Changed how all docker images have their version set to use the compose repo

butane/monitor.yaml.tftpl

@@ -13,6 +13,8 @@ version: 1.0.0
 # VMs (see the dozzle-agent units in the other butane configs) and, via the
 # local socket, from this host's own containers. Reachable on :8080.
 #
+# Also runs Alerta on :8082; see alerta.service below.
+#
 # No state is kept on disk: /data is a tmpfs, so the container is fully
 # disposable and there is nothing to back up. That is also why simple auth
 # (users.yml) is not used -- it would need a persistent /data.
@@ -20,10 +22,11 @@ version: 1.0.0
 # Hub <-> agent traffic is TLS, using the certificate pair baked into the
 # dozzle image. Every hub and agent on the same image version shares it, so
 # nothing needs mounting here -- which is also why the agents must stay pinned
-# to the same tag as the hub. To move to a custom pair later, generate one
-# with (writes into $PWD):
+# to the same tag as the hub (DOZZLE_IMAGE in versions.env). To move to a
+# custom pair later, generate one with (writes into $PWD, using the tag from
+# DOZZLE_IMAGE):
 #
-#   docker run --rm -v "$PWD":/out amir20/dozzle:v11.1.1 generate-certs \
+#   docker run --rm -v "$PWD":/out amir20/dozzle:<tag> generate-certs \
 #     --cert-out /out/dozzle_cert.pem --key-out /out/dozzle_key.pem
 #
 # ...then mount it at /dozzle_cert.pem and /dozzle_key.pem (read-only) on the
@@ -37,9 +40,12 @@ systemd:
       contents: |
         [Unit]
         Description=Dozzle log viewer hub
-        After=docker.service
+        After=docker.service versions-fetch.service
         Requires=docker.service
+        Wants=versions-fetch.service
         [Service]
+        # Image tag comes from versions.env; see butane/versions-sync.yaml.
+        EnvironmentFile=/etc/versions.env
         TimeoutStartSec=0
         # Kept as unit environment rather than inline -e values so that
         # wait-for-agents.sh can read the agent list from the same place the
@@ -63,7 +69,7 @@ systemd:
         Environment="DOZZLE_AUTH_OIDC_SCOPES=dozzle_roles,picture"
         Environment="DOZZLE_AUTH_OIDC_ROLES_CLAIM=dozzle_roles"
         # Pulled up front so a slow first pull is not mistaken for a hung unit.
-        ExecStartPre=/usr/bin/docker pull amir20/dozzle:v11.1.1
+        ExecStartPre=/usr/bin/docker pull $${DOZZLE_IMAGE}
         # Leading "-" so a missing container is not a failure.
         ExecStartPre=-/usr/bin/docker rm --force dozzle
         # If the hub starts before the agents are listening, the failed initial
@@ -85,7 +91,7 @@ systemd:
           -e DOZZLE_AUTH_OIDC_NAME \
           -e DOZZLE_AUTH_OIDC_SCOPES \
           -e DOZZLE_AUTH_OIDC_ROLES_CLAIM \
-          amir20/dozzle:v11.1.1
+          $${DOZZLE_IMAGE}
         ExecStop=/usr/bin/docker stop dozzle
         Restart=always
         RestartSec=5s
@@ -108,15 +114,18 @@ systemd:
       contents: |
         [Unit]
         Description=Dozzle MCP endpoint
-        After=docker.service
+        After=docker.service versions-fetch.service
         Requires=docker.service
+        Wants=versions-fetch.service
         [Service]
+        # Image tag comes from versions.env; see butane/versions-sync.yaml.
+        EnvironmentFile=/etc/versions.env
         TimeoutStartSec=0
         # Same agents as the hub, same file, so the two cannot drift.
         EnvironmentFile=/etc/dozzle/agents.env
         Environment="DOZZLE_HOSTNAME=Oswald Logs (MCP)"
         Environment="DOZZLE_ENABLE_MCP=true"
-        ExecStartPre=/usr/bin/docker pull amir20/dozzle:v11.1.1
+        ExecStartPre=/usr/bin/docker pull $${DOZZLE_IMAGE}
         ExecStartPre=-/usr/bin/docker rm --force dozzle-mcp
         ExecStartPre=-/usr/bin/timeout 180 /opt/dozzle/wait-for-agents.sh
         ExecStart=/usr/bin/docker run --rm --name dozzle-mcp \
@@ -126,12 +135,73 @@ systemd:
           -e DOZZLE_HOSTNAME \
           -e DOZZLE_REMOTE_AGENT \
           -e DOZZLE_ENABLE_MCP \
-          amir20/dozzle:v11.1.1
+          $${DOZZLE_IMAGE}
         ExecStop=/usr/bin/docker stop dozzle-mcp
         Restart=always
         RestartSec=5s
         [Install]
         WantedBy=multi-user.target
+    # Alerta alert console (API + web UI) on :8082.
+    #
+    # Prerequisites, all of which must exist before the VM is rebuilt:
+    #   - an "alerta" Postgres database and role; the schema is created on
+    #     first start
+    #   - an OIDC client for Alerta in Authelia, with the Alerta URL as a
+    #     redirect URI and token_endpoint_auth_method client_secret_basic
+    #   - ALERTA_DATABASE_URL, ALERTA_SECRET_KEY, ALERTA_ADMIN_PASSWORD,
+    #     ALERTA_OIDC_CLIENT_ID and ALERTA_OIDC_CLIENT_SECRET in
+    #     Infisical (see secrets.tmpl). Every Butane file is rendered on every
+    #     plan, so until they exist no plan succeeds -- not just this VM's.
+    #     Generate the key with `openssl rand -hex 32`, and keep "%" out of
+    #     the database URL: systemd reads it as a specifier
+    #
+    # Alerts, users and API keys all live in Postgres, so a taint loses
+    # nothing. SECRET_KEY signs login tokens; without a fixed one the image
+    # generates a new one per start and every session is dropped.
+    #
+    # ADMIN_PASSWORD is used only when the admin user does not exist yet.
+    # Changing it in Infisical afterwards has no effect: change it in the UI.
+    # Web logins go through Authelia; the basic-auth admin user is kept for
+    # API access. Self sign-up is off, so further users are added by the admin.
+    #
+    # --log-driver none keeps this container out of Dozzle. The image's
+    # entrypoint dumps its whole environment and prints the admin API key at
+    # every start, and dozzle-mcp above serves logs without auth. Output
+    # still reaches the journal (journalctl -u alerta) through the attached
+    # docker run.
+    - name: alerta.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Alerta alert console
+        After=docker.service versions-fetch.service
+        Requires=docker.service
+        Wants=versions-fetch.service
+        [Service]
+        # Image tag comes from versions.env; see butane/versions-sync.yaml.
+        EnvironmentFile=/etc/versions.env
+        TimeoutStartSec=0
+        ExecStartPre=/usr/bin/docker pull $${ALERTA_IMAGE}
+        ExecStartPre=-/usr/bin/docker rm --force alerta
+        ExecStart=/usr/bin/docker run --rm --name alerta \
+          --log-driver none \
+          -e DATABASE_URL=${alerta_database_url} \
+          -e SECRET_KEY=${alerta_secret_key} \
+          -e AUTH_REQUIRED=True \
+          -e AUTH_PROVIDER=openid \
+          -e OIDC_ISSUER_URL=https://auth.atlashorizon.net \
+          -e OAUTH2_CLIENT_ID=${alerta_oidc_client_id} \
+          -e OAUTH2_CLIENT_SECRET=${alerta_oidc_client_secret} \
+          -e SIGNUP_ENABLED=True \
+          -e ADMIN_USERS=admin \
+          -e ADMIN_PASSWORD=${alerta_admin_password} \
+          -p 8082:8080 \
+          $${ALERTA_IMAGE}
+        ExecStop=/usr/bin/docker stop alerta
+        Restart=always
+        RestartSec=5s
+        [Install]
+        WantedBy=multi-user.target
 
 storage:
   files:
@@ -142,7 +212,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          DOZZLE_REMOTE_AGENT=192.168.7.60:7007|oswald-runner|Goose,192.168.7.61:7007|ai|Goose,192.168.7.62:7007|oswl-connector|Goose,192.168.7.64:7007|cisa-kev-rss|Goose,192.168.7.4:7007|PortaNAS|Portanas
+          DOZZLE_REMOTE_AGENT=192.168.7.60:7007|oswald-runner|Goose,192.168.7.61:7007|ai|Goose,192.168.7.62:7007|oswl-connector|Goose,192.168.20.74:7007|Argo|Truenas,192.168.20.4:7007|Atalantia|Truenas,192.168.7.4:7007|Goldie|Truenas,192.168.20.217:7007|Laika|CallieCorner
     # Blocks until every agent named in DOZZLE_REMOTE_AGENT accepts a TCP
     # connection. The list is read from the environment, so adding or removing
     # an agent above needs no change here.