Secure MCP Server

version: '3.9' services: prometheus: image: prom/prometheus:v2.48.1 container_name: prometheus command: - '--config.file=/etc/prometheus/prometheus.yml' - '--storage.tsdb.path=/prometheus' - '--web.enable-lifecycle' - '--web.enable-admin-api' - '--storage.tsdb.retention.time=30d' - '--storage.tsdb.retention.size=10GB' volumes: - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml - ./prometheus/alerts.yml:/etc/prometheus/alerts.yml - prometheus_data:/prometheus ports: - "9090:9090" networks: - monitoring restart: unless-stopped grafana: image: grafana/grafana:10.2.3 container_name: grafana environment: - GF_SECURITY_ADMIN_USER=admin - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-admin} - GF_SERVER_ROOT_URL=http://localhost:3001 - GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource - GF_AUTH_ANONYMOUS_ENABLED=false - GF_AUTH_DISABLE_LOGIN_FORM=false - GF_AUTH_OAUTH_AUTO_LOGIN=false - GF_SECURITY_COOKIE_SECURE=true - GF_SECURITY_STRICT_TRANSPORT_SECURITY=true - GF_SECURITY_CONTENT_SECURITY_POLICY=true volumes: - ./grafana/provisioning:/etc/grafana/provisioning - ./grafana/dashboards:/var/lib/grafana/dashboards - grafana_data:/var/lib/grafana ports: - "3001:3000" networks: - monitoring restart: unless-stopped depends_on: - prometheus alertmanager: image: prom/alertmanager:v0.27.0 container_name: alertmanager command: - '--config.file=/etc/alertmanager/config.yml' - '--storage.path=/alertmanager' - '--web.route-prefix=/' volumes: - ./alertmanager/config.yml:/etc/alertmanager/config.yml - alertmanager_data:/alertmanager ports: - "9093:9093" networks: - monitoring restart: unless-stopped node-exporter: image: prom/node-exporter:v1.7.0 container_name: node-exporter command: - '--path.procfs=/host/proc' - '--path.sysfs=/host/sys' - '--path.rootfs=/rootfs' - '--collector.filesystem.mount-points-exclude=^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/.+)($|/)' - '--collector.netclass.ignored-devices=^(veth.*)$' volumes: - /proc:/host/proc:ro - /sys:/host/sys:ro - /:/rootfs:ro ports: - "9100:9100" networks: - monitoring restart: unless-stopped privileged: true security_opt: - no-new-privileges:true cadvisor: image: gcr.io/cadvisor/cadvisor:v0.47.2 container_name: cadvisor volumes: - /:/rootfs:ro - /var/run:/var/run:ro - /sys:/sys:ro - /var/lib/docker/:/var/lib/docker:ro - /dev/disk/:/dev/disk:ro ports: - "8080:8080" networks: - monitoring restart: unless-stopped privileged: true devices: - /dev/kmsg jaeger: image: jaegertracing/all-in-one:1.52 container_name: jaeger environment: - COLLECTOR_OTLP_ENABLED=true - SPAN_STORAGE_TYPE=badger - BADGER_EPHEMERAL=false - BADGER_DIRECTORY_VALUE=/badger/data - BADGER_DIRECTORY_KEY=/badger/key - METRICS_STORAGE_TYPE=prometheus - PROMETHEUS_SERVER_URL=http://prometheus:9090 volumes: - jaeger_data:/badger ports: - "5775:5775/udp" # Zipkin compact - "6831:6831/udp" # Jaeger compact - "6832:6832/udp" # Jaeger binary - "5778:5778" # Configs - "16686:16686" # UI - "14268:14268" # Direct ingestion - "14269:14269" # Admin - "4317:4317" # OTLP gRPC - "4318:4318" # OTLP HTTP networks: - monitoring restart: unless-stopped elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:8.11.3 container_name: elasticsearch environment: - discovery.type=single-node - xpack.security.enabled=true - xpack.security.authc.api_key.enabled=true - ELASTIC_PASSWORD=${ELASTIC_PASSWORD:-elastic} - "ES_JAVA_OPTS=-Xms2g -Xmx2g" - cluster.routing.allocation.disk.threshold_enabled=false volumes: - elasticsearch_data:/usr/share/elasticsearch/data ports: - "9200:9200" - "9300:9300" networks: - monitoring restart: unless-stopped ulimits: memlock: soft: -1 hard: -1 nofile: soft: 65536 hard: 65536 kibana: image: docker.elastic.co/kibana/kibana:8.11.3 container_name: kibana environment: - ELASTICSEARCH_HOSTS=http://elasticsearch:9200 - ELASTICSEARCH_USERNAME=elastic - ELASTICSEARCH_PASSWORD=${ELASTIC_PASSWORD:-elastic} - XPACK_SECURITY_ENABLED=true - XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY=a7a6311933d3503b89bc2dbc36572c33a6c10925682e591bffcab6911c06786d ports: - "5601:5601" networks: - monitoring restart: unless-stopped depends_on: - elasticsearch logstash: image: docker.elastic.co/logstash/logstash:8.11.3 container_name: logstash volumes: - ./logstash/pipeline:/usr/share/logstash/pipeline - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml ports: - "5000:5000/tcp" - "5000:5000/udp" - "9600:9600" environment: - "LS_JAVA_OPTS=-Xms1g -Xmx1g" - ELASTICSEARCH_HOSTS=http://elasticsearch:9200 - ELASTICSEARCH_USERNAME=elastic - ELASTICSEARCH_PASSWORD=${ELASTIC_PASSWORD:-elastic} networks: - monitoring restart: unless-stopped depends_on: - elasticsearch tempo: image: grafana/tempo:2.3.1 container_name: tempo command: [ "-config.file=/etc/tempo.yaml" ] volumes: - ./tempo/tempo.yaml:/etc/tempo.yaml - tempo_data:/tmp/tempo ports: - "3200:3200" # tempo - "4318:4318" # otlp http - "4317:4317" # otlp grpc - "9411:9411" # zipkin - "14268:14268" # jaeger ingest networks: - monitoring restart: unless-stopped loki: image: grafana/loki:2.9.4 container_name: loki command: -config.file=/etc/loki/local-config.yaml volumes: - ./loki/loki-config.yaml:/etc/loki/local-config.yaml - loki_data:/loki ports: - "3100:3100" networks: - monitoring restart: unless-stopped promtail: image: grafana/promtail:2.9.4 container_name: promtail volumes: - ./promtail/config.yml:/etc/promtail/config.yml - /var/log:/var/log:ro - /var/lib/docker/containers:/var/lib/docker/containers:ro command: -config.file=/etc/promtail/config.yml networks: - monitoring restart: unless-stopped depends_on: - loki otel-collector: image: otel/opentelemetry-collector-contrib:0.92.0 container_name: otel-collector command: [ "--config=/etc/otel-collector-config.yaml" ] volumes: - ./otel/otel-collector-config.yaml:/etc/otel-collector-config.yaml ports: - "1888:1888" # pprof extension - "8888:8888" # Prometheus metrics exposed by the collector - "8889:8889" # Prometheus exporter metrics - "13133:13133" # health_check extension - "4317:4317" # OTLP gRPC receiver - "4318:4318" # OTLP HTTP receiver - "55679:55679" # zpages extension networks: - monitoring restart: unless-stopped depends_on: - jaeger - prometheus - tempo networks: monitoring: driver: bridge ipam: config: - subnet: 172.25.0.0/16 volumes: prometheus_data: grafana_data: alertmanager_data: elasticsearch_data: loki_data: tempo_data: jaeger_data: