82 lines
3.1 KiB
YAML
82 lines
3.1 KiB
YAML
# Prometheus scrape configuration for the boilerplate.
|
|
#
|
|
# Scrapes the three application processes' /metrics endpoints with
|
|
# bearer-token authentication. METRICS_TOKEN is injected via the
|
|
# `metrics_token` file (Docker Secret) or the PROM_METRICS_TOKEN env var
|
|
# at compose-up time.
|
|
#
|
|
# Targets:
|
|
# * api — apps/api admin metrics surface (port 3201 default)
|
|
# * worker — apps/worker admin server (port 9101 default; 9100 is health-probe)
|
|
# * web — apps/web SSR resource route on /api/metrics
|
|
#
|
|
# Operator deploys this on the Hetzner staging server alongside Sentry.
|
|
|
|
global:
|
|
scrape_interval: 15s
|
|
scrape_timeout: 10s
|
|
evaluation_interval: 15s
|
|
external_labels:
|
|
cluster: boilerplate
|
|
environment: staging
|
|
|
|
scrape_configs:
|
|
- job_name: boilerplate-api
|
|
metrics_path: /metrics
|
|
scheme: https
|
|
authorization:
|
|
type: Bearer
|
|
credentials_file: /etc/prometheus/secrets/metrics_token
|
|
static_configs:
|
|
- targets: ["api.boiler.saas-ctrl.com"]
|
|
labels:
|
|
service: api
|
|
|
|
- job_name: boilerplate-worker
|
|
metrics_path: /metrics
|
|
scheme: http
|
|
authorization:
|
|
type: Bearer
|
|
credentials_file: /etc/prometheus/secrets/metrics_token
|
|
static_configs:
|
|
# Worker admin server runs inside the private network on
|
|
# WORKER_ADMIN_PORT (9101 default for the general queue group;
|
|
# 9102/9103/9104 for mail/import/webhook groups per #45).
|
|
#
|
|
# OPERATOR WIRING REQUIRED — pick one:
|
|
# (a) Attach Prometheus to the same Docker network as the worker
|
|
# and use the worker container's stable alias (in Coolify v4
|
|
# the UUID-based generated name changes on every redeploy
|
|
# so you must either add a docker-compose override that
|
|
# sets `networks.<net>.aliases: [boilerplate-worker]` or
|
|
# use Coolify's "Internal-only" service feature).
|
|
# (b) Expose the worker admin server through Traefik on a
|
|
# dedicated hostname (e.g. worker-admin.<domain>) with a
|
|
# Traefik IPAllowList middleware restricted to the
|
|
# Prometheus host, plus the standard Bearer-token auth.
|
|
#
|
|
# Until (a) or (b) is wired the worker job stays DOWN; api+web
|
|
# cover the HTTP-side metrics, the per-queue queue_jobs_*
|
|
# counters from the worker registry are not yet visible.
|
|
- targets: ["worker.boilerplate.internal:9101"]
|
|
labels:
|
|
service: worker
|
|
|
|
- job_name: boilerplate-web
|
|
metrics_path: /api/metrics
|
|
scheme: https
|
|
authorization:
|
|
type: Bearer
|
|
credentials_file: /etc/prometheus/secrets/metrics_token
|
|
static_configs:
|
|
# /api/metrics is admin-only — the resource route is mounted on
|
|
# the admin host. Scraping the tenant-facing host returns 404 by
|
|
# design. Use admin.<domain> for staging; in prod set to
|
|
# admin.<prod-domain>.
|
|
- targets: ["admin.boiler.saas-ctrl.com"]
|
|
labels:
|
|
service: web
|
|
|
|
# When promoting to production, also scrape the production targets behind
|
|
# their own bearer-token. Add scrape_configs entries with environment=production.
|