diff --git a/monitoring/.env.example b/monitoring/.env.example
new file mode 100644
index 0000000..4dd531f
--- /dev/null
+++ b/monitoring/.env.example
@@ -0,0 +1,6 @@
+# Grafana Cloud credentials (find these at grafana.com -> My Account -> Grafana Cloud)
+GRAFANA_CLOUD_LOKI_URL=https://logs-prod-XXX.grafana.net/loki/api/v1/push
+GRAFANA_CLOUD_LOKI_USER=123456
+GRAFANA_CLOUD_PROMETHEUS_URL=https://prometheus-prod-XXX.grafana.net/api/prom/push
+GRAFANA_CLOUD_PROMETHEUS_USER=123456
+GRAFANA_CLOUD_API_KEY=glc_CHANGE_ME
diff --git a/monitoring/config.alloy b/monitoring/config.alloy
new file mode 100644
index 0000000..94a5001
--- /dev/null
+++ b/monitoring/config.alloy
@@ -0,0 +1,66 @@
+// ============================================================
+// Docker log collection -> Grafana Cloud Loki
+// ============================================================
+
+discovery.docker "containers" {
+  host = "unix:///var/run/docker.sock"
+}
+
+discovery.relabel "containers" {
+  targets = discovery.docker.containers.targets
+
+  rule {
+    source_labels = ["__meta_docker_container_name"]
+    target_label  = "container"
+  }
+
+  rule {
+    source_labels = ["__meta_docker_container_name"]
+    target_label  = "job"
+  }
+}
+
+loki.source.docker "containers" {
+  host       = "unix:///var/run/docker.sock"
+  targets    = discovery.relabel.containers.output
+  forward_to = [loki.write.grafana_cloud.receiver]
+}
+
+loki.write "grafana_cloud" {
+  endpoint {
+    url = env("GRAFANA_CLOUD_LOKI_URL")
+
+    basic_auth {
+      username = env("GRAFANA_CLOUD_LOKI_USER")
+      password = env("GRAFANA_CLOUD_API_KEY")
+    }
+  }
+}
+
+// ============================================================
+// Node exporter metrics -> Grafana Cloud Prometheus
+// ============================================================
+
+prometheus.exporter.unix "node" {
+  procfs_path = "/host/proc"
+  sysfs_path  = "/host/sys"
+  rootfs_path = "/host/root"
+}
+
+prometheus.scrape "node" {
+  targets    = prometheus.exporter.unix.node.targets
+  forward_to = [prometheus.remote_write.grafana_cloud.receiver]
+
+  scrape_interval = "60s"
+}
+
+prometheus.remote_write "grafana_cloud" {
+  endpoint {
+    url = env("GRAFANA_CLOUD_PROMETHEUS_URL")
+
+    basic_auth {
+      username = env("GRAFANA_CLOUD_PROMETHEUS_USER")
+      password = env("GRAFANA_CLOUD_API_KEY")
+    }
+  }
+}
diff --git a/monitoring/docker-compose.yml b/monitoring/docker-compose.yml
new file mode 100644
index 0000000..7ffd13f
--- /dev/null
+++ b/monitoring/docker-compose.yml
@@ -0,0 +1,23 @@
+services:
+  alloy:
+    image: grafana/alloy:latest
+    container_name: alloy
+    restart: unless-stopped
+    env_file: .env
+    volumes:
+      - ./config.alloy:/etc/alloy/config.alloy:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /:/host/root:ro
+    command:
+      - run
+      - /etc/alloy/config.alloy
+      - --storage.path=/var/lib/alloy/data
+    pid: host
+    networks:
+      - monitoring
+
+networks:
+  monitoring:
+    driver: bridge