christianmaier/base-prometheus repository overview

⁠base-prometheus

The metrics store of the base platform: the official Prometheus⁠ with the platform's scrape configuration baked in.

⁠Tags

One tag per release, X.Y.Z, the same version as base-caddy and base-grafana of that release (first: 2.1.0). There is no latest: deployments reference a version and its digest.

Platforms: linux/amd64, linux/arm64.

⁠What is inside

• prom/prometheus, pinned by digest
• /etc/prometheus/prometheus.yml: scrapes Caddy's metrics every 15 s
• Retention of 30 days

⁠Running

Port: 9090, meant for an internal Docker network only, never published.

services:
  prometheus:
    image: christianmaier/base-prometheus:2.1.0
    volumes: ["prometheus-data:/prometheus"]
    networks: [observability]
    read_only: true
    cap_drop: ["ALL"]
    security_opt: ["no-new-privileges:true"]
networks:
  observability:
    internal: true
volumes:
  prometheus-data: {}

The target caddy:2020 is expected in the same network. Caddy answers there only to that network's subnet.

⁠Security

• Runs as nobody, needs no capabilities, read-only root filesystem
• Neither the admin API nor the lifecycle API is enabled
• Before every release and weekly: scanned for vulnerabilities with a fix (Trivy), for Dockerfile misconfigurations and for secrets (gitleaks)
• SBOM (SPDX) and build provenance attached to every release