mirror of
https://github.com/XRPLF/rippled.git
synced 2026-09-27 07:26:51 +00:00
3f510ecf44
The compose ports published on every host interface, so the collector's unauthenticated OTLP receivers, Tempo, and the anonymous-admin Grafana were reachable by anything that could route to the host. Nothing consumed the published ports from off-host: containers address each other by compose service name, and every doc and script uses localhost.
87 lines
3.3 KiB
YAML
87 lines
3.3 KiB
YAML
# Docker Compose stack for xrpld OpenTelemetry observability.
|
|
#
|
|
# Provides services for local development:
|
|
# - otel-collector: receives OTLP traces from xrpld, batches and
|
|
# forwards them to Tempo. Listens on ports 4317 (gRPC)
|
|
# and 4318 (HTTP).
|
|
# - tempo: Grafana Tempo tracing backend, queryable via Grafana Explore
|
|
# on port 3000. Recommended for production (S3/GCS storage, TraceQL).
|
|
# - grafana: dashboards on port 3000, pre-configured with Tempo
|
|
# datasource.
|
|
#
|
|
# Usage:
|
|
# docker compose -f docker/telemetry/docker-compose.yml up -d
|
|
#
|
|
# Configure xrpld to export traces by adding to xrpld.cfg:
|
|
# [telemetry]
|
|
# enabled=1
|
|
# traces_endpoint=http://localhost:4318/v1/traces
|
|
|
|
services:
|
|
# OpenTelemetry Collector: receives spans from xrpld via OTLP protocol,
|
|
# batches them for efficiency, and forwards to Tempo for storage.
|
|
otel-collector:
|
|
image: otel/opentelemetry-collector-contrib:0.158.0
|
|
command: ["--config=/etc/otel-collector-config.yaml"]
|
|
# Published on the host loopback only. The receivers have no auth and no
|
|
# TLS, so only processes on this host may reach them. Note this 127.0.0.1
|
|
# is the HOST interface docker listens on; the container-side bind lives in
|
|
# the collector config and is a separate choice. Upstream asks for a
|
|
# specific interface rather than 0.0.0.0 on either side (CWE-1327):
|
|
# https://opentelemetry.io/docs/security/config-best-practices/
|
|
ports:
|
|
- "127.0.0.1:4317:4317" # OTLP gRPC receiver
|
|
- "127.0.0.1:4318:4318" # OTLP HTTP receiver (xrpld sends traces here)
|
|
- "127.0.0.1:13133:13133" # Health check endpoint
|
|
volumes:
|
|
# Mount collector pipeline config (receivers → processors → exporters)
|
|
- ./otel-collector-config.yaml:/etc/otel-collector-config.yaml:ro
|
|
depends_on:
|
|
- tempo
|
|
networks:
|
|
- xrpld-telemetry
|
|
|
|
# Grafana Tempo: distributed tracing backend that stores and indexes
|
|
# spans. Queryable via TraceQL in Grafana Explore.
|
|
tempo:
|
|
image: grafana/tempo:2.9.4
|
|
command: ["-config.file=/etc/tempo.yaml"]
|
|
ports:
|
|
- "127.0.0.1:3200:3200" # Tempo HTTP API (health check, query)
|
|
volumes:
|
|
# Mount Tempo storage and ingestion config
|
|
- ./tempo.yaml:/etc/tempo.yaml:ro
|
|
# Persistent volume for trace data (WAL + blocks)
|
|
- tempo-data:/var/tempo
|
|
networks:
|
|
- xrpld-telemetry
|
|
|
|
# Grafana: visualization UI with Tempo pre-configured as a datasource.
|
|
# Anonymous admin access enabled for local development convenience.
|
|
grafana:
|
|
image: grafana/grafana:13.1.2
|
|
environment:
|
|
- GF_AUTH_ANONYMOUS_ENABLED=true # No login required for local dev
|
|
- GF_AUTH_ANONYMOUS_ORG_ROLE=Admin # Full access without auth
|
|
ports:
|
|
- "127.0.0.1:3000:3000" # Grafana web UI
|
|
volumes:
|
|
# Auto-provision Tempo datasource and search filters on startup
|
|
- ./grafana/provisioning:/etc/grafana/provisioning:ro
|
|
depends_on:
|
|
- tempo
|
|
networks:
|
|
- xrpld-telemetry
|
|
|
|
# Named volume for Tempo trace storage (WAL and compacted blocks).
|
|
# Data persists across container restarts. Remove with:
|
|
# docker compose -f docker/telemetry/docker-compose.yml down -v
|
|
volumes:
|
|
tempo-data:
|
|
|
|
# Isolated bridge network so services communicate by container name
|
|
# (e.g., the collector reaches Tempo at http://tempo:4317).
|
|
networks:
|
|
xrpld-telemetry:
|
|
driver: bridge
|