Add Netdata monitoring stack

Docker Compose setup for Netdata with monitoring_network (172.24.0.0/16).
Includes nginx location blocks for path-based access at swave.lol/netdata/.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2 files changed, 68 insertions, 0 deletions

diff --git a/netdata/docker-compose.yaml b/netdata/docker-compose.yaml
new file mode 100644
index 0000000..3f2cda2
--- /dev/null
+++ b/netdata/docker-compose.yaml
@@ -0,0 +1,45 @@
+services:
+
+  netdata:
+    image: netdata/netdata:latest
+    container_name: netdata
+    hostname: bastion
+    restart: always
+    pid: host
+    cap_add:
+      - SYS_PTRACE
+      - SYS_ADMIN
+    security_opt:
+      - apparmor:unconfined
+    environment:
+      - NETDATA_CLAIM_TOKEN=
+      - NETDATA_CLAIM_URL=https://app.netdata.cloud
+      - NETDATA_CLAIM_ROOMS=
+    volumes:
+      - netdata-config:/etc/netdata
+      - netdata-lib:/var/lib/netdata
+      - netdata-cache:/var/cache/netdata
+      - /etc/passwd:/host/etc/passwd:ro
+      - /etc/group:/host/etc/group:ro
+      - /etc/localtime:/etc/localtime:ro
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /etc/os-release:/host/etc/os-release:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      monitoring_network:
+        ipv4_address: 172.24.0.2
+
+networks:
+  monitoring_network:
+    name: monitoring_network
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.24.0.0/16
+          gateway: 172.24.0.1
+
+volumes:
+  netdata-config:
+  netdata-lib:
+  netdata-cache:
diff --git a/netdata/nginx-netdata.conf b/netdata/nginx-netdata.conf
new file mode 100644
index 0000000..9151d4c
--- /dev/null
+++ b/netdata/nginx-netdata.conf
@@ -0,0 +1,23 @@
+# Netdata — path-based proxy
+# Add this location block to the existing swave.lol HTTPS server block in nginx.conf
+#
+# The trailing slash in proxy_pass strips /netdata/ before forwarding to Netdata.
+# Netdata uses relative URLs internally, so path stripping works correctly.
+# Netdata container is on monitoring_network at 172.24.0.2, port 19999.
+
+location = /netdata {
+    return 301 /netdata/;
+}
+
+location /netdata/ {
+    proxy_pass http://172.24.0.2:19999/;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Server $host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_read_timeout 86400;
+}