feat: grafana loki

2026-07-10 13:10:58 +02:00
parent b800bfe08b
commit 8d57aa4bc0
16 changed files with 1095 additions and 3 deletions
@@ -0,0 +1,91 @@
+{config, ...}: let
+  lokiPort = config.m3ta.ports.get "loki";
+  prmNetbirdIP = "100.91.49.26";
+  cldNetbirdIP = "100.91.203.184";
+in {
+  services.loki = {
+    enable = true;
+    dataDir = "/var/lib/loki";
+    configuration = {
+      auth_enabled = false;
+
+      server = {
+        http_listen_address = "127.0.0.1";
+        http_listen_port = lokiPort;
+      };
+
+      common = {
+        path_prefix = config.services.loki.dataDir;
+        replication_factor = 1;
+        ring = {
+          instance_addr = "127.0.0.1";
+          kvstore.store = "inmemory";
+        };
+      };
+
+      schema_config.configs = [
+        {
+          from = "2024-04-01";
+          store = "tsdb";
+          object_store = "filesystem";
+          schema = "v13";
+          index = {
+            prefix = "index_";
+            period = "24h";
+          };
+        }
+      ];
+
+      storage_config = {
+        filesystem.directory = "${config.services.loki.dataDir}/chunks";
+        tsdb_shipper = {
+          active_index_directory = "${config.services.loki.dataDir}/tsdb-index";
+          cache_location = "${config.services.loki.dataDir}/tsdb-cache";
+        };
+      };
+
+      limits_config = {
+        retention_period = "336h";
+        max_query_lookback = "336h";
+        allow_structured_metadata = true;
+        volume_enabled = true;
+        reject_old_samples = true;
+        reject_old_samples_max_age = "168h";
+      };
+
+      compactor = {
+        working_directory = "${config.services.loki.dataDir}/compactor";
+        compaction_interval = "10m";
+        retention_enabled = true;
+        retention_delete_delay = "2h";
+        retention_delete_worker_count = 50;
+        delete_request_store = "filesystem";
+      };
+
+      analytics.reporting_enabled = false;
+    };
+  };
+
+  services.traefik.staticConfigOptions.entryPoints.loki = {
+    address = "${prmNetbirdIP}:${toString lokiPort}";
+  };
+
+  services.traefik.dynamicConfigOptions.http = {
+    middlewares.loki-basic-auth.basicAuth.usersFile = config.age.secrets.monitoring-loki-htpasswd.path;
+
+    services.loki.loadBalancer.servers = [
+      {url = "http://127.0.0.1:${toString lokiPort}/";}
+    ];
+
+    routers.loki-push = {
+      rule = "PathPrefix(`/loki/api/v1/push`)";
+      entrypoints = ["loki"];
+      service = "loki";
+      middlewares = ["loki-basic-auth"];
+    };
+  };
+
+  networking.firewall.extraCommands = ''
+    iptables -A INPUT -p tcp -s ${cldNetbirdIP} --dport ${toString lokiPort} -j ACCEPT
+  '';
+}