diff --git a/docker/telemetry/docker-compose.workload.yaml b/docker/telemetry/docker-compose.workload.yaml index 5e81570f95..59a9f9047c 100644 --- a/docker/telemetry/docker-compose.workload.yaml +++ b/docker/telemetry/docker-compose.workload.yaml @@ -40,11 +40,17 @@ services: otel-collector: image: otel/opentelemetry-collector-contrib:0.158.0 command: ["--config=/etc/otel-collector-config.yaml"] + # Published on the host loopback only. The receivers have no auth and no + # TLS, so only processes on this host may reach them. Note this 127.0.0.1 + # is the HOST interface docker listens on; the container-side bind lives in + # the collector config and is a separate choice. Upstream asks for a + # specific interface rather than 0.0.0.0 on either side (CWE-1327): + # https://opentelemetry.io/docs/security/config-best-practices/ ports: - - "4317:4317" # OTLP gRPC - - "4318:4318" # OTLP HTTP (traces + beast::insight metrics) - - "8889:8889" # Prometheus metrics endpoint - - "13133:13133" # Health check + - "127.0.0.1:4317:4317" # OTLP gRPC + - "127.0.0.1:4318:4318" # OTLP HTTP (traces + beast::insight metrics) + - "127.0.0.1:8889:8889" # Prometheus metrics endpoint + - "127.0.0.1:13133:13133" # Health check volumes: - ./otel-collector-config.yaml:/etc/otel-collector-config.yaml:ro # Mount the validation workdir so the file_log receiver can tail node @@ -60,7 +66,7 @@ services: image: grafana/tempo:2.9.4 command: ["-config.file=/etc/tempo.yaml"] ports: - - "3200:3200" # Tempo HTTP API + - "127.0.0.1:3200:3200" # Tempo HTTP API volumes: - ./tempo.yaml:/etc/tempo.yaml:ro - tempo-data:/var/tempo @@ -70,7 +76,7 @@ services: prometheus: image: prom/prometheus:v3.13.2 ports: - - "9090:9090" + - "127.0.0.1:9090:9090" volumes: - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro depends_on: @@ -81,7 +87,7 @@ services: loki: image: grafana/loki:3.7.6 ports: - - "3100:3100" # Loki HTTP API + - "127.0.0.1:3100:3100" # Loki HTTP API command: ["-config.file=/etc/loki/local-config.yaml"] networks: - workload-net @@ -98,7 +104,7 @@ services: - GF_AUTH_ANONYMOUS_ENABLED=true # No login required for local dev - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin # Full access without auth ports: - - "3000:3000" # Grafana web UI + - "127.0.0.1:3000:3000" # Grafana web UI volumes: - ./grafana/provisioning:/etc/grafana/provisioning:ro - ./grafana/dashboards:/var/lib/grafana/dashboards:ro diff --git a/docker/telemetry/docker-compose.yml b/docker/telemetry/docker-compose.yml index 1cb821734d..228ab87fb9 100644 --- a/docker/telemetry/docker-compose.yml +++ b/docker/telemetry/docker-compose.yml @@ -140,7 +140,7 @@ services: loki: image: grafana/loki:3.7.6 ports: - - "3100:3100" + - "127.0.0.1:3100:3100" command: -config.file=/etc/loki/local-config.yaml volumes: - loki-data:/loki diff --git a/docker/telemetry/grafana/dashboards/job-queue.json b/docker/telemetry/grafana/dashboards/job-queue.json index 0516079768..f31a87be24 100644 --- a/docker/telemetry/grafana/dashboards/job-queue.json +++ b/docker/telemetry/grafana/dashboards/job-queue.json @@ -621,7 +621,7 @@ "query": "label_values(service_name)", "datasource": { "type": "prometheus", - "uid": "prometheus" + "uid": "${DS_PROMETHEUS}" }, "includeAll": true, "allValue": ".*", @@ -641,7 +641,7 @@ "query": "label_values(deployment_environment)", "datasource": { "type": "prometheus", - "uid": "prometheus" + "uid": "${DS_PROMETHEUS}" }, "includeAll": true, "allValue": ".*", @@ -661,7 +661,7 @@ "query": "label_values(xrpl_network_type)", "datasource": { "type": "prometheus", - "uid": "prometheus" + "uid": "${DS_PROMETHEUS}" }, "includeAll": true, "allValue": ".*", @@ -741,7 +741,7 @@ "query": "label_values(target_info, service_instance_id)", "datasource": { "type": "prometheus", - "uid": "prometheus" + "uid": "${DS_PROMETHEUS}" }, "includeAll": true, "allValue": ".*", @@ -761,7 +761,7 @@ "query": "label_values(job_queued_total, job_type)", "datasource": { "type": "prometheus", - "uid": "prometheus" + "uid": "${DS_PROMETHEUS}" }, "includeAll": true, "allValue": ".*", @@ -781,7 +781,7 @@ "query": "label_values(job_queued_total, handler)", "datasource": { "type": "prometheus", - "uid": "prometheus" + "uid": "${DS_PROMETHEUS}" }, "includeAll": true, "allValue": ".*", @@ -804,5 +804,5 @@ "title": "Job Queue Analysis", "uid": "job-queue", "version": 1, - "refresh": "5s" + "refresh": "30s" } diff --git a/docker/telemetry/grafana/dashboards/ledger-data-sync.json b/docker/telemetry/grafana/dashboards/ledger-data-sync.json index 3827c902d2..d71f242b79 100644 --- a/docker/telemetry/grafana/dashboards/ledger-data-sync.json +++ b/docker/telemetry/grafana/dashboards/ledger-data-sync.json @@ -2340,6 +2340,7 @@ "id": 38 } ], + "refresh": "30s", "schemaVersion": 39, "tags": ["ledger", "sync"], "templating": { @@ -2365,7 +2366,7 @@ "query": "label_values(service_name)", "datasource": { "type": "prometheus", - "uid": "prometheus" + "uid": "${DS_PROMETHEUS}" }, "includeAll": true, "allValue": ".*", @@ -2385,7 +2386,7 @@ "query": "label_values(deployment_environment)", "datasource": { "type": "prometheus", - "uid": "prometheus" + "uid": "${DS_PROMETHEUS}" }, "includeAll": true, "allValue": ".*", @@ -2405,7 +2406,7 @@ "query": "label_values(xrpl_network_type)", "datasource": { "type": "prometheus", - "uid": "prometheus" + "uid": "${DS_PROMETHEUS}" }, "includeAll": true, "allValue": ".*", @@ -2485,7 +2486,7 @@ "query": "label_values(target_info, service_instance_id)", "datasource": { "type": "prometheus", - "uid": "prometheus" + "uid": "${DS_PROMETHEUS}" }, "includeAll": true, "allValue": ".*", @@ -2505,7 +2506,7 @@ "query": "label_values(job_queued_total, handler)", "datasource": { "type": "prometheus", - "uid": "prometheus" + "uid": "${DS_PROMETHEUS}" }, "includeAll": true, "allValue": ".*", diff --git a/docker/telemetry/grafana/dashboards/log-derived-insights.json b/docker/telemetry/grafana/dashboards/log-derived-insights.json index dc26f76a27..ceb4a9f9cd 100644 --- a/docker/telemetry/grafana/dashboards/log-derived-insights.json +++ b/docker/telemetry/grafana/dashboards/log-derived-insights.json @@ -90,7 +90,7 @@ "query": "label_values(service_name)", "datasource": { "type": "loki", - "uid": "loki" + "uid": "${DS_LOKI}" }, "includeAll": true, "allValue": ".*", @@ -110,7 +110,7 @@ "query": "label_values({service_name=\"xrpld\"}, deployment_environment)", "datasource": { "type": "loki", - "uid": "loki" + "uid": "${DS_LOKI}" }, "includeAll": true, "allValue": ".*", @@ -130,7 +130,7 @@ "query": "label_values({service_name=\"xrpld\"}, service_instance_id)", "datasource": { "type": "loki", - "uid": "loki" + "uid": "${DS_LOKI}" }, "includeAll": true, "allValue": ".*", diff --git a/docker/telemetry/grafana/dashboards/overlay-traffic-detail.json b/docker/telemetry/grafana/dashboards/overlay-traffic-detail.json index dd088632da..cb60c3e348 100644 --- a/docker/telemetry/grafana/dashboards/overlay-traffic-detail.json +++ b/docker/telemetry/grafana/dashboards/overlay-traffic-detail.json @@ -1135,7 +1135,7 @@ "query": "label_values(getobject_lookups_total, result)", "datasource": { "type": "prometheus", - "uid": "prometheus" + "uid": "${DS_PROMETHEUS}" }, "includeAll": true, "allValue": ".*", @@ -1155,7 +1155,7 @@ "query": "label_values(getobject_rejected_total, reason)", "datasource": { "type": "prometheus", - "uid": "prometheus" + "uid": "${DS_PROMETHEUS}" }, "includeAll": true, "allValue": ".*",