poprhythm
c23ff52563
Two cryptominer incursions (inbox-zero, then gitea) went unnoticed until found manually — there was no alerting on sustained host CPU. Wired netdata's existing 10min_cpu_usage alarm to notify via the shared Telegram bot (config is host-only, not committed). Also narrowed the dashboard port from 0.0.0.0 to the host's LAN IP to reduce exposure.
43 lines
1.2 KiB
YAML
43 lines
1.2 KiB
YAML
version: '3'
|
|
|
|
services:
|
|
netdata:
|
|
container_name: netdata
|
|
image: netdata/netdata:latest
|
|
restart: unless-stopped
|
|
hostname: ${HOSTNAME:-docker-host}
|
|
ports:
|
|
# Bound to the host's LAN IP (not 0.0.0.0) so the dashboard stays
|
|
# reachable from the LAN but isn't listening on every interface.
|
|
# NOTE: this host's LAN IP is DHCP-assigned — if it changes, update
|
|
# this binding to match.
|
|
- 192.168.1.67:19999:19999
|
|
cap_add:
|
|
- SYS_PTRACE
|
|
- SYS_ADMIN
|
|
security_opt:
|
|
- apparmor:unconfined
|
|
environment:
|
|
- TZ=${TZ}
|
|
- DOCKER_HOST=/var/run/docker.sock
|
|
volumes:
|
|
# Docker socket for container monitoring
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
|
|
# Host system monitoring
|
|
- /proc:/host/proc:ro
|
|
- /sys:/host/sys:ro
|
|
- /etc/os-release:/host/etc/os-release:ro
|
|
- /etc/passwd:/host/etc/passwd:ro
|
|
- /etc/group:/host/etc/group:ro
|
|
|
|
# Netdata config and data persistence
|
|
- /srv/netdata/config:/etc/netdata
|
|
- /srv/netdata/lib:/var/lib/netdata
|
|
- /srv/netdata/cache:/var/cache/netdata
|
|
|
|
volumes:
|
|
netdata-config:
|
|
netdata-lib:
|
|
netdata-cache:
|