Deployment Overview of Prometheus on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the following requirements must be met:

Operating System: Ubuntu
Privileges: Root or sudo access is required for installation.
Docker: Docker engine must be installed on the host.
Ports:
9090: Internal application port.
443: External HTTPS traffic.

FQDN of the final panel on the hostkey.in domain¶

The application is accessible via a specific subdomain template:

Parameter	Value
Prefix	`prometheus`
Domain	`hostkey.in`
Full template	`prometheus{Server_ID_from_Invapi}.hostkey.in`

File and Directory Structure¶

The application uses the following directory structure for configuration and data persistence:

/srv/prometheus: Main data directory for Prometheus.
/srv/prometheus/config: Configuration files directory.
/root/nginx: Nginx proxy configuration directory.
/data/nginx/user_conf.d: User-specific Nginx configuration files.

Application Installation Process¶

The installation process involves several automated steps to prepare the environment and deploy the application:

System Preparation: The system is checked for compatibility (Ubuntu distribution).
Docker Installation: Docker engine is installed on the host if not already present.
Directory Setup:
Directories /srv/prometheus and /srv/prometheus/config are created.
Permissions are set with ownership 65534:65534 (Prometheus user) to ensure the container can access data.
Configuration Generation: A default prometheus.yml file is generated in /srv/prometheus/config/.
Container Deployment: The Prometheus Docker container is started using the specified image version.
Proxy Configuration: An Nginx proxy is configured to route traffic from the domain to the local application port via a reverse proxy setup.

Access Rights and Security¶

File Permissions: Data directories are set to 0775 mode with ownership assigned to user/group 65534.
Network Security: The application is configured behind an Nginx reverse proxy, which handles SSL termination.
Container Isolation: Prometheus runs in a dedicated Docker container with restricted access to specific volumes.

Databases¶

Prometheus uses a Time Series Database (TSDB) for data storage.

Storage Location: /prometheus inside the container, mapped to /srv/prometheus on the host.
Configuration: The database is managed via the --storage.tsdb.path=/prometheus command-line argument.

Docker Containers and Their Deployment¶

The deployment utilizes two main containers:

Prometheus Container¶

Image Name: prom/prometheus:v3.0.0
Ports: 9090:9090
Volumes:
/srv/prometheus/config/prometheus.yml:/etc/prometheus/prometheus.yml
/srv/prometheus:/prometheus
Environment Variables: N/A
Restart Policy: always

Nginx Proxy Container¶

Image Name: jonasal/nginx-certbot:latest
Ports: Uses host network mode.
Volumes:
nginx_secrets:/etc/letsencrypt (External volume)
/data/nginx/user_conf.d:/etc/nginx/user_conf.d
Environment Variables:
[email protected]
Restart Policy: unless-stopped

Application Update Instructions¶

To update the Prometheus application, perform the following steps:

Pull the latest image for the specific version or use the updated tag.

Restart the container to apply changes:

docker compose pull && docker compose up -d

Location of Configuration Files and Data¶

Prometheus Config: /srv/prometheus/config/prometheus.yml
Prometheus Data: /srv/prometheus
Nginx User Configs: /data/nginx/user_conf.d/

Available Ports for Connection¶

HTTPS (External): 443
HTTP (Internal): 9090

Starting and Stopping the Application¶

The application is managed via Docker Compose within the /root/nginx directory for the proxy, or via standard Docker commands for the Prometheus service.

To stop the application:

docker stop prometheus

To start the application:

docker start prometheus

Proxy Servers¶

The application is served through an Nginx reverse proxy using nginx-certbot. This setup provides:

SSL/TLS: Automated certificate management via Certbot.
Domain Routing: Traffic arriving at prometheus{Server_ID}.hostkey.in is proxied to http://127.0.0.1:9090.