Architecture
🧰 Step 1. Prerequisites
On all droplets, install:
sudo apt update -y
sudo apt install docker.io docker-compose ufw -y
sudo systemctl enable docker
sudo systemctl start docker⚙️ Step 2. Setup Node Exporter on Each App Droplet
Run Node Exporter in Docker:
docker run -d --name=node_exporter --restart=always -p 9100:9100 prom/node-exporterCheck:
curl http://localhost:9100/metrics | head🔐 Configure UFW on Node Exporter Droplets
We’ll only allow the Monitoring Droplet’s IP to access Node Exporter (port 9100).
sudo ufw allow OpenSSH
sudo ufw allow from <MONITORING_DROPLET_IP> to any port 9100 proto tcp
sudo ufw enable
sudo ufw status✅ This ensures only Prometheus can scrape metrics.
🧩 Step 3. Prometheus + Grafana on Monitoring Droplet
mkdir -p ~/monitoring/{prometheus,grafana}
cd ~/monitoringprometheus/prometheus.yml
global:
scrape_interval: 15s
scrape_configs:
- job_name: 'droplets'
static_configs:
- targets:
- "159.89.xx.xx:9100" # Droplet 1
- "178.62.xx.xx:9100" # Droplet 2
- "165.22.xx.xx:9100" # Droplet 3docker-compose.yml
version: "3.8"
services:
prometheus:
image: prom/prometheus
container_name: prometheus
restart: always
ports:
- "9090:9090"
volumes:
- ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
grafana:
image: grafana/grafana
container_name: grafana
restart: always
ports:
- "3000:3000"
environment:
- GF_SECURITY_ADMIN_USER=admin
- GF_SECURITY_ADMIN_PASSWORD=adm🚀 Step 4. Run Stack
docker-compose up -d
docker psCheck access:
Prometheus: http://monitoring-droplet-ip:9090
Grafana: http://monitoring-droplet-ip:3000
🔒 Step 5. Secure Monitoring Droplet with UFW
We’ll only allow:
SSH
Prometheus (9090)
Grafana (3000)
Internal outbound scraping
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
# Allow Grafana and Prometheus from your laptop/public IP
sudo ufw allow from <YOUR_PUBLIC_IP> to any port 3000 proto tcp
sudo ufw allow from <YOUR_PUBLIC_IP> to any port 9090 proto tcp
# (optional) allow VPC access if droplets in same network
sudo ufw allow from 10.0.0.0/8 to any port 9090 proto tcp
sudo ufw enable
sudo ufw status numbered✅ Now, only your IP can view dashboards; others are blocked.
🧱 Step 6. Configure Grafana
- Visit Grafana → http://monitoring-droplet-IP:3000
- Login → admin / admin
- Add Prometheus Data Source
URL: http://prometheus:9090
Save & Test ✅
- Import Dashboards:
Linux Node Exporter Full → Grafana Dashboard 1860
Docker Container Metrics → Grafana Dashboard 893
📊 Step 7. Validate Everything
Prometheus Targets:
http://:Monitor-Droplet-IP:9090/targets
✅ All should show “UP”
Grafana Dashboard: ✅ Shows CPU, Memory, Disk, Network live metrics
✅ Summary
| Component | Port | Access | Description |
| Prometheus | 9090 | Only from your IP | Collect and stores metrics |
| Grafana | 3000 | Only from your IP | Dashboards & Visualization |
| Node Exporter | 9100 | Only from Monitoring Droplet | Exposes system metrics |