feat(indexer): Add grafana and alert service to local development

[roninjin10]

• add prometheus to docker-compose
• add grafana to docker-compose
• add new folder for holding grafana provisioning and configuration
• Add alert service
• Configure alert service
• Configure gafana dashboard for api
• Configure grafana dashboard for indexer
• remove gateway/backend service
• make docker-compose run against more networks than just goerli

[roninjin10]

Current dependencies on/for this PR:

• develop
  • PR fix(indexer): Add migrations file to docker image" #7260
    • PR feat(indexer): Add grafana and alert service to local development #7257 👈

This comment was auto-generated by Graphite.

[semgrep-app]

Service 'grafana' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

_{Ignore this finding from writable-filesystem-service.}

[semgrep-app]

Service 'prometheus' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

_{Ignore this finding from writable-filesystem-service.}

[semgrep-app]

Service 'grafana' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

_{Ignore this finding from no-new-privileges.}

[semgrep-app]

Service 'prometheus' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

_{Ignore this finding from no-new-privileges.}

[semgrep-app]

Service 'alertmanager' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

_{Ignore this finding from writable-filesystem-service.}

[semgrep-app]

Service 'alertmanager' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

_{Ignore this finding from no-new-privileges.}

[semgrep-app]

Semgrep found 1 gorm-hardcoded-secret finding:

• indexer/database/db.go: L51-55

A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>indexer/database/db.go</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0("<b>[Line: 49]</b> #quot; password=%s#quot;")
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2("<b>[Line: 49]</b> dsn")
        end
        %% Sink

        subgraph Sink
            direction LR

            v1("<b>[Line: 51]</b> gorm.Open(postgres.Open(dsn), &gorm.Config{<br>			// The indexer will explicitly manage the transactions<br>			SkipDefaultTransaction: true,<br>			Logger:                 logger.Default.LogMode(logger.Silent),<br>		})")
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink

    %% Clickable

    click v0 href "https://github.com/ethereum-optimism/optimism/blob/07e6b6e53a4988118488d265a5ee7f175a29d351/indexer/database/db.go#L49" "View in source" _blank
    click v1 href "https://github.com/ethereum-optimism/optimism/blob/07e6b6e53a4988118488d265a5ee7f175a29d351/indexer/database/db.go#L51" "View in source" _blank
    click v2 href "https://github.com/ethereum-optimism/optimism/blob/07e6b6e53a4988118488d265a5ee7f175a29d351/indexer/database/db.go#L49" "View in source" _blank

Loading

_{Ignore this finding from gorm-hardcoded-secret.}

Semgrep found 1 gorm-empty-password finding:

• indexer/database/db.go: L51-55

The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>indexer/database/db.go</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0("<b>[Line: 49]</b> #quot; password=%s#quot;")
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2("<b>[Line: 49]</b> dsn")
        end
        %% Sink

        subgraph Sink
            direction LR

            v1("<b>[Line: 51]</b> gorm.Open(postgres.Open(dsn), &gorm.Config{<br>			// The indexer will explicitly manage the transactions<br>			SkipDefaultTransaction: true,<br>			Logger:                 logger.Default.LogMode(logger.Silent),<br>		})")
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink

    %% Clickable

    click v0 href "https://github.com/ethereum-optimism/optimism/blob/07e6b6e53a4988118488d265a5ee7f175a29d351/indexer/database/db.go#L49" "View in source" _blank
    click v1 href "https://github.com/ethereum-optimism/optimism/blob/07e6b6e53a4988118488d265a5ee7f175a29d351/indexer/database/db.go#L51" "View in source" _blank
    click v2 href "https://github.com/ethereum-optimism/optimism/blob/07e6b6e53a4988118488d265a5ee7f175a29d351/indexer/database/db.go#L49" "View in source" _blank

Loading

_{Ignore this finding from gorm-empty-password.}

[github-actions]

This PR is stale because it has been open 14 days with no activity. Remove stale label or comment or this will be closed in 5 days.