version: "3.2"

networks:
  traefik_swarm:
    external: true

volumes:
  grafana_data:
    driver: local
    driver_opts:
      type: "nfs"
      o: addr=10.0.20.30,nolock,soft,rw
      device: ":/volume1/swarm/monitoring/grafana_db"

secrets:
  GF_ADMIN_PASSWORD:
    external: true

services:
  grafana:
    image: grafana/grafana:8.2.7
    user: "1028"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD__FILE=/run/secrets/GF_ADMIN_PASSWORD
    volumes:
      - grafana_data:/var/lib/grafana
    depends_on:
      - prometheus
    secrets:
      - "GF_ADMIN_PASSWORD"
    networks:
      - traefik_swarm
    logging:
      driver: loki:latest
      options:
        loki-url: "http://master.server:3100/loki/api/v1/push"
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints: [node.platform.os == linux]
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.grafana.entrypoints=websecure"
        - "traefik.http.routers.grafana.rule=Host(`grafana.domain.me`)"
        - "traefik.http.routers.grafana.tls.certresolver=cf-cert"
        - "traefik.http.routers.grafana.middlewares=secure-headers@file"
        - "traefik.http.services.grafana.loadbalancer.server.port=3000"