5005a4980a
- Bind Loki to 127.0.0.1:3100 instead of 0.0.0.0:3100 to prevent external access - Add Traefik labels for secure HTTPS access with Authentik authentication - Bind Blackbox Exporter to 127.0.0.1:9115 instead of 0.0.0.0:9115 - Add Traefik labels for secure monitoring dashboard access - Enable Authentik middleware for Portainer (was disabled temporarily) - Services are now only accessible through Traefik reverse proxy with HTTPS and SSO Fixes critical security issues: - Prevents direct access to monitoring services (CVSS 9.8-9.1) - Eliminates log file exposure through public Loki port - Restricts infrastructure reconnaissance via Blackbox exporter - Enforces authentication for critical management tools 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
45 lines
1.2 KiB
YAML
45 lines
1.2 KiB
YAML
version: '3.8'
|
|
|
|
services:
|
|
loki:
|
|
image: grafana/loki:latest
|
|
container_name: loki
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:3100:3100"
|
|
command: -config.file=/etc/loki/local-config.yaml
|
|
volumes:
|
|
- loki-data:/loki
|
|
- ./loki-config.yaml:/etc/loki/local-config.yaml
|
|
networks:
|
|
- monitoring_monitoring
|
|
- traefik-public
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.loki.rule=Host(`loki.ai-impress.com`)"
|
|
- "traefik.http.routers.loki.entrypoints=websecure"
|
|
- "traefik.http.routers.loki.tls.certresolver=cloudflare"
|
|
- "traefik.http.routers.loki.middlewares=authentik@file"
|
|
- "traefik.http.services.loki.loadbalancer.server.port=3100"
|
|
|
|
promtail:
|
|
image: grafana/promtail:latest
|
|
container_name: promtail
|
|
restart: unless-stopped
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- /var/lib/docker/containers:/var/lib/docker/containers:ro
|
|
- /opt:/opt:ro
|
|
- ./promtail-config.yaml:/etc/promtail/config.yaml
|
|
command: -config.file=/etc/promtail/config.yaml
|
|
networks:
|
|
- monitoring_monitoring
|
|
|
|
volumes:
|
|
loki-data:
|
|
|
|
networks:
|
|
monitoring_monitoring:
|
|
external: true
|
|
traefik-public:
|
|
external: true
|