DIGITALOCEAN APP PLATFORM X DATADOG

VPC (Virtual Private Cloud)

A VPC on DigitalOcean is a private, isolated network that you create within the DigitalOcean infrastructure. It allows you to run resources (such as Droplets, databases, etc.) within a virtual, isolated network environment—similar to AWS or GCP.

Create a VPC

In DigitalOcean -> Networking -> VPC, click Create VPC Network. In the next window, select the appropriate data center region, have DigitalOcean generate the IP range (default setting), and provide a name and description for the VPC.
 

The first VPC you create is automatically set as the default VPC. Any new components you create are automatically assigned to this VPC.

Server installation

After completing the basic server configuration (see my article Basic Server Security), you must also open the Datadog Agent port. This is done using the command sudo ufw allow from <vpc ip range> to any port 8126. Since the Datadog Agent is to be run as a Docker container, Docker must be installed on the server. Docker provides a good guide for this

https://docs.docker.com/engine/install/ubuntu/

After installation, a folder will be created within the /opt directory so that any user can configure the agent. Command: sudo mkdir /opt/datadog-agent.

I like to use docker compose to configure and run containers. The following file can be used for this purpose:

services:
  dd-agent:
    image: datadog/agent:latest
    container_name: datadog-agent
    network_mode: host
    restart: always
    environment:
      DD_SITE: "<datadog-site>"
      DD_API_KEY: "<your-api-key>"
      DD_APM_ENABLED: true
      DD_LOGS_ENABLED: true
      DD_CONTAINER_EXCLUDE_LOGS: "name:datadog-agent"
      DD_APM_NON_LOCAL_TRAFFIC: true
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /proc/:/host/proc/:ro
      - /sys/fs/cgroup/:/host/sys/fs/cgroup:ro

You can configure additional settings by referring to the Datadog documentation. The DD_APM_NON_LOCAL_TRAFFIC setting is important. It allows traces from external sources outside the server.

The Datadog agent is started using the command sudo docker compose up -d.

Firewall

The DigitalOcean firewall allows you to control incoming and outgoing traffic. The firewall can be assigned to multiple components, which then share the same network rules. The firewall operates at the network level within the DigitalOcean infrastructure.

Create a firewall

In DigitalOcean -> Networking -> Firewall, click Create Firewall. In the firewall window that appears, give it a descriptive name. By default, the Inbound Rules only allow the SSH port from all IPv4 and IPv6 addresses. This setting must be changed so that the server remains accessible via SSH. To do this, set the Type to Custom and enter the desired SSH port (see Server Installation).

A new rule is then created. The type is Custom, The port is 8126 (the Datadog agent port), and for the source, enter the VPC's IP range (e.g., 10.114.0.0/20).

You can then select the droplet you created earlier under Apply to Droplets.

Configuration of the application

To allow the application to send traces to the Datadog agent that has been set up, the server’s private IP address (e.g., 10.114.0.2) is set as the DD_AGENT_HOST. This causes the library (e.g., ddtrace) to send the data to the Datadog agent running on the server instead of to localhost. In addition, the app must be added to the created VPC. This can be done within the app under Settings -> Region.

Conclusion

Due to the limitations of the DigitalOcean App Platform, which do not allow for native use of the Datadog agent, and the lack of direct integration between Datadog and DigitalOcean, the method described here is the only way to monitor applications within the DigitalOcean App Platform using Datadog.