Metrics taps: node_exporter + cAdvisor containers, MediaMTX and Caddy metrics on loopback (Prometheus format, store-agnostic)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docker-compose.yml

@@ -23,6 +23,7 @@ services:
       - "127.0.0.1:8888:8888"    # HLS      -> Caddy live.HOST/hls/*
       - "127.0.0.1:8889:8889"    # WebRTC   -> Caddy live.HOST/webrtc/*
       - "127.0.0.1:9997:9997"    # API      -> Caddy live.HOST/api/*
+      - "127.0.0.1:9998:9998"    # Prometheus metrics (per-stream bitrate, readers, drops) -> scraper on the host
     volumes:
       - ./mediamtx.yml:/mediamtx.yml:ro
       - ./bin/mtx-on-ready.sh:/vanguard/on-ready.sh:ro   # is-live notice + WebRTC audio mirror (runOnReady)
@@ -299,6 +300,38 @@ services:
       - gitea
     restart: unless-stopped
 
+  # ---- metrics taps (LOGGING.md): Prometheus text format on loopback, scraped by whichever store is chosen later
+  node_exporter:
+    logging: *vglog
+    labels: { vanguard.service: node_exporter, vanguard.category: infra }
+    image: quay.io/prometheus/node-exporter:latest
+    container_name: node_exporter
+    network_mode: host               # listens on 127.0.0.1:9100 only
+    pid: host
+    command: ["--path.rootfs=/host", "--web.listen-address=127.0.0.1:9100", "--collector.filesystem.mount-points-exclude=^/(dev|proc|sys|run|var/lib/docker/.+)($$|/)"]
+    volumes:
+      - /:/host:ro,rslave
+    restart: unless-stopped
+
+  cadvisor:
+    logging: *vglog
+    labels: { vanguard.service: cadvisor, vanguard.category: infra }
+    image: gcr.io/cadvisor/cadvisor:latest
+    container_name: cadvisor
+    ports:
+      - "127.0.0.1:9101:8080"        # per-container CPU / memory / network / disk
+    command: ["--housekeeping_interval=10s", "--docker_only=true", "--store_container_labels=false", "--whitelisted_container_labels=vanguard.service,vanguard.category"]
+    volumes:
+      - /:/rootfs:ro
+      - /var/run:/var/run:ro
+      - /sys:/sys:ro
+      - /var/lib/docker/:/var/lib/docker:ro
+      - /dev/disk/:/dev/disk:ro
+    devices:
+      - /dev/kmsg
+    privileged: true
+    restart: unless-stopped
+
 volumes:
   copyparty_hist:
   caddy_data: