feat: run core stack without a tunnel token

Move cloudflared into an optional compose.tunnel.yml overlay (pinned to
2026.6.1 instead of :latest) so a fresh clone + .env.example + 'just up'
brings up Grafana locally. 'just up-tunnel' is the production path.

Author: simonvanlierde

.env.example

@@ -6,5 +6,6 @@ GRAFANA_ADMIN_PASSWORD=change-me
 #   GRAFANA_ROOT_URL=https://grafana.example.com
 GRAFANA_ROOT_URL=http://localhost:3000
 
+# Only needed for `just up-tunnel` (production exposure via Cloudflare Tunnel).
 # From: Cloudflare Zero Trust → Networks → Tunnels → <your tunnel> → Configure → token
 CLOUDFLARE_TUNNEL_TOKEN=

compose.tunnel.yml

@@ -0,0 +1,21 @@
+# Production overlay: expose Grafana (and the OTLP endpoints) via Cloudflare
+# Tunnel. Requires CLOUDFLARE_TUNNEL_TOKEN in .env.
+#
+#   just up-tunnel
+#
+# Token-based tunnel: routes are configured in the Cloudflare Zero Trust
+# dashboard. Create a tunnel at dash.cloudflare.com → Zero Trust → Networks →
+# Tunnels, then set the public hostnames there (e.g. grafana.example.com →
+# http://grafana:3000, otlp.example.com → http://otel-collector:4318).
+
+services:
+  cloudflared:
+    image: cloudflare/cloudflared:2026.6.1
+    restart: unless-stopped
+    depends_on: [ grafana, otel-collector ]
+    command: tunnel --no-autoupdate run --token ${CLOUDFLARE_TUNNEL_TOKEN:?set CLOUDFLARE_TUNNEL_TOKEN in .env}
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"

compose.yml

@@ -82,18 +82,6 @@ services:
       GF_FEATURE_TOGGLES_ENABLE: traceqlEditor,metricsSummary,traceToProfiles
     logging: *default-logging
 
-  cloudflared:
-    image: cloudflare/cloudflared:latest
-    restart: unless-stopped
-    depends_on: [ grafana, otel-collector ]
-    # Token-based tunnel: routes are configured in the Cloudflare Zero Trust dashboard.
-    # Create a tunnel at dash.cloudflare.com → Zero Trust → Networks → Tunnels,
-    # then set the public hostnames there (e.g. grafana.example.com → http://grafana:3000,
-    # otlp.example.com → http://otel-collector:4318).
-    command: tunnel --no-autoupdate run --token ${CLOUDFLARE_TUNNEL_TOKEN:?set CLOUDFLARE_TUNNEL_TOKEN in .env}
-    logging: *default-logging
-    pull_policy: always
-
 volumes:
   loki_data:
   tempo_data:

justfile

@@ -3,11 +3,16 @@ set dotenv-load
 default:
     @just --list
 
+# Core stack (no tunnel; Grafana at http://localhost:3000)
 up:
     docker compose up -d
 
+# Core stack + Cloudflare Tunnel (production; needs CLOUDFLARE_TUNNEL_TOKEN)
+up-tunnel:
+    docker compose -f compose.yml -f compose.tunnel.yml up -d
+
 down:
-    docker compose down
+    docker compose down --remove-orphans
 
 logs service="":
     docker compose logs -f {{service}}