cedricandClaude Opus 5.5
42f6137391
- ALLOW_PURGE is now false by default; the UI shows a banner when there is no authentication. - Read-only role: AUTH_VIEWER_USER/AUTH_VIEWER_PASS in local mode, or OIDC_ADMIN_GROUP in OIDC mode; changes get 403 and the admin settings are greyed out. - Content-Security-Policy (inline scripts allowed by hash) and other security headers; cross-site changes are refused. - Syslog TCP: at most SYSLOG_TCP_MAX_CONNS connections, closed after SYSLOG_TCP_IDLE of silence; HTTP idle timeout. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
87 lines
3.9 KiB
YAML
87 lines
3.9 KiB
YAML
services:
|
|
logstream:
|
|
build: .
|
|
container_name: logstream
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- victorialogs
|
|
- docker-proxy
|
|
ports:
|
|
- "${SYSLOG_PORT:-514}:5514/udp"
|
|
- "${SYSLOG_PORT:-514}:5514/tcp"
|
|
- "${HTTP_PORT:-8080}:8080"
|
|
environment:
|
|
VLOGS_URL: http://victorialogs:9428
|
|
SYSLOG_PUBLIC_PORT: ${SYSLOG_PORT:-514} # le port d'ecoute syslog par defaut (attention aux ports <1024)
|
|
TZ: ${TZ:-Europe/Paris}
|
|
AUTH_MODE: ${AUTH_MODE:-local} # local (page de connexion, compte ci-dessous) ou oidc
|
|
AUTH_USER: ${AUTH_USER:-} # vide = pas d'authentification, on delegue ca au reverse proxy traefik
|
|
AUTH_PASS: ${AUTH_PASS:-}
|
|
AUTH_VIEWER_USER: ${AUTH_VIEWER_USER:-} # compte en lecture seule (optionnel)
|
|
AUTH_VIEWER_PASS: ${AUTH_VIEWER_PASS:-}
|
|
LOGIN_LOGO: ${LOGIN_LOGO:-} # PNG affiche sur la page de connexion (chemin dans le conteneur, voir volumes)
|
|
PRESETS_FILE: ${PRESETS_FILE:-} # prereglages de tags (defaut /data/presets.json, voir docs/presets.fr.md)
|
|
OIDC_ISSUER: ${OIDC_ISSUER:-}
|
|
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
|
|
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
|
|
OIDC_REDIRECT_URL: ${OIDC_REDIRECT_URL:-}
|
|
OIDC_SCOPES: ${OIDC_SCOPES:-openid profile email}
|
|
OIDC_ADMIN_GROUP: ${OIDC_ADMIN_GROUP:-} # vide = tout le monde est admin, sinon les autres sont en lecture seule
|
|
OIDC_GROUPS_CLAIM: ${OIDC_GROUPS_CLAIM:-groups}
|
|
SESSION_TTL: ${SESSION_TTL:-${OIDC_SESSION_TTL:-12h}} # duree de la session (local et oidc)
|
|
RDNS: ${RDNS:-on} # resol dns
|
|
DNS_SERVER: ${DNS_SERVER:-} # si resolv directe
|
|
ALLOW_PURGE: ${ALLOW_PURGE:-false} # true pour autoriser « Supprimer tous les logs »
|
|
EXPORT_MAX: ${EXPORT_MAX:-100000}
|
|
DOCKER_LOGS: ${DOCKER_LOGS:-on} # collecte des logs des conteneurs Docker
|
|
DOCKER_HOST: tcp://docker-proxy:2375 # lecture seul de l'API Docker
|
|
DOCKER_BACKFILL: ${DOCKER_BACKFILL:-1h}
|
|
HOST_LOGS_BACKFILL: ${HOST_LOGS_BACKFILL:-1h} # historique lu a l'activation des logs systeme de l'hote
|
|
group_add:
|
|
- "${HOST_LOGS_GID:-4}" # groupe autorise a lire les logs de l'hote (4 = adm sur Debian/Ubuntu)
|
|
volumes:
|
|
- logstream-data:/data # tags.json, docker.json (les choix des conteneurs)
|
|
# logs systeme de l'hote, en lecture seule (source a activer dans Reglages > Sources)
|
|
- /var/log:/host/var/log:ro # journal systemd persistant et fichiers texte
|
|
- /run/log/journal:/host/run/log/journal:ro # journal systemd volatile
|
|
# logo de la page de connexion, avec LOGIN_LOGO=/config/logo.png dans .env
|
|
# - ./logo.png:/config/logo.png:ro
|
|
# prereglages de tags personnalises, avec PRESETS_FILE=/config/presets.json dans .env
|
|
# - ./presets.json:/config/presets.json:ro
|
|
labels:
|
|
logstream.exclude: "true" # pas de collect des logs logstream
|
|
|
|
victorialogs:
|
|
image: victoriametrics/victoria-logs:v1.52.0
|
|
container_name: logstream-victorialogs
|
|
restart: unless-stopped
|
|
command:
|
|
- -storageDataPath=/vlogs
|
|
- -retentionPeriod=${RETENTION:-30d}
|
|
- -httpListenAddr=:9428
|
|
- -delete.enable # obliger pour autoriser la purge de la base via l'interface
|
|
volumes:
|
|
- vlogs-data:/vlogs
|
|
ports:
|
|
# VictoriaLogs debug UI (http://localhost:9428/select/vmui), localhost only
|
|
- "127.0.0.1:9428:9428"
|
|
|
|
docker-proxy:
|
|
# Docker proxy pour eviter de solliciter directement l'API docker
|
|
image: tecnativa/docker-socket-proxy:v0.5.0
|
|
container_name: logstream-docker-proxy
|
|
restart: unless-stopped
|
|
environment:
|
|
CONTAINERS: 1
|
|
EVENTS: 1
|
|
INFO: 1
|
|
POST: 0
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
labels:
|
|
logstream.exclude: "true" # pour exclure les logs propres de logstream
|
|
|
|
volumes:
|
|
logstream-data:
|
|
vlogs-data:
|