# yaml-language-server: $schema=https://schema.zeabur.app/template.json
apiVersion: zeabur.com/v1
kind: Template
metadata:
    name: VictoriaMetrics Gateway
spec:
    description: A lightweight gateway based on Caddy, specifically designed for the VictoriaMetrics stack (Metrics, Logs, and Traces).
    icon: https://cdn.zeabur.com/caddy.png
    tags:
        - monitoring
        - observability
        - gateway
    readme: |
        This gateway is ideal for scenarios where Grafana is located in a different project or environment and needs to access data over the public internet. Directly exposing VictoriaMetrics endpoints to the internet is insecure; therefore, using this gateway (which provides HTTP Basic Authentication) is the recommended approach for secure access.

        Note that you need to deploy [VictoriaMetrics](https://zeabur.com/templates/UBHA7Z), [VictoriaLogs](https://zeabur.com/templates/OXA4QA), and [VictoriaTraces](https://zeabur.com/templates/XUSH4W) in the same project of gateway.

        ## Key Features

        - **Enhanced Security**: Protects your data with HTTP Basic Auth, ensuring only authorized Grafana instances or users can pull data.
        - **Audit Logging**: Built-in logging allows you to monitor access requests and maintain an audit trail.
        - **Customizable**: Built on Caddy, you can easily extend the template to include advanced features like IP Whitelisting or specialized routing.
        - **Unified Access**: Provides a single domain entry point for all three observability pillars.

        ## Usage & Endpoints

        You can access the respective services using the following URL patterns:

        - VictoriaMetrics: `https://your-domain/metrics`
        - VictoriaLogs: `https://your-domain/logs`
        - VictoriaTraces: `https://your-domain/traces`

        Note that the gateway is protected with HTTP Basic Authentication. The default username and password are `victoria` and `9xjgxnOmuceAgVN4TWiFBg4WVeHhBZ2T`. You can change the username and password in the `Caddyfile`.
    services:
        - name: victoria-gateway
          icon: https://cdn.zeabur.com/caddy.png
          template: PREBUILT_V2
          spec:
            id: victoria-gateway
            source:
                image: caddy:2-alpine
            ports:
                - id: web
                  port: 80
                  type: HTTP
            env: {}
            configs:
                - path: /etc/caddy/Caddyfile
                  template: |
                    {
                        servers {
                            trusted_proxies static private_ranges
                            trusted_proxies_strict
                            client_ip_headers X-Forwarded-For X-Real-IP
                        }
                    }

                    :80 {
                        log

                        basic_auth {
                            # Generate your password hash using the following command:
                            #       caddy hash-password -p "your-password"
                            #
                            # The default username and password is "victoria" and "9xjgxnOmuceAgVN4TWiFBg4WVeHhBZ2T"
                            victoria $2a$14$3/JKdIT1I1IuIPxmSvrwRuswEYWXhJ1JlV8I4uu7upbQYcVyjUVoS
                        }

                        # VictoriaLogs
                        handle_path /logs* {
                            reverse_proxy http://victorialogs:9428
                        }

                        # VictoriaTraces
                        handle_path /traces* {
                            reverse_proxy http://victoriatraces:10428
                        }

                        # VictoriaMetrics
                        handle_path /metrics* {
                            reverse_proxy http://victoriametrics:8428
                        }

                        handle / {
                            respond <<EOF
                    Welcome to my VictoriaMetrics stack :)
                    ---

                    VictoriaTraces: /traces
                    VictoriaLogs: /logs
                    VictoriaMetrics: /metrics
                    EOF 200
                    }
                  permission: null
                  envsubst: null
            portForwarding:
                enabled: false