services:
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus-data:/prometheus
    restart: unless-stopped

  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    ports:
      - 172.20.10.227:3001:3000
    volumes:
      - grafana-data:/var/lib/grafana
      - ./grafana/dashboards:/etc/grafana/provisioning/dashboards
      - ./grafana/datasources:/etc/grafana/provisioning/datasources
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=
      - GF_SERVER_ROOT_URL=https://grafana.netbird.smavs.duckdns.org
      - GF_AUTH_GENERIC_OAUTH_ENABLED=true
      - GF_AUTH_GENERIC_OAUTH_NAME=authentik 
      - GF_AUTH_GENERIC_OAUTH_CLIENT_ID=   #client e secret visibili da authentik
      - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=
      - GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email entitlements
      - GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://auth.netbird.smavs.duckdns.org/application/o/authorize/
      - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://auth.netbird.smavs.duckdns.org/application/o/token/
      - GF_AUTH_GENERIC_OAUTH_API_URL=https://auth.netbird.smavs.duckdns.org/application/o/userinfo/
      - GF_AUTH_SIGNOUT_REDIRECT_URL=https://auth.netbird.smavs.duckdns.org//application/o/grafana/end-session/
    # Optionally enable auto-login (bypasses Grafana login screen)
      - GF_AUTH_OAUTH_AUTO_LOGIN=true
    # Optionally map user entitlements to Grafana roles
      - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(entitlements[*], 'Grafana Admins') && 'Admin' || contains(entitlements[*], 'Grafana Editors') && 'Editor' || 'Viewer'
    restart: unless-stopped

volumes:
  prometheus-data:
  grafana-data: