docker-compose.yml

version: "3"
services:
  mysql:
    ports:
      - 3306:3306
    image: mysql:8.4@sha256:43bd9764df60666fb2ba2cf8217dd17b3d2414c150005d2fdd07a0cd73d3b7f5
    environment:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD:-root}
      - MYSQL_DATABASE=${MYSQL_DATABASE:-grafana}
      - MYSQL_USER=${MYSQL_USER:-grafana}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD:-grafana}
    healthcheck:
      test:
        [
          "CMD",
          "mysqladmin",
          "ping",
          "-p$$MYSQL_ROOT_PASSWORD",
          "--protocol",
          "tcp",
        ]
      interval: 10s
      retries: 10
      start_period: 10s
  grafana:
    depends_on:
      mysql:
        condition: service_healthy
    ports:
      - 3000:3000
    image: ${GRAFANA_IMAGE:-grafana/grafana}:${GRAFANA_VERSION}
    pull_policy: always
    user: ${DOCKER_USER_UID:-}
    environment:
      - GF_DATABASE_TYPE=mysql
      - GF_DATABASE_HOST=mysql
      - GF_DATABASE_NAME=${MYSQL_DATABASE:-grafana}
      - GF_DATABASE_USER=${MYSQL_USER:-grafana}
      - GF_DATABASE_PASSWORD=${MYSQL_PASSWORD:-grafana}
      - GF_SERVER_ROOT_URL=${GRAFANA_URL}
      - GF_ENTERPRISE_LICENSE_TEXT=${GF_ENTERPRISE_LICENSE_TEXT:-}
      - GF_SERVER_SERVE_FROM_SUB_PATH=${GF_SERVER_SERVE_FROM_SUB_PATH:-}
      - GF_FEATURE_TOGGLES_ENABLE=${GF_FEATURE_TOGGLES_ENABLE:-nestedFolders,ssoSettingsApi,ssoSettingsSAML,ssoSettingsLDAP,grafanaManagedRecordingRulesDatasources,enableSCIM,alertEnrichmentMultiStep,alertEnrichmentConditional,alertingEnrichmentAssistantInvestigations,secretsManagementAppPlatform,secretsManagementAppPlatformUI,grafanaAPIServerWithExperimentalAPIs,secretsManagementAppPlatformAwsKeeper}
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://0.0.0.0:3000/api/health || exit 1 # Use wget because older versions of Grafana don't have curl
      interval: 10s
      retries: 10
      start_period: 10s
    volumes:
      - ./testdata:/certs
  mtls-proxy:
    profiles:
      - "tls"
    depends_on:
      - grafana
    image: squareup/ghostunnel:v1.5.2@sha256:70f4cf270425dee074f49626ec63fc96e6712e9c0eedf127e7254e8132d25063
    command: |
      server
        --listen 0.0.0.0:3001
        --target grafana:3000
        --unsafe-target
        --key /certs/grafana.key
        --cert /certs/grafana.crt
        --cacert /certs/ca.crt
        --allow-cn client
    volumes:
      - ./testdata:/certs
    ports:
      - 3001:3001
  nginx:
    profiles:
      - "proxy"
    depends_on:
      - grafana
    image: nginx:latest@sha256:fa5f6b4cc851e85f8542619dac4f60b1f24681fc7be221d00f4221c4f3b92caa
    ports:
      - 3001:3001
    volumes:
      - ./testdata/nginx.conf:/etc/nginx/nginx.conf