{config, ...}: let
  lokiPort = config.m3ta.ports.get "loki";
  prmNetbirdIP = "100.91.49.26";
  cldNetbirdIP = "100.91.203.184";
in {
  services.loki = {
    enable = true;
    dataDir = "/var/lib/loki";
    configuration = {
      auth_enabled = false;

      server = {
        http_listen_address = "127.0.0.1";
        http_listen_port = lokiPort;
      };

      common = {
        path_prefix = config.services.loki.dataDir;
        replication_factor = 1;
        ring = {
          instance_addr = "127.0.0.1";
          kvstore.store = "inmemory";
        };
      };

      schema_config.configs = [
        {
          from = "2024-04-01";
          store = "tsdb";
          object_store = "filesystem";
          schema = "v13";
          index = {
            prefix = "index_";
            period = "24h";
          };
        }
      ];

      storage_config = {
        filesystem.directory = "${config.services.loki.dataDir}/chunks";
        tsdb_shipper = {
          active_index_directory = "${config.services.loki.dataDir}/tsdb-index";
          cache_location = "${config.services.loki.dataDir}/tsdb-cache";
        };
      };

      limits_config = {
        retention_period = "336h";
        max_query_lookback = "336h";
        allow_structured_metadata = true;
        volume_enabled = true;
        reject_old_samples = true;
        reject_old_samples_max_age = "168h";
      };

      compactor = {
        working_directory = "${config.services.loki.dataDir}/compactor";
        compaction_interval = "10m";
        retention_enabled = true;
        retention_delete_delay = "2h";
        retention_delete_worker_count = 50;
        delete_request_store = "filesystem";
      };

      analytics.reporting_enabled = false;
    };
  };

  services.traefik.staticConfigOptions.entryPoints.loki = {
    address = "${prmNetbirdIP}:${toString lokiPort}";
  };

  services.traefik.dynamicConfigOptions.http = {
    middlewares.loki-basic-auth.basicAuth.usersFile = config.age.secrets.monitoring-loki-htpasswd.path;

    services.loki.loadBalancer.servers = [
      {url = "http://127.0.0.1:${toString lokiPort}/";}
    ];

    routers.loki-push = {
      rule = "PathPrefix(`/loki/api/v1/push`)";
      entrypoints = ["loki"];
      service = "loki";
      middlewares = ["loki-basic-auth"];
    };
  };

  networking.firewall.extraCommands = ''
    iptables -A INPUT -p tcp -s ${cldNetbirdIP} --dport ${toString lokiPort} -j ACCEPT
  '';
}