new file: crowdsec/Dockerfile

new file:   default-environment.env
	new file:   docker-compose.yml
	new file:   docker-exporter/Dockerfile
	new file:   docker-exporter/Dockerfile.old
	new file:   docker-exporter/TEST_EXAMPLE.md
	new file:   docker-exporter/exporter.py
	new file:   docker-exporter/exporter.py.old
	new file:   services-up.sh
	new file:   telegraf.conf
	new file:   traefik/certs/.gitkeep
	new file:   traefik/dynamic.yml
	new file:   traefik/letsencrypt/acme.json
	new file:   traefik/traefik.yml

crowdsec/Dockerfile

@@ -0,0 +1,6 @@
+FROM crowdsecurity/crowdsec:latest
+
+COPY config/ /etc/crowdsec
+# Install required components at build time
+RUN cscli hub update && \
+    cscli collections install crowdsecurity/traefik --force

default-environment.env

@@ -0,0 +1,18 @@
+PROJECT_ROOT=/home/raspi/raspi
+REMOTE_PROJECT_ROOT=/home/nixos/raspi
+DOMAIN=lan.ddnsgeek.com
+TZ=Australia/Brisbane
+EMAIL=wayne.bennett@live.com
+
+# Docker Socket Proxy
+DOCKER_SOCKET_PROXY_LOG_LEVEL=info
+DOCKER_SOCKET_PROXY_HOST=tcp://docker-socket-proxy:2375
+
+# Docker Update Exporter
+DOCKER_EXPORTER_LOG_LEVEL=INFO
+
+# Crowdsec
+CROWDSEC_COLLECTIONS=crowdsecurity/traefik
+
+
+

docker-compose.yml

@@ -0,0 +1,179 @@
+version: "3.9"
+
+services:
+  traefik:
+    profiles: ["all"]
+    image: traefik:3
+    container_name: traefik
+    restart: always
+    depends_on:
+      - docker-socket-proxy
+#    environment:
+#      TRAEFIK_PROVIDERS_DOCKER_ENDPOINT: ${DOCKER_SOCKET_PROXY_HOST}
+    ports:
+      - "80:80"
+      - "443:443"
+      - "8080:8080"
+    volumes:
+#      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ${PROJECT_ROOT}/traefik/letsencrypt:/letsencrypt
+      - ${PROJECT_ROOT}/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
+      - ${PROJECT_ROOT}/traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
+    networks:
+      - proxy
+
+  uptime-kuma:
+    profiles: ["all"]
+    image: louislam/uptime-kuma
+    container_name: uptime-kuma
+    restart: always
+    depends_on:
+      - traefik
+      - docker-socket-proxy
+    environment:
+      DOCKER_HOST: ${DOCKER_SOCKET_PROXY_HOST}
+    volumes:
+      - ${PROJECT_ROOT}/uptime-kuma:/app/data
+#      - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      - proxy
+    labels:
+      - traefik.enable=true
+
+      # Router
+      - traefik.http.routers.kuma.rule=Host(`kuma.lan.ddnsgeek.com`)
+      - traefik.http.routers.kuma.entrypoints=websecure
+      - traefik.http.routers.kuma.tls=true
+      - traefik.http.routers.kuma.tls.certresolver=le
+
+      # Service -> container port
+      - traefik.http.services.kuma.loadbalancer.server.port=3001
+#      - traefik.http.routers.kuma.middlewares=default-chain@file
+#    ports:
+#      - 8080:3001
+
+  portainer-agent:
+    profiles: ["all"]
+    image: portainer/agent
+    restart: always
+    depends_on:
+      - docker-socket-proxy
+    ports:
+      - 9001:9001
+    container_name: portainer-agent
+    environment:
+      DOCKER_HOST: ${DOCKER_SOCKET_PROXY_HOST}
+    volumes:
+ #     - /var/run/docker.sock:/var/run/docker.sock
+      - /var/lib/docker/volumes:/var/lib/docker/volumes
+      - /:/host
+    networks:
+      - proxy
+
+  crowdsec:
+    profiles: ["all"]
+    image: crowdsecurity/crowdsec:latest
+#    build: ./crowdsec
+    container_name: crowdsec
+    restart: always
+    environment:
+      - COLLECTIONS=${CROWDSEC_COLLECTIONS}
+    volumes:
+      - ${PROJECT_ROOT}/data/logs:/logs:ro
+      - ${PROJECT_ROOT}/crowdsec/data:/var/lib/crowdsec/data
+      - ${PROJECT_ROOT}/crowdsec/config:/etc/crowdsec
+    networks:
+      - proxy
+
+  docker-update-exporter:
+    profiles: ["all"]
+    build: ${REMOTE_PROJECT_ROOT}/docker-exporter
+    container_name: docker-update-exporter
+    volumes:
+#      - /var/run/docker.sock:/var/run/docker.sock
+      - ${PROJECT_ROOT}:/compose:ro
+#      - ${PROJECT_ROOT}/docker-compose.yml:/compose/docker-compose.yml:ro
+      - ${REMOTE_PROJECT_ROOT}/docker-exporter/data:/data:rw
+      - ${PROJECT_ROOT}/.docker/config.json:/root/.docker/config.json:ro
+    environment:
+      LOG_LEVEL: ${DOCKER_EXPORTER_LOG_LEVEL}
+      DOCKER_HOST: ${DOCKER_SOCKET_PROXY_HOST}
+    ports:
+      - "9105:9105"
+    restart: unless-stopped
+    depends_on:
+      - docker-socket-proxy
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - proxy
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:9105/metrics')"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  telegraf:
+    profiles: ["monitoring","all","prometheus"]
+    image: telegraf:latest
+#    group_add:
+#      - "123"
+#    privileged: true
+    container_name: telegraf
+    restart: unless-stopped
+    depends_on:
+      - docker-socket-proxy
+#    cap_drop:
+#      - ALL
+    security_opt:
+      - no-new-privileges:true
+    volumes:
+ #     - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ${PROJECT_ROOT}/telegraf.conf:/etc/telegraf/telegraf.conf:ro
+    networks:
+#      - edge
+      - proxy
+    ports:
+      - 9273:9273
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:9273/metrics || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  docker-socket-proxy:
+    profiles: ["monitoring","all","prometheus","prometheus-exporters"]
+    image: tecnativa/docker-socket-proxy:latest
+    container_name: docker-socket-proxy
+    restart: unless-stopped
+    environment:
+      LOG_LEVEL: ${DOCKER_SOCKET_PROXY_LOG_LEVEL}
+      DISTRIBUTION: 1
+      CONTAINERS: 1
+      EVENTS: 1
+      IMAGES: 1
+      INFO: 1
+      NETWORKS: 1
+      PING: 1
+      POST: 1
+      SERVICES: 1
+      TASKS: 1
+      VERSION: 1
+      VOLUMES: 1
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - proxy
+
+
+networks:
+  proxy:
+    name: proxy

docker-exporter/Dockerfile

@@ -0,0 +1,15 @@
+FROM python:3.11-slim
+
+#RUN groupadd -g 1000 appuser || true && \
+#    useradd -m -u 1000 -g 1000 -s /bin/bash appuser
+#RUN groupadd -g 999 docker || true && usermod -aG docker appuser
+WORKDIR /app
+COPY exporter.py .
+
+RUN mkdir -p /data 
+
+RUN pip install --no-cache-dir docker prometheus_client requests pyyaml
+
+#USER appuser
+
+CMD ["python", "-u", "exporter.py"]

docker-exporter/Dockerfile.old

@@ -0,0 +1,8 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+COPY exporter.py .
+
+RUN pip install docker prometheus_client requests pyyaml
+
+CMD ["python", "exporter.py"]

docker-exporter/TEST_EXAMPLE.md

@@ -0,0 +1,24 @@
+# Exporter image-mapping test example
+
+Run the exporter in dry-run mode to print the `service -> image:tag` mapping without starting the metrics loop:
+
+```bash
+SERVICES_UP_SCRIPT=/workspace/docker/services-up.sh python monitoring/docker-exporter/exporter.py --dry-run
+```
+
+Example output excerpt:
+
+```json
+{
+  "crowdsec": "crowdsecurity/crowdsec:latest",
+  "docker-update-exporter": "python:3.11-slim",
+  "nextcloud-webapp": "nextcloud:production",
+  "node-red": "nodered/node-red:latest",
+  "prometheus": "prom/prometheus:latest",
+  "traefik": "traefik:3"
+}
+```
+
+This confirms the exporter now reports images for both:
+- services with explicit `image:` values, and
+- services using `build:` contexts.

docker-exporter/exporter.py

@@ -0,0 +1,528 @@
+#!/usr/bin/env python3
+import argparse
+import os
+import re
+import time
+import json
+import logging
+import docker
+import yaml
+from prometheus_client import Gauge, start_http_server
+
+# --- Logging ---
+LOG_LEVEL = os.getenv("LOG_LEVEL", "DEBUG").upper()
+logging.basicConfig(
+    level=getattr(logging, LOG_LEVEL, logging.DEBUG),
+    format="%(asctime)s [%(levelname)s] %(message)s"
+)
+logger = logging.getLogger("docker-update-exporter")
+
+# --- Config ---
+EXPORTER_PORT = 9105
+CHECK_INTERVAL = 3600
+CACHE_TTL = int(os.getenv("CACHE_TTL", "300"))
+SERVICES_UP_SCRIPT = os.getenv("SERVICES_UP_SCRIPT", "/compose/services-up.sh")
+CACHE_FILE = os.getenv("CACHE_FILE", "/data/remote_digest_cache.json")
+DRY_RUN = os.getenv("DRY_RUN", "false").lower() in ("1", "true", "yes")
+
+try:
+    client = docker.from_env()
+except Exception as e:
+    logger.warning(f"Docker client unavailable at startup: {e}")
+    client = None
+
+# --- Metrics ---
+CONTAINER_UPDATE = Gauge(
+    "docker_container_update_available",
+    "1 if container image is out of date (compose drift or registry), 0 otherwise",
+    ["container", "compose_image", "running_image", "com_docker_compose_project"]
+)
+
+LAST_CHECK = Gauge(
+    "docker_image_update_last_check_timestamp",
+    "Last time the update check ran (unix timestamp)"
+)
+
+
+def set_container_update_metric(container_name, compose_image, running_image, project_name, update_flag):
+    """Set update metric for a container and log the emitted metric payload."""
+    metric_labels = {
+        "container": container_name,
+        "compose_image": compose_image or "unknown",
+        "running_image": running_image,
+        "com_docker_compose_project": project_name,
+    }
+    CONTAINER_UPDATE.labels(**metric_labels).set(update_flag)
+    logger.info(
+        "Metric emitted: docker_container_update_available=%s labels=%s",
+        update_flag,
+        metric_labels,
+    )
+
+
+def set_last_check_metric():
+    """Set and log the timestamp for the most recent check cycle."""
+    ts = time.time()
+    LAST_CHECK.set(ts)
+    logger.info("Metric emitted: docker_image_update_last_check_timestamp=%s", ts)
+
+# --- Persistent Cache ---
+def load_cache():
+    if not os.path.exists(CACHE_FILE):
+        logger.info(f"Cache file does not exist yet: {CACHE_FILE}")
+        return {}
+    try:
+        with open(CACHE_FILE, "r") as f:
+            cache = json.load(f)
+            logger.info(f"Loaded {len(cache)} cached remote digests")
+            return cache
+    except Exception as e:
+        logger.error(f"Failed to load cache: {e}")
+        return {}
+
+def save_cache():
+    try:
+        os.makedirs(os.path.dirname(CACHE_FILE), exist_ok=True)
+        with open(CACHE_FILE, "w") as f:
+            json.dump(REMOTE_DIGEST_CACHE, f)
+        logger.debug(f"Saved {len(REMOTE_DIGEST_CACHE)} remote digests to cache")
+    except Exception as e:
+        logger.error(f"Failed to save cache: {e}")
+
+REMOTE_DIGEST_CACHE = load_cache()
+now = time.time()
+REMOTE_DIGEST_CACHE = {
+    image: (digest, ts)
+    for image, (digest, ts) in REMOTE_DIGEST_CACHE.items()
+    if now - ts < CACHE_TTL
+}
+
+# --- Helpers ---
+def get_project_prefix_from_script(script_path):
+    prefix = "core-"
+    if not os.path.exists(script_path):
+        return prefix
+    try:
+        with open(script_path) as f:
+            for line in f:
+                m = re.match(r'PROJECT\s*=\s*["\']?([^"\']+)', line)
+                if m:
+                    return m.group(1) + "-"
+    except Exception as e:
+        logger.warning(f"Failed reading project prefix: {e}")
+    return prefix
+
+def get_local_digest(image_name):
+    """
+    Return the local digest for the specific image reference.
+    """
+    if client is None:
+        return None
+
+    try:
+        img = client.images.get(image_name)
+        digests = img.attrs.get("RepoDigests", [])
+
+        logger.debug(f"RepoDigests for {image_name}: {digests}")
+
+        for entry in digests:
+            if "@" in entry:
+                digest = entry.split("@", 1)[1]
+                logger.debug(f"Local digest for {image_name}: {digest}")
+                return digest
+
+        logger.debug(f"No RepoDigest found for {image_name}")
+
+    except Exception as e:
+        logger.debug(f"Could not get local digest for {image_name}: {e}")
+
+    return None
+
+def get_remote_digest(image_name):
+    """
+    Return the upstream digest for the exact platform-specific image that Docker
+    would pull on this host. This avoids false positives with multi-arch images
+    where the registry manifest-list digest differs from the pulled image digest.
+    """
+    now = time.time()
+
+    cached = REMOTE_DIGEST_CACHE.get(image_name)
+    if cached:
+        digest, ts = cached
+        if now - ts < CACHE_TTL:
+            logger.debug(f"Using cached remote digest for {image_name}: {digest}")
+            return digest
+
+    if client is None:
+        return None
+
+    try:
+        registry_data = client.images.get_registry_data(image_name)
+
+        digest = None
+
+        # docker SDK versions differ; try the common fields in order
+        if hasattr(registry_data, "id") and registry_data.id:
+            digest = registry_data.id
+        elif hasattr(registry_data, "attrs"):
+            digest = (
+                registry_data.attrs.get("Descriptor", {}).get("digest")
+                or registry_data.attrs.get("digest")
+            )
+
+        if digest:
+            REMOTE_DIGEST_CACHE[image_name] = (digest, now)
+            save_cache()
+            logger.debug(f"Remote digest for {image_name}: {digest}")
+            return digest
+
+        logger.warning(f"No remote digest found for {image_name}")
+        return None
+    except Exception as e:
+        logger.debug(f"Error fetching remote digest for {image_name}: {e}")
+
+    return None
+
+# --- Dockerfile Image Extraction ---
+def parse_dockerfile_for_image(dockerfile_path):
+    if not os.path.exists(dockerfile_path):
+        return None
+
+    try:
+        arg_defaults = {}
+        last_from = None
+        with open(dockerfile_path) as df:
+            for line in df:
+                line = line.strip()
+                if not line or line.startswith("#"):
+                    continue
+
+                if line.upper().startswith("ARG "):
+                    arg_body = line[4:].strip()
+                    if "=" in arg_body:
+                        key, value = arg_body.split("=", 1)
+                        arg_defaults[key.strip()] = value.strip()
+                    continue
+
+                # Prefer LABEL with image if present.
+                if "LABEL" in line and "image=" in line:
+                    match = re.search(r'image=["\']?([^"\']+)["\']?', line)
+                    if match:
+                        image_name = normalize_image_name(substitute_dockerfile_args(match.group(1), arg_defaults))
+                        logger.debug(f"Found LABEL image={image_name} in {dockerfile_path}")
+                        return image_name
+
+                if line.upper().startswith("FROM "):
+                    from_clause = line[5:].strip()
+                    if from_clause.startswith("--"):
+                        split_clause = from_clause.split(None, 1)
+                        if len(split_clause) < 2:
+                            continue
+                        from_clause = split_clause[1]
+
+                    parts = from_clause.split()
+                    if not parts:
+                        continue
+
+                    candidate = substitute_dockerfile_args(parts[0], arg_defaults)
+                    if candidate and candidate.lower() != "scratch":
+                        last_from = normalize_image_name(candidate)
+
+        if last_from:
+            logger.debug(f"Found base FROM {last_from} in {dockerfile_path}")
+            return last_from
+    except Exception as e:
+        logger.debug(f"Error reading Dockerfile {dockerfile_path}: {e}")
+
+    return None
+
+def normalize_image_name(image_name):
+    if not image_name:
+        return None
+    if "@" in image_name:
+        return image_name
+    if ":" in image_name.rsplit("/", 1)[-1]:
+        return image_name
+    return f"{image_name}:latest"
+
+def is_compose_build_placeholder(image_name, project_name):
+    if not image_name:
+        return False
+    candidate = str(image_name)
+    project_prefix = f"{project_name}-"
+    if candidate.startswith(project_prefix):
+        return True
+    # Keep backward-compatible behavior for historical default project prefix.
+    return candidate.startswith("core-")
+
+def substitute_dockerfile_args(value, arg_defaults):
+    if not value:
+        return value
+
+    pattern = re.compile(r"\$\{([^}]+)\}|\$([A-Za-z_][A-Za-z0-9_]*)")
+
+    def replacer(match):
+        expr = match.group(1)
+        simple = match.group(2)
+        if simple:
+            return arg_defaults.get(simple, "")
+
+        if ":-" in expr:
+            var_name, default_value = expr.split(":-", 1)
+            return arg_defaults.get(var_name, default_value)
+        if "-" in expr:
+            var_name, default_value = expr.split("-", 1)
+            return arg_defaults.get(var_name, default_value)
+        return arg_defaults.get(expr, "")
+
+    return pattern.sub(replacer, value)
+
+def expand_compose_path(path_value, project_root):
+    raw = str(path_value)
+    raw = raw.replace("${PROJECT_ROOT}", project_root).replace("$PROJECT_ROOT", project_root)
+    return os.path.expandvars(raw)
+
+def get_project_root_from_script(script_path):
+    if not script_path:
+        return os.getcwd()
+    return os.path.dirname(os.path.abspath(script_path))
+
+# --- Compose parsing ---
+def get_compose_files_from_script(script_path):
+    files = []
+    if not os.path.exists(script_path):
+        return files
+    base_dir = get_project_root_from_script(script_path)
+    try:
+        with open(script_path) as f:
+            content = f.read()
+        match = re.search(r'FILES\s*=\s*\((.*?)\)', content, re.DOTALL)
+        if match:
+            for line in match.group(1).splitlines():
+                line = line.strip()
+                if line.startswith("-f"):
+                    path = line[2:].strip()
+                    if path:
+                        full = os.path.normpath(os.path.join(base_dir, path))
+                        files.append(full)
+    except Exception as e:
+        logger.warning(f"Failed parsing services-up.sh: {e}")
+    return files
+
+def parse_project_name_from_script(script_path):
+    project = "core"
+    if not os.path.exists(script_path):
+        return project
+    try:
+        with open(script_path) as f:
+            for line in f:
+                m = re.match(r'PROJECT\s*=\s*["\']?([^"\']+)', line)
+                if m:
+                    project = m.group(1)
+                    break
+    except Exception as e:
+        logger.warning(f"Failed reading project name: {e}")
+    return project
+
+def resolve_local_build_image(service_name, project_name):
+    if client is None:
+        return None
+    try:
+        images = client.images.list(filters={"label": f"com.docker.compose.service={service_name}"})
+        for image in images:
+            labels = image.attrs.get("Config", {}).get("Labels", {}) or {}
+            if labels.get("com.docker.compose.project") != project_name:
+                continue
+            for tag in image.tags:
+                if tag and "<none>" not in tag:
+                    logger.debug(f"Resolved local compose image for {service_name}: {tag}")
+                    return normalize_image_name(tag)
+    except Exception as e:
+        logger.debug(f"Could not inspect local build metadata for {service_name}: {e}")
+    return None
+
+def parse_compose_services(compose_files, project_name, project_root):
+    svc_map = {}
+    for f in compose_files:
+        if not os.path.exists(f):
+            logger.warning(f"Compose file from services-up.sh is missing: {f}")
+            continue
+        try:
+            with open(f) as stream:
+                data = yaml.safe_load(stream) or {}
+            for svc_name, svc_def in data.get("services", {}).items():
+                image = normalize_image_name(svc_def.get("image"))
+                profiles = svc_def.get("profiles", [])
+                build_ctx = svc_def.get("build")
+                dockerfile_path = None
+                from_dockerfile = None
+                local_built_image = None
+
+                if build_ctx:
+                    if isinstance(build_ctx, dict):
+                        context = build_ctx.get("context", ".")
+                        dockerfile = build_ctx.get("dockerfile", "Dockerfile")
+                    else:
+                        context = build_ctx
+                        dockerfile = "Dockerfile"
+
+                    compose_dir = os.path.dirname(f)
+                    context_expanded = expand_compose_path(context, project_root)
+                    if os.path.isabs(context_expanded):
+                        context_path = context_expanded
+                    else:
+                        context_path = os.path.normpath(os.path.join(compose_dir, context_expanded))
+                    dockerfile_expanded = expand_compose_path(dockerfile, project_root)
+                    dockerfile_path = os.path.normpath(os.path.join(context_path, dockerfile_expanded))
+                    from_dockerfile = normalize_image_name(parse_dockerfile_for_image(dockerfile_path))
+                    local_built_image = resolve_local_build_image(svc_name, project_name)
+
+                placeholder_image = is_compose_build_placeholder(image, project_name) or is_compose_build_placeholder(local_built_image, project_name)
+                if placeholder_image:
+                    resolved_image = from_dockerfile or image or local_built_image or f"{project_name}-{svc_name}:latest"
+                else:
+                    resolved_image = image or local_built_image or from_dockerfile or f"{project_name}-{svc_name}:latest"
+
+                svc_map[svc_name] = {
+                    "image": resolved_image,
+                    "profiles": profiles,
+                    "build_context": build_ctx,
+                    "compose_file": f,
+                    "dockerfile": dockerfile_path
+                }
+        except Exception as e:
+            logger.warning(f"Failed parsing {f}: {e}")
+
+    logger.debug(f"Service image mapping: {svc_map}")
+    return svc_map
+
+# --- Main check ---
+def check_containers():
+    if client is None:
+        logger.error("Docker client is unavailable; skipping check cycle")
+        return
+
+    set_last_check_metric()
+    CONTAINER_UPDATE.clear()
+
+    project_name = parse_project_name_from_script(SERVICES_UP_SCRIPT)
+    project_root = get_project_root_from_script(SERVICES_UP_SCRIPT)
+    compose_files = get_compose_files_from_script(SERVICES_UP_SCRIPT)
+    svc_map = parse_compose_services(compose_files, project_name, project_root)
+
+    containers = client.containers.list()
+    pending_metrics = []
+    remote_targets = set()
+
+    for container in containers:
+        proj = container.labels.get("com.docker.compose.project")
+        if not proj:
+            continue
+
+        svc = container.labels.get("com.docker.compose.service")
+        running = container.attrs["Config"]["Image"]
+
+        compose_image = None
+        if svc in svc_map:
+            compose_image = svc_map[svc]["image"]
+
+        local_digest = get_local_digest(running)
+        remote_target = compose_image or running
+
+        # If we cannot determine a local digest, we cannot compare and should
+        # avoid spending a registry lookup for this container.
+        if local_digest:
+            remote_targets.add(remote_target)
+
+        pending_metrics.append({
+            "container_name": container.name,
+            "service": svc,
+            "compose_image": compose_image,
+            "running_image": running,
+            "project_name": proj,
+            "remote_target": remote_target,
+            "local_digest": local_digest,
+        })
+
+    remote_digests = {target: get_remote_digest(target) for target in remote_targets}
+
+    for payload in pending_metrics:
+        local_digest = payload["local_digest"]
+        remote_target = payload["remote_target"]
+        remote_digest = remote_digests.get(remote_target)
+        update_flag = 1 if (local_digest and remote_digest and local_digest != remote_digest) else 0
+
+        logger.info(
+            "Digest comparison: container=%s service=%s running=%s target=%s local=%s remote=%s",
+            payload["container_name"],
+            payload["service"],
+            payload["running_image"],
+            remote_target,
+            local_digest,
+            remote_digest,
+        )
+
+        set_container_update_metric(
+            container_name=payload["container_name"],
+            compose_image=payload["compose_image"],
+            running_image=payload["running_image"],
+            project_name=payload["project_name"],
+            update_flag=update_flag,
+        )
+
+def dump_service_image_mapping():
+    project_name = parse_project_name_from_script(SERVICES_UP_SCRIPT)
+    project_root = get_project_root_from_script(SERVICES_UP_SCRIPT)
+    compose_files = get_compose_files_from_script(SERVICES_UP_SCRIPT)
+    svc_map = parse_compose_services(compose_files, project_name, project_root)
+    mapping = {name: data["image"] for name, data in sorted(svc_map.items())}
+    logger.info("Service to image mapping:")
+    logger.info(json.dumps(mapping, indent=2, sort_keys=True))
+    return mapping
+
+# --- Runner ---
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Docker image update exporter")
+    parser.add_argument("--dry-run", action="store_true", help="Only print service->image mapping and exit")
+    parser.add_argument(
+        "--services-up-script",
+        default=SERVICES_UP_SCRIPT,
+        help=f"Path to services-up script (default: {SERVICES_UP_SCRIPT})",
+    )
+    parser.add_argument(
+        "--cache-file",
+        default=CACHE_FILE,
+        help=f"Path to digest cache file (default: {CACHE_FILE})",
+    )
+    parser.add_argument(
+        "--log-level",
+        default=LOG_LEVEL,
+        help=f"Logging level (default: {LOG_LEVEL})",
+    )
+    args = parser.parse_args()
+
+    effective_log_level = str(args.log_level).upper()
+    logging.getLogger().setLevel(getattr(logging, effective_log_level, logging.DEBUG))
+    logger.setLevel(getattr(logging, effective_log_level, logging.DEBUG))
+
+    SERVICES_UP_SCRIPT = args.services_up_script
+    CACHE_FILE = args.cache_file
+    REMOTE_DIGEST_CACHE = load_cache()
+    now = time.time()
+    REMOTE_DIGEST_CACHE = {
+        image: (digest, ts)
+        for image, (digest, ts) in REMOTE_DIGEST_CACHE.items()
+        if now - ts < CACHE_TTL
+    }
+
+    if DRY_RUN or args.dry_run:
+        dump_service_image_mapping()
+        raise SystemExit(0)
+
+    start_http_server(EXPORTER_PORT)
+    while True:
+        try:
+            check_containers()
+        except Exception as e:
+            logger.exception(f"update check failed: {e}")
+        time.sleep(CHECK_INTERVAL)

docker-exporter/exporter.py.old

@@ -0,0 +1,514 @@
+#!/usr/bin/env python3
+import os
+import re
+import time
+import json
+import logging
+import docker
+import requests
+import yaml
+from prometheus_client import Gauge, start_http_server
+
+# --- Logging ---
+LOG_LEVEL = os.getenv("LOG_LEVEL", "INFO").upper()
+
+logging.basicConfig(
+    level=getattr(logging, LOG_LEVEL, logging.INFO),
+    format="%(asctime)s [%(levelname)s] %(message)s"
+)
+
+logger = logging.getLogger("docker-update-exporter")
+
+# --- Config ---
+EXPORTER_PORT = 9105
+CHECK_INTERVAL = 60
+CACHE_TTL = 6 * 3600
+SERVICES_UP_SCRIPT = "/compose/services-up.sh"
+CACHE_FILE = "/data/remote_digest_cache.json"
+
+client = docker.from_env()
+
+# --- Metrics ---
+CONTAINER_UPDATE = Gauge(
+    "docker_container_update_available",
+    "1 if container image is out of date (compose drift or registry), 0 otherwise",
+    ["container", "compose_image", "running_image", "com_docker_compose_project"]
+)
+
+LAST_CHECK = Gauge(
+    "docker_image_update_last_check_timestamp",
+    "Last time the update check ran (unix timestamp)"
+)
+
+# --- Persistent Cache ---
+
+def load_cache():
+    if not os.path.exists(CACHE_FILE):
+        logger.info(f"Cache file does not exist yet: {CACHE_FILE}")
+        return {}
+
+    try:
+        with open(CACHE_FILE, "r") as f:
+            cache = json.load(f)
+            logger.info(f"Loaded {len(cache)} cached remote digests")
+            logger.debug(f"Cache contents: {cache}")
+            return cache
+    except Exception as e:
+        logger.error(f"Failed to load cache from {CACHE_FILE}: {e}")
+        return {}
+
+def save_cache():
+    try:
+        os.makedirs(os.path.dirname(CACHE_FILE), exist_ok=True)
+        with open(CACHE_FILE, "w") as f:
+            json.dump(REMOTE_DIGEST_CACHE, f)
+
+        logger.debug(
+            f"Saved {len(REMOTE_DIGEST_CACHE)} entries to cache file {CACHE_FILE}"
+        )
+    except Exception as e:
+        logger.error(f"Failed to save cache to {CACHE_FILE}: {e}")
+
+REMOTE_DIGEST_CACHE = load_cache()
+
+# --- Helpers ---
+
+def get_project_prefix_from_script(script_path):
+    project_prefix = "core-"  # fallback
+
+    if not os.path.exists(script_path):
+        logger.warning(
+            f"services-up script not found at {script_path}, using fallback project prefix {project_prefix}"
+        )
+        return project_prefix
+
+    try:
+        with open(script_path, "r") as f:
+            for line in f:
+                line = line.strip()
+                m = re.match(r'PROJECT\s*=\s*["\']?([^"\']+)["\']?', line)
+                if m:
+                    project_prefix = m.group(1) + "-"
+                    logger.debug(
+                        f"Detected compose project prefix from script: {project_prefix}"
+                    )
+                    break
+    except Exception as e:
+        logger.error(f"Failed reading project prefix from {script_path}: {e}")
+
+    return project_prefix
+
+def get_local_digest(image_name):
+    try:
+        img = client.images.get(image_name)
+        digests = img.attrs.get("RepoDigests", [])
+
+        logger.debug(f"Local RepoDigests for {image_name}: {digests}")
+
+        if digests:
+            digest = digests[0].split("@")[1]
+            logger.debug(f"Local digest for {image_name}: {digest}")
+            return digest
+
+        logger.info(f"No local digest found for image {image_name}")
+
+    except Exception as e:
+        logger.warning(f"Failed to retrieve local digest for {image_name}: {e}")
+
+    return None
+
+def get_remote_digest(image_name):
+    now = time.time()
+    original = image_name
+
+    # Cache hit
+    if original in REMOTE_DIGEST_CACHE:
+        digest, ts = REMOTE_DIGEST_CACHE[original]
+        age = now - ts
+
+        if age < CACHE_TTL:
+            logger.debug(
+                f"Using cached remote digest for {original} "
+                f"(age={int(age)}s, ttl={CACHE_TTL}s): {digest}"
+            )
+            return digest
+
+        logger.info(
+            f"Cache entry expired for {original} "
+            f"(age={int(age)}s > ttl={CACHE_TTL}s)"
+        )
+
+    try:
+        if "/" not in image_name:
+            registry = "docker.io"
+            repo = "library/" + image_name
+        else:
+            parts = image_name.split("/")
+            if "." in parts[0] or ":" in parts[0]:
+                registry = parts[0]
+                repo = "/".join(parts[1:])
+            else:
+                registry = "docker.io"
+                repo = image_name
+
+        if ":" in repo:
+            repo, tag = repo.rsplit(":", 1)
+        else:
+            tag = "latest"
+
+        logger.debug(
+            f"Resolving remote digest for {original}: "
+            f"registry={registry}, repo={repo}, tag={tag}"
+        )
+
+        token = None
+        manifest_url = None
+
+        if registry in ["docker.io", "registry-1.docker.io"]:
+            logger.debug(f"Requesting Docker Hub token for {repo}")
+
+            token_res = requests.get(
+                "https://auth.docker.io/token",
+                params={
+                    "service": "registry.docker.io",
+                    "scope": f"repository:{repo}:pull"
+                },
+                timeout=10
+            )
+
+            logger.debug(
+                f"Docker Hub token response for {repo}: "
+                f"status={token_res.status_code}"
+            )
+
+            token = token_res.json().get("token")
+            manifest_url = (
+                f"https://registry-1.docker.io/v2/{repo}/manifests/{tag}"
+            )
+
+        elif registry == "ghcr.io":
+            logger.debug(f"Requesting GHCR token for {repo}")
+
+            token_res = requests.get(
+                "https://ghcr.io/token",
+                params={
+                    "service": "ghcr.io",
+                    "scope": f"repository:{repo}:pull"
+                },
+                timeout=10
+            )
+
+            logger.debug(
+                f"GHCR token response for {repo}: "
+                f"status={token_res.status_code}"
+            )
+
+            token = token_res.json().get("token")
+            manifest_url = f"https://ghcr.io/v2/{repo}/manifests/{tag}"
+
+        else:
+            logger.warning(
+                f"Unsupported registry '{registry}' for image {original}"
+            )
+            return None
+
+        if not token:
+            logger.warning(
+                f"No authentication token returned for {original}"
+            )
+            return None
+
+        logger.debug(f"Requesting manifest for {original}: {manifest_url}")
+
+        res = requests.get(
+            manifest_url,
+            headers={
+                "Authorization": f"Bearer {token}",
+                "Accept": "application/vnd.docker.distribution.manifest.v2+json"
+            },
+            timeout=10
+        )
+
+        logger.debug(
+            f"Manifest response for {original}: "
+            f"status={res.status_code}"
+        )
+
+        if res.status_code == 200:
+            digest = res.headers.get("Docker-Content-Digest")
+
+            logger.info(
+                f"Fetched remote digest for {original}: {digest}"
+            )
+
+            REMOTE_DIGEST_CACHE[original] = (digest, now)
+            save_cache()
+
+            logger.debug(
+                f"Cached remote digest for {original}: {digest}"
+            )
+
+            return digest
+
+        if res.status_code == 429:
+            logger.warning(
+                f"Registry rate limit hit while fetching {original}"
+            )
+        elif res.status_code in [401, 403]:
+            logger.warning(
+                f"Authentication failed while fetching {original}: "
+                f"status={res.status_code}"
+            )
+        else:
+            logger.warning(
+                f"Unexpected manifest response for {original}: "
+                f"status={res.status_code}, body={res.text[:250]}"
+            )
+
+    except Exception as e:
+        logger.error(f"Failed to fetch remote digest for {original}: {e}")
+
+    return None
+
+def get_compose_files_from_script(script_path):
+    files = []
+
+    if not os.path.exists(script_path):
+        logger.error(f"services-up script not found: {script_path}")
+        return files
+
+    base_dir = os.path.dirname(script_path)
+
+    try:
+        with open(script_path, "r") as f:
+            content = f.read()
+
+        match = re.search(r'FILES\s*=\s*\((.*?)\)', content, re.DOTALL)
+
+        if not match:
+            logger.warning(
+                f"No FILES=(...) block found in {script_path}"
+            )
+            return files
+
+        lines = match.group(1).splitlines()
+
+        for line in lines:
+            line = line.strip()
+
+            if line.startswith("-f"):
+                rel_path = line[2:].strip()
+
+                if rel_path:
+                    full_path = os.path.normpath(
+                        os.path.join(base_dir, rel_path)
+                    )
+
+                    logger.debug(
+                        f"Resolved compose file: {rel_path} -> {full_path}"
+                    )
+
+                    files.append(full_path)
+
+        logger.info(f"Found {len(files)} compose files")
+
+    except Exception as e:
+        logger.error(f"Failed parsing compose files from {script_path}: {e}")
+
+    return files
+
+def parse_compose_files(compose_files):
+    service_to_image = {}
+
+    for f in compose_files:
+        if not os.path.exists(f):
+            logger.warning(f"Compose file missing: {f}")
+            continue
+
+        try:
+            with open(f, "r") as stream:
+                data = yaml.safe_load(stream) or {}
+                services = data.get("services", {})
+
+                logger.debug(
+                    f"Parsing {len(services)} services from compose file {f}"
+                )
+
+                for service_name, service_def in services.items():
+                    image = service_def.get("image")
+                    is_built = False
+
+                    if not image:
+                        is_built = True
+                        build_ctx = service_def.get("build")
+
+                        logger.debug(
+                            f"Service {service_name} is build-based, build config={build_ctx}"
+                        )
+
+                        if isinstance(build_ctx, dict):
+                            context_path = build_ctx.get("context", ".")
+                            dockerfile_path = os.path.join(
+                                context_path,
+                                build_ctx.get("dockerfile", "Dockerfile")
+                            )
+                        elif isinstance(build_ctx, str):
+                            context_path = build_ctx
+                            dockerfile_path = os.path.join(
+                                context_path, "Dockerfile"
+                            )
+                        else:
+                            dockerfile_path = None
+
+                        if dockerfile_path and os.path.exists(dockerfile_path):
+                            try:
+                                with open(dockerfile_path, "r") as df:
+                                    for line in df:
+                                        line = line.strip()
+                                        if (
+                                            line.upper().startswith("LABEL")
+                                            and "image=" in line
+                                        ):
+                                            m = re.search(
+                                                r'image=["\']?([^"\']+)["\']?',
+                                                line
+                                            )
+                                            if m:
+                                                image = m.group(1)
+                                                logger.debug(
+                                                    f"Found upstream image label for {service_name}: {image}"
+                                                )
+                                                break
+                            except Exception as e:
+                                logger.warning(
+                                    f"Failed reading Dockerfile {dockerfile_path}: {e}"
+                                )
+
+                        if not image:
+                            image = f"{service_name}:latest"
+                            logger.info(
+                                f"No image label found for build service {service_name}, "
+                                f"defaulting to {image}"
+                            )
+
+                    service_to_image[service_name] = (image, is_built)
+
+        except Exception as e:
+            logger.error(f"Failed parsing compose file {f}: {e}")
+
+    logger.info(f"Mapped {len(service_to_image)} compose services to images")
+    logger.debug(f"Service/image mapping: {service_to_image}")
+
+    return service_to_image
+
+def check_containers():
+    logger.info("Starting container update check")
+
+    CONTAINER_UPDATE.clear()
+
+    project_prefix = get_project_prefix_from_script(SERVICES_UP_SCRIPT)
+    compose_files = get_compose_files_from_script(SERVICES_UP_SCRIPT)
+    service_to_image = parse_compose_files(compose_files)
+
+    containers = client.containers.list()
+    logger.info(f"Checking {len(containers)} running containers")
+
+    for container in containers:
+        project_label = container.labels.get("com.docker.compose.project")
+
+        if not project_label:
+            logger.debug(
+                f"Skipping non-compose container {container.name}"
+            )
+            continue
+
+        service_label = container.labels.get("com.docker.compose.service")
+        running_image = container.attrs["Config"]["Image"]
+
+        logger.debug(
+            f"Evaluating container={container.name}, "
+            f"service={service_label}, project={project_label}, "
+            f"running_image={running_image}"
+        )
+
+        compose_image = None
+        is_built = False
+
+        if service_label and service_label in service_to_image:
+            compose_image, is_built = service_to_image[service_label]
+
+            if is_built:
+                compose_image_name, _, _ = compose_image.partition(":")
+                compose_image = f"{project_prefix}{compose_image_name}"
+
+        update_flag = 0
+
+        if is_built:
+            if running_image != compose_image:
+                logger.info(
+                    f"Update detected for build-based container {container.name}: "
+                    f"running image {running_image} != expected {compose_image}"
+                )
+                update_flag = 1
+            else:
+                local_digest = get_local_digest(running_image)
+                remote_digest = get_remote_digest(
+                    service_to_image[service_label][0]
+                )
+
+                if local_digest and remote_digest and local_digest != remote_digest:
+                    logger.info(
+                        f"Remote image update available for {container.name}: "
+                        f"{local_digest} != {remote_digest}"
+                    )
+                    update_flag = 1
+        else:
+            if running_image != compose_image:
+                logger.info(
+                    f"Compose drift detected for {container.name}: "
+                    f"running image {running_image} != compose image {compose_image}"
+                )
+                update_flag = 1
+            else:
+                local_digest = get_local_digest(running_image)
+                remote_digest = get_remote_digest(running_image)
+
+                if local_digest and remote_digest and local_digest != remote_digest:
+                    logger.info(
+                        f"Registry update available for {container.name}: "
+                        f"{local_digest} != {remote_digest}"
+                    )
+                    update_flag = 1
+
+        CONTAINER_UPDATE.labels(
+            container=container.name,
+            compose_image=compose_image if compose_image else "unknown",
+            running_image=running_image,
+            com_docker_compose_project=project_label
+        ).set(update_flag)
+
+        logger.info(
+            f"Container {container.name}: "
+            f"running={running_image}, "
+            f"compose={compose_image}, "
+            f"update_available={update_flag}"
+        )
+
+    LAST_CHECK.set(time.time())
+    logger.info("Container update check complete")
+
+if __name__ == "__main__":
+    logger.info(
+        f"Starting Docker update exporter on port {EXPORTER_PORT} "
+        f"with LOG_LEVEL={LOG_LEVEL}"
+    )
+
+    start_http_server(EXPORTER_PORT)
+
+    while True:
+        try:
+            check_containers()
+        except Exception as e:
+            logger.exception(f"Unhandled error during update check: {e}")
+
+        time.sleep(CHECK_INTERVAL)

services-up.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+CONTEXT="raspi"
+ENV="default-environment.env"
+PROJECT="raspi"
+FILES=(
+  -f docker-compose.yml
+)
+
+docker --context $CONTEXT compose -p $PROJECT --env-file $ENV  "${FILES[@]}" $1 $2 $3 $4 $5 $6 $7 $8 $9

telegraf.conf

@@ -0,0 +1,9 @@
+[agent]
+  interval = "10s"
+
+[[inputs.docker]]
+  endpoint = "tcp://docker-socket-proxy:2375"
+  gather_services = false
+
+[[outputs.prometheus_client]]
+  listen = ":9273"

traefik/dynamic.yml

@@ -0,0 +1,27 @@
+http:
+  middlewares:
+    crowdsec:
+      plugin:
+        crowdsec-bouncer:
+          crowdsecMode: live
+          crowdsecLapiKey: HeneLa2mazFVzl5+DQRKOdchBuJxKdjrHsHBE/03Acs
+          crowdsecLapiHost: crowdsec:8080
+          crowdsecLapiScheme: http
+
+    secHeaders:
+        headers:
+            browserXssFilter: true
+            contentTypeNosniff: true
+            frameDeny: true
+#            sslRedirect: true
+       #HSTS Configuration
+            stsIncludeSubdomains: true
+            stsPreload: true
+            stsSeconds: 15552000
+            forceSTSHeader: true
+            customFrameOptionsValue: "SAMEORIGIN"
+    default-chain:
+      chain:
+        middlewares:
+          - secHeaders
+          - crowdsec

traefik/traefik.yml

@@ -0,0 +1,58 @@
+api:
+  dashboard: true
+  insecure: true   # keep false if exposing via router
+ping: {}
+
+log:
+  level: INFO
+
+accessLog:
+  filePath: /logs/access.log
+  format: json
+
+entryPoints:
+  web:
+    address: ":80"
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+
+  websecure:
+    address: ":443"
+    http:
+      middlewares:
+        - default-chain@file
+
+providers:
+  docker:
+    endpoint: "tcp://docker-socket-proxy:2375"
+    exposedByDefault: false
+  file:
+    filename: /etc/traefik/dynamic.yml
+    watch: true
+
+experimental:
+  plugins:
+    crowdsec-bouncer:
+      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+      version: v1.4.2
+
+certificatesResolvers:
+  le:
+    acme:
+      email: wayne.bennett@live.com
+      storage: /letsencrypt/acme.json
+      httpChallenge:
+        entryPoint: web
+metrics:
+  prometheus:
+#    entryPoint: metrics:9100          # optional, default is "metrics"
+    buckets:
+      - 0.1
+      - 0.3
+      - 1.2
+      - 5.0
+    addEntryPointsLabels: true   # add labels for each entrypoint
+    addServicesLabels: true      # add labels for each service