service:
  name: fleet-prometheus
  owner_node: vps
  role: fleet-liveness-source
  exposure: tailscale-internal   # reachable on Tailscale; NOT behind public npm proxy
  dependencies:
    - node_exporter              # first scrape target (VPS-local host metrics)
  ports:
    - container: 9090
      host: 9090
      protocol: tcp
  healthcheck:
    type: http
    endpoint: http://localhost:9090/-/healthy
    interval: 30s
    timeout: 10s
    retries: 5
  restart_policy: unless-stopped
  persistence:
    paths:
      - fleet-prometheus_tsdb     # TSDB -> /prometheus (named volume)
  runtime:
    config_files:
      - prometheus.yml            # scrape config (secret-free, in git)
    env_vars: []                  # no secrets / no required env