@arcote.tech/arc-cli 0.7.19 → 0.7.21

package/src/deploy/compose.ts

@@ -1,3 +1,4 @@
+import { observabilityDomain } from "./caddyfile";
 import type { DeployConfig } from "./config";
 
 // ---------------------------------------------------------------------------
@@ -21,6 +22,17 @@ export interface ComposeOptions {
   cfg: DeployConfig;
 }
 
+/** json-file log rotation for every service — without it container logs grow
+ *  unbounded and eventually fill the disk. Alloy tails these same files via
+ *  the Docker API, and rotation is handled transparently. */
+function pushLogging(lines: string[]): void {
+  lines.push("    logging:");
+  lines.push("      driver: json-file");
+  lines.push("      options:");
+  lines.push('        max-size: "10m"');
+  lines.push('        max-file: "3"');
+}
+
 export function generateCompose({ cfg }: ComposeOptions): string {
   const lines: string[] = [];
   lines.push("# Generated by `arc platform deploy` — do not edit by hand.");
@@ -29,6 +41,7 @@ export function generateCompose({ cfg }: ComposeOptions): string {
   lines.push("  caddy:");
   lines.push("    image: caddy:2-alpine");
   lines.push("    restart: unless-stopped");
+  pushLogging(lines);
   lines.push("    ports:");
   lines.push('      - "80:80"');
   lines.push('      - "443:443"');
@@ -46,6 +59,10 @@ export function generateCompose({ cfg }: ComposeOptions): string {
   lines.push("      - caddy_config:/config");
   lines.push("    networks:");
   lines.push("      - arc-net");
+  if (cfg.observability?.enabled) {
+    lines.push("    expose:");
+    lines.push('      - "2020"  # Prometheus metrics endpoint (Caddyfile :2020 site)');
+  }
   lines.push("");
 
   // Private Docker Registry — `arc platform deploy` pushes app images here,
@@ -54,6 +71,7 @@ export function generateCompose({ cfg }: ComposeOptions): string {
   lines.push("  registry:");
   lines.push("    image: registry:2");
   lines.push("    restart: unless-stopped");
+  pushLogging(lines);
   lines.push("    volumes:");
   lines.push("      - registry_data:/var/lib/registry");
   lines.push("      - ./registry-auth/htpasswd:/auth/htpasswd:ro");
@@ -81,6 +99,15 @@ export function generateCompose({ cfg }: ComposeOptions): string {
     );
     lines.push(`    container_name: arc-${name}`);
     lines.push("    restart: unless-stopped");
+    pushLogging(lines);
+    // The host server exposes GET /health (packages/host healthHandler).
+    // Image base is oven/bun:1-alpine — busybox wget is available.
+    lines.push("    healthcheck:");
+    lines.push('      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:5005/health"]');
+    lines.push("      interval: 30s");
+    lines.push("      timeout: 5s");
+    lines.push("      retries: 3");
+    lines.push("      start_period: 20s");
     if (usePostgres) {
       lines.push("    depends_on:");
       lines.push(`      arc-db-${name}:`);
@@ -149,6 +176,7 @@ export function generateCompose({ cfg }: ComposeOptions): string {
     lines.push(`    image: ${image}`);
     lines.push(`    container_name: arc-db-${name}`);
     lines.push("    restart: unless-stopped");
+    pushLogging(lines);
     lines.push("    environment:");
     lines.push("      POSTGRES_USER: arc");
     lines.push("      POSTGRES_DB: arc");
@@ -186,11 +214,17 @@ export function generateCompose({ cfg }: ComposeOptions): string {
     lines.push("    image: otel/opentelemetry-collector-contrib:0.114.0");
     lines.push("    container_name: arc-otel-collector");
     lines.push("    restart: unless-stopped");
+    pushLogging(lines);
+    // Root needed for the hostmetrics (/hostfs) + docker_stats (docker.sock)
+    // receivers — the image's default user 10001 can read neither.
+    lines.push("    user: \"0:0\"");
     lines.push("    command: [\"--config=/etc/otelcol-contrib/config.yaml\"]");
     lines.push("    volumes:");
     lines.push(
       "      - ./observability/otel-collector-config.yaml:/etc/otelcol-contrib/config.yaml:ro",
     );
+    lines.push("      - /:/hostfs:ro                                  # hostmetrics root_path");
+    lines.push("      - /var/run/docker.sock:/var/run/docker.sock:ro  # docker_stats");
     lines.push("    networks: [arc-net]");
     lines.push("    expose:");
     lines.push("      - \"4317\"  # OTLP gRPC");
@@ -206,6 +240,7 @@ export function generateCompose({ cfg }: ComposeOptions): string {
     lines.push("    image: grafana/tempo:2.6.1");
     lines.push("    container_name: arc-tempo");
     lines.push("    restart: unless-stopped");
+    pushLogging(lines);
     lines.push("    command: [\"-config.file=/etc/tempo.yaml\"]");
     lines.push("    user: \"0\"  # tempo writes to /var/tempo, owned by root in the image");
     lines.push("    volumes:");
@@ -221,6 +256,7 @@ export function generateCompose({ cfg }: ComposeOptions): string {
     lines.push("    image: grafana/loki:3.3.2");
     lines.push("    container_name: arc-loki");
     lines.push("    restart: unless-stopped");
+    pushLogging(lines);
     lines.push("    command: [\"-config.file=/etc/loki/local-config.yaml\"]");
     lines.push("    user: \"0\"");
     lines.push("    volumes:");
@@ -236,6 +272,7 @@ export function generateCompose({ cfg }: ComposeOptions): string {
     lines.push("    image: prom/prometheus:v2.55.1");
     lines.push("    container_name: arc-prometheus");
     lines.push("    restart: unless-stopped");
+    pushLogging(lines);
     lines.push("    command:");
     lines.push("      - \"--config.file=/etc/prometheus/prometheus.yml\"");
     lines.push("      - \"--storage.tsdb.path=/prometheus\"");
@@ -250,11 +287,38 @@ export function generateCompose({ cfg }: ComposeOptions): string {
     lines.push("      - \"9090\"  # HTTP API + remote_write receiver");
     lines.push("");
 
+    // Grafana Alloy — tails stdout/stderr of every container (Docker API)
+    // and pushes to Loki. Complements in-app OTLP logs with infra-container
+    // output and app crash logs.
+    lines.push("  alloy:");
+    lines.push("    image: grafana/alloy:v1.16.1");
+    lines.push("    container_name: arc-alloy");
+    lines.push("    restart: unless-stopped");
+    pushLogging(lines);
+    lines.push("    user: \"0\"  # docker.sock access");
+    lines.push("    command:");
+    lines.push("      - run");
+    lines.push("      - --server.http.listen-addr=0.0.0.0:12345");
+    lines.push("      - --storage.path=/var/lib/alloy/data");
+    lines.push("      - /etc/alloy/config.alloy");
+    lines.push("    volumes:");
+    lines.push("      - ./observability/alloy-config.alloy:/etc/alloy/config.alloy:ro");
+    lines.push("      - /var/run/docker.sock:/var/run/docker.sock:ro");
+    lines.push("      - alloy_data:/var/lib/alloy/data");
+    lines.push("    networks: [arc-net]");
+    lines.push("    expose:");
+    lines.push("      - \"12345\"  # Alloy self-metrics (Prom scrape)");
+    lines.push("    depends_on:");
+    lines.push("      - loki");
+    lines.push("");
+
     const adminPasswordEnv = cfg.observability.adminPasswordEnv ?? "ARC_OBSERVABILITY_PASSWORD";
+    const grafanaDomain = observabilityDomain(cfg);
     lines.push("  grafana:");
     lines.push("    image: grafana/grafana:11.4.0");
     lines.push("    container_name: arc-grafana");
     lines.push("    restart: unless-stopped");
+    pushLogging(lines);
     lines.push("    environment:");
     lines.push("      GF_SECURITY_ADMIN_USER: admin");
     lines.push(
@@ -262,6 +326,11 @@ export function generateCompose({ cfg }: ComposeOptions): string {
     );
     lines.push("      GF_USERS_ALLOW_SIGN_UP: \"false\"");
     lines.push("      GF_AUTH_ANONYMOUS_ENABLED: \"false\"");
+    if (grafanaDomain) {
+      // Correct absolute links in alert notifications + UI redirects behind
+      // the Caddy reverse proxy.
+      lines.push(`      GF_SERVER_ROOT_URL: "https://${grafanaDomain}"`);
+    }
     // Subpath-less — the upstream URL is served from root via Caddy reverse
     // proxy on a dedicated subdomain.
     lines.push("    volumes:");
@@ -278,6 +347,9 @@ export function generateCompose({ cfg }: ComposeOptions): string {
     lines.push(
       "      - ./observability/grafana-dashboards:/etc/grafana/provisioning/dashboards/arc:ro",
     );
+    lines.push(
+      "      - ./observability/grafana-alerting:/etc/grafana/provisioning/alerting:ro",
+    );
     lines.push("      - grafana_data:/var/lib/grafana");
     lines.push("    networks: [arc-net]");
     lines.push("    expose:");
@@ -308,6 +380,7 @@ export function generateCompose({ cfg }: ComposeOptions): string {
     lines.push("  loki_data:");
     lines.push("  prometheus_data:");
     lines.push("  grafana_data:");
+    lines.push("  alloy_data:");
   }
 
   return lines.join("\n") + "\n";

package/src/deploy/config.ts

@@ -109,6 +109,11 @@ export interface DeployObservability {
     logs?: string;
     metrics?: string;
   };
+  /** Webhook URL for Grafana alert notifications (Slack/Discord/anything that
+   *  accepts a POST). When absent, alert rules are still provisioned but no
+   *  contact point / notification policy is created — alerts are visible in
+   *  the Grafana UI only. */
+  alertWebhookUrl?: string;
 }
 
 export interface DeployRegistry {
@@ -344,6 +349,15 @@ export function validateDeployConfig(input: unknown): DeployConfig {
         metrics: optionalString(retentionRaw, "observability.retention.metrics"),
       };
     }
+    const alertWebhookUrl = optionalString(
+      observabilityRaw,
+      "observability.alertWebhookUrl",
+    );
+    if (alertWebhookUrl !== undefined && !/^https?:\/\/.+/.test(alertWebhookUrl)) {
+      throw new Error(
+        `deploy.arc.json: observability.alertWebhookUrl must be an http(s) URL (got "${alertWebhookUrl}")`,
+      );
+    }
     validated.observability = {
       enabled: enabledRaw,
       subdomain: optionalString(observabilityRaw, "observability.subdomain") ?? "observability",
@@ -351,6 +365,7 @@ export function validateDeployConfig(input: unknown): DeployConfig {
         optionalString(observabilityRaw, "observability.adminPasswordEnv") ??
         "ARC_OBSERVABILITY_PASSWORD",
       retention,
+      alertWebhookUrl,
     };
   }