added loki and nginx geolocation

docker/docker-compose.yaml

@@ -1,7 +1,7 @@
 version: '3'
 services:
   nginx:
-    image: nginx:latest
+    image: nginx-geoip:latest #https://git.limbosolutions.com/kb/nginx
     volumes:
       - nginx-conf.d:/etc/nginx/conf.d
       - letsencrypt-conf:/etc/letsencrypt
@@ -13,14 +13,16 @@ services:
       - 8080:8080
     command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
     restart: unless-stopped
+  promtail:
+    image: grafana/promtail:2.9.4
+    volumes:
+      - nginx-log:/mnt/nginx-logs
+      - promtail_etc:/etc/promtail
+    environment:
+      - PROMTAIL_LOKISERVER_ADDRESS=${PROMTAIL_LOKISERVER_ADDRESS}
+    command: -config.file=/etc/promtail/config.yml -config.expand-env=true
   duplicati:
     image: duplicati-mysqlclient:latest
-    environment:
-      - INFLUXDB_SERVER=${DUPLICATI_INFLUXDB_SERVER}
-      - INFLUXDB_BUCKET=${DUPLICATI_INFLUXDB_BUCKET}
-      - INFLUXDB_ORG=${DUPLICATI_INFLUXDB_ORG}
-      - INFLUXDB_TOKEN=${DUPLICATI_INFLUXDB_TOKEN}
-      - INFLUXDB_CLIENT_HOSTNAME=${DUPLICATI_INFLUXDB_CLIENT_HOSTNAME}
     volumes:
       - duplicati_tmpdata:/data
       - nginx-conf.d:/bck/nginx-conf.d
@@ -30,25 +32,13 @@ services:
     ports:
       - 8205:8200
     restart: unless-stopped
-  telegraf:
-    image: telegraf
-    restart: unless-stopped
-    volumes:
-      - telegraf-etc:/etc/telegraf
-      - nginx-log:/var/log/nginx
-    environment:
-    - INFLUXDB_URL=${TELEGRAF_INFLUXDB_URL}
-    - INFLUXDB_BUCKET=${TELEGRAF_INFLUXDB_BUCKET}
-    - INFLUXDB_ORG=${TELEGRAF_INFLUXDB_ORG}
-    - INFLUXDB_TOKEN=${TELEGRAF_INFLUXDB_TOKEN}
-    - INFLUXDB_CLIENT_HOSTNAME=${TELEGRAF_CLIENT_HOSTNAME}
   code-server:
     image: lscr.io/linuxserver/code-server:latest
     environment:
       - PUID=1000
       - PGID=1000
       - TZ=Etc/UTC
-      - PASSWORD=${codeserver_password}
+      - PASSWORD=${CODSERVER_PASSWORD}
       #- HASHED_PASSWORD= #optional
       #- SUDO_PASSWORD=password #optional
       #- SUDO_PASSWORD_HASH= #optional
@@ -57,6 +47,8 @@ services:
     volumes:
       - codeserver_config:/config
       - nginx-conf.d:/mnt/wan_reverse_proxy_nginx-conf.d
+      - promtail_etc:/mnt/promtail_etc
+      - nginx-log:/mnt/nginx-log
     ports:
       - 8443:8443
     restart: unless-stopped
@@ -68,3 +60,4 @@ volumes:
   telegraf-etc:
   nginx-log:
   codeserver_config:
+  promtail_etc:

docker/nginx/rootfs/etc/nginx/conf.d/default.conf

@@ -1,3 +1,42 @@
-log_format vhosts ' $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent $host "$http_referer" "$http_user_agent"';
+log_format json_analytics escape=json '{'
-access_log  /var/log/nginx/vhosts-access.log vhosts;
+                    '"msec": "$msec", ' # request unixtime in seconds with a milliseconds resolution
+                    '"connection": "$connection", ' # connection serial number
+                    '"connection_requests": "$connection_requests", ' # number of requests made in connection
+                    '"pid": "$pid", ' # process pid
+                    '"request_id": "$request_id", ' # the unique request id
+                    '"request_length": "$request_length", ' # request length (including headers and body)
+                    '"remote_addr": "$remote_addr", ' # client IP
+                    '"remote_user": "$remote_user", ' # client HTTP username
+                    '"remote_port": "$remote_port", ' # client port
+                    '"time_local": "$time_local", '
+                    '"time_iso8601": "$time_iso8601", ' # local time in the ISO 8601 standard format
+                    '"request": "$request", ' # full path no arguments if the request
+                    '"request_uri": "$request_uri", ' # full path and arguments if the request
+                    '"args": "$args", ' # args
+                    '"status": "$status", ' # response status code
+                    '"body_bytes_sent": "$body_bytes_sent", ' # the number of body bytes exclude headers sent to a client
+                    '"bytes_sent": "$bytes_sent", ' # the number of bytes sent to a client
+                    '"http_referer": "$http_referer", ' # HTTP referer
+                    '"http_user_agent": "$http_user_agent", ' # user agent
+                    '"http_x_forwarded_for": "$http_x_forwarded_for", ' # http_x_forwarded_for
+                    '"http_host": "$http_host", ' # the request Host: header
+                    '"server_name": "$server_name", ' # the name of the vhost serving the request
+                    '"request_time": "$request_time", ' # request processing time in seconds with msec resolution
+                    '"upstream": "$upstream_addr", ' # upstream backend server for proxied requests
+                    '"upstream_connect_time": "$upstream_connect_time", ' # upstream handshake time incl. TLS
+                    '"upstream_header_time": "$upstream_header_time", ' # time spent receiving upstream headers
+                    '"upstream_response_time": "$upstream_response_time", ' # time spend receiving upstream body
+                    '"upstream_response_length": "$upstream_response_length", ' # upstream response length
+                    '"upstream_cache_status": "$upstream_cache_status", ' # cache HIT/MISS where applicable
+                    '"ssl_protocol": "$ssl_protocol", ' # TLS protocol
+                    '"ssl_cipher": "$ssl_cipher", ' # TLS cipher
+                    '"scheme": "$scheme", ' # http or https
+                    '"request_method": "$request_method", ' # request method
+                    '"server_protocol": "$server_protocol", ' # request protocol, like HTTP/1.1 or HTTP/2.0
+                    '"pipe": "$pipe", ' # "p" if request was pipelined, "." otherwise
+                    '"gzip_ratio": "$gzip_ratio", '
+                    '"http_cf_ray": "$http_cf_ray"'
+                    '}';
+
+access_log /var/log/nginx/access_json_analytics.log json_analytics;
 

docker/promtail/rootfs/promail/config.yml

@@ -0,0 +1,20 @@
+server:
+  http_listen_port: 9080
+  grpc_listen_port: 0
+
+positions:
+  filename: /tmp/positions.yaml
+
+clients:
+  - url: ${PROMTAIL_LOKISERVER_ADDRESS}/loki/api/v1/push
+
+scrape_configs:
+- job_name: nginx
+  static_configs:
+  - targets:
+      - localhost
+    labels:
+      job: nginx
+      host: wanreverseproxy
+      agent: promtail
+      __path__: /mnt/nginx-logs/access_json_analytics.log

docker/telegraf/rootfs/etc/telegraf/telegraf.d/influxdb.conf

@@ -1,19 +0,0 @@
-[[outputs.influxdb_v2]] 
-
-
-#   ## The URLs of the InfluxDB cluster nodes.
-#   ##
-#   ## Multiple URLs can be specified for a single cluster, only ONE of the
-#   ## urls will be written to each interval.
-#   ##   ex: urls = ["https://us-west-2-1.aws.cloud2.influxdata.com"]
-urls = ["${INFLUXDB_URL}"]
-#
-#   ## Token for authentication.
-token = "${INFLUXDB_TOKEN}"
-#
-#   ## Organization is the name of the organization you wish to write to.
-organization = "${INFLUXDB_ORG}"
-#
-#   ## Destination bucket to write into.
-bucket = "${INFLUXDB_BUCKET}"
-#

docker/telegraf/rootfs/etc/telegraf/telegraf.d/nginx.conf

@@ -1,16 +0,0 @@
-[[inputs.nginx]]
-   	 urls = ["http://wansrv01:8080/stub_status"]
-   	 response_timeout = "5s"
-
-
-[[inputs.tail]]
-	files = ["/var/log/nginx/vhosts-access.log"]
-	from_beginning = true
-    name_override = "nginx_access-logv3"
-	grok_patterns = ["%{CUSTOM_LOG}"]
-	grok_custom_patterns = '''
-			CUSTOM_LOG %{COMMON_LOG_FORMAT} %{NOTSPACE:nginx_host} "%{DATA:referrer}" "%{DATA:agent}"
-			'''
-  	data_format = "grok"
-
-