cedricandClaude Opus 5.5
f30c353b46
AUTH_MODE=local keeps the HTTP Basic authentication (unchanged default); AUTH_MODE=oidc logs in through an OpenID Connect provider with the authorization code flow and PKCE, standard library only: discovery, ID token signature (RS/PS/ES) and claims checks, signed session cookie whose key is kept in DATA_DIR. The UI gets a log out button and reloads into the login when the session ends. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
77 lines
3.0 KiB
YAML
77 lines
3.0 KiB
YAML
services:
|
|
logstream:
|
|
build: .
|
|
container_name: logstream
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- victorialogs
|
|
- docker-proxy
|
|
ports:
|
|
- "${SYSLOG_PORT:-514}:5514/udp"
|
|
- "${SYSLOG_PORT:-514}:5514/tcp"
|
|
- "${HTTP_PORT:-8080}:8080"
|
|
environment:
|
|
VLOGS_URL: http://victorialogs:9428
|
|
SYSLOG_PUBLIC_PORT: ${SYSLOG_PORT:-514} # le port d'ecoute syslog par defaut (attention aux ports <1024)
|
|
TZ: ${TZ:-Europe/Paris}
|
|
AUTH_MODE: ${AUTH_MODE:-local} # local (Basic Auth ci-dessous) ou oidc
|
|
AUTH_USER: ${AUTH_USER:-} # vide = pas d'authentification, on delegue ca au reverse proxy traefik
|
|
AUTH_PASS: ${AUTH_PASS:-}
|
|
OIDC_ISSUER: ${OIDC_ISSUER:-}
|
|
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
|
|
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
|
|
OIDC_REDIRECT_URL: ${OIDC_REDIRECT_URL:-}
|
|
OIDC_SCOPES: ${OIDC_SCOPES:-openid profile email}
|
|
OIDC_SESSION_TTL: ${OIDC_SESSION_TTL:-12h}
|
|
RDNS: ${RDNS:-on} # resol dns
|
|
DNS_SERVER: ${DNS_SERVER:-} # si resolv directe
|
|
ALLOW_PURGE: ${ALLOW_PURGE:-true}
|
|
EXPORT_MAX: ${EXPORT_MAX:-100000}
|
|
DOCKER_LOGS: ${DOCKER_LOGS:-on} # collecte des logs des conteneurs Docker
|
|
DOCKER_HOST: tcp://docker-proxy:2375 # lecture seul de l'API Docker
|
|
DOCKER_BACKFILL: ${DOCKER_BACKFILL:-1h}
|
|
HOST_LOGS_BACKFILL: ${HOST_LOGS_BACKFILL:-1h} # historique lu a l'activation des logs systeme de l'hote
|
|
group_add:
|
|
- "${HOST_LOGS_GID:-4}" # groupe autorise a lire les logs de l'hote (4 = adm sur Debian/Ubuntu)
|
|
volumes:
|
|
- logstream-data:/data # tags.json, docker.json (les choix des conteneurs)
|
|
# logs systeme de l'hote, en lecture seule (source a activer dans Reglages > Sources)
|
|
- /var/log:/host/var/log:ro # journal systemd persistant et fichiers texte
|
|
- /run/log/journal:/host/run/log/journal:ro # journal systemd volatile
|
|
labels:
|
|
logstream.exclude: "true" # pas de collect des logs logstream
|
|
|
|
victorialogs:
|
|
image: victoriametrics/victoria-logs:v1.52.0
|
|
container_name: logstream-victorialogs
|
|
restart: unless-stopped
|
|
command:
|
|
- -storageDataPath=/vlogs
|
|
- -retentionPeriod=${RETENTION:-30d}
|
|
- -httpListenAddr=:9428
|
|
- -delete.enable # obliger pour autoriser la purge de la base via l'interface
|
|
volumes:
|
|
- vlogs-data:/vlogs
|
|
ports:
|
|
# VictoriaLogs debug UI (http://localhost:9428/select/vmui), localhost only
|
|
- "127.0.0.1:9428:9428"
|
|
|
|
docker-proxy:
|
|
# Docker proxy pour eviter de solliciter directement l'API docker
|
|
image: tecnativa/docker-socket-proxy:v0.5.0
|
|
container_name: logstream-docker-proxy
|
|
restart: unless-stopped
|
|
environment:
|
|
CONTAINERS: 1
|
|
EVENTS: 1
|
|
INFO: 1
|
|
POST: 0
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
labels:
|
|
logstream.exclude: "true" # pour exclure les logs propres de logstream
|
|
|
|
volumes:
|
|
logstream-data:
|
|
vlogs-data:
|