modified: .gitignore

modified:   apps/gramps/docker-compose.yml
	modified:   apps/nextcloud/docker-compose.yml
	modified:   apps/passbolt/docker-compose.yml
	modified:   core/docker-compose.yml
	modified:   monitoring/gotify/docker-compose.yml
	modified:   monitoring/prometheus/docker-compose.yml
	modified:   monitoring/prometheus/prometheus.yml
	.env.example
	DEPLOYMENT.md
	SECURITY_SECRETS_INVENTORY.md
	secrets/

monitoring/prometheus/docker-compose.yml

@@ -4,6 +4,8 @@ services:
   prometheus:
     profiles: ["monitoring","all","prometheus"]
     image: prom/prometheus:latest
+    env_file:
+      - ${PROJECT_ROOT}/secrets/stack-secrets.env
     container_name: prometheus
     depends_on:
 #      - alertmanager
@@ -22,6 +24,7 @@ services:
       - ${PROJECT_ROOT}/monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
       - ${PROJECT_ROOT}/monitoring/prometheus/data:/prometheus
       - ${PROJECT_ROOT}/monitoring/prometheus/rules:/etc/prometheus/rules:ro
+      - ${PROJECT_ROOT}/secrets/prometheus_kuma_basic_auth_password.txt:/run/secrets/prometheus_kuma_basic_auth_password:ro
 
     restart: unless-stopped
     labels:
@@ -53,7 +56,7 @@ services:
 #    volumes:
 #      - ./alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
 #    restart: unless-stopped
-#    networks:
+#    secrets:
 #      - edge
 #      - traefik_reverse_proxy
 #    healthcheck:
@@ -101,14 +104,18 @@ services:
     image: influxdb:2.7
     container_name: influxdb
     restart: unless-stopped
+    env_file:
+      - ${PROJECT_ROOT}/secrets/stack-secrets.env
     volumes:
       - ${PROJECT_ROOT}/monitoring/influxdb:/var/lib/influxdb2
     environment:
-      DOCKER_INFLUXDB_INIT_MODE: ${INFLUXDB_INIT_MODE}
+      DOCKER_INFLUXDB_INIT_MODE: setup
       DOCKER_INFLUXDB_INIT_USERNAME: ${INFLUXDB_INIT_USERNAME}
-      DOCKER_INFLUXDB_INIT_PASSWORD: ${INFLUXDB_INIT_PASSWORD}
+      DOCKER_INFLUXDB_INIT_PASSWORD_FILE: /run/secrets/influxdb_init_password
       DOCKER_INFLUXDB_INIT_ORG: ${INFLUXDB_INIT_ORG}
       DOCKER_INFLUXDB_INIT_BUCKET: ${INFLUXDB_INIT_BUCKET}
+    secrets:
+      - influxdb_init_password
     networks:
 #      - edge
 #      - traefik_reverse_proxy
@@ -205,10 +212,12 @@ services:
     profiles: ["monitoring","all","prometheus-exporters"]
     image: ekofr/pihole-exporter:latest
     container_name: pihole-exporter
+    env_file:
+      - ${PROJECT_ROOT}/secrets/stack-secrets.env
     environment:
       PIHOLE_HOSTNAME: ${PIHOLE_HOSTNAME}
-      PIHOLE_PASSWORD: "${PIHOLE_PASSWORD}"
-      PORT: ${PIHOLE_EXPORTER_PORT}
+      PIHOLE_PASSWORD: ${PIHOLE_PASSWORD}
+      PORT: 9617
     ports:
       - "9617:9617"
     restart: unless-stopped
@@ -228,3 +237,8 @@ services:
 #    external: true
 
 
+
+
+secrets:
+  influxdb_init_password:
+    file: ${PROJECT_ROOT}/secrets/influxdb_init_password.txt