# Loki / Alloy

Status: abgeloester Altstand. Der zentrale Zielzustand ist `monitoring/` mit `monitoring-loki` und `monitoring-promtail`.

Internal logging stack for KalliLab CORE.

## Services

- `loki`: internal log store on `backend_net`, no Traefik route, `auth_enabled: false` because access is limited to internal Docker networking.
- `alloy`: Docker log collector. It mounts `/var/run/docker.sock:ro` as a documented observability exception and forwards Docker container logs to Loki.

## Migration note

Do not run this stack in parallel with `monitoring/` unless you are deliberately comparing collectors during migration. After `monitoring-loki` and `monitoring-promtail` are live and Grafana can query logs, stop this Komodo stack and keep the files only as rollback reference.

## Host sync

Before first deploy, sync the checked-in config files to appdata:

```bash
mkdir -p /mnt/user/appdata/loki/config /mnt/user/appdata/loki/data
mkdir -p /mnt/user/appdata/alloy/config /mnt/user/appdata/alloy/data
cp /mnt/user/services/homelab-infra/ops/loki/config/loki-config.yml /mnt/user/appdata/loki/config/loki-config.yml
cp /mnt/user/services/homelab-infra/ops/loki/config/config.alloy /mnt/user/appdata/alloy/config/config.alloy
chown -R 10001:10001 /mnt/user/appdata/loki/data
chmod 644 /mnt/user/appdata/loki/config/loki-config.yml /mnt/user/appdata/alloy/config/config.alloy
```

## Restore posture

Loki data is transient operational telemetry. Docker raw logs remain the first fallback, Loki chunks on disk are a convenience cache, and ntfy critical events provide the external first-crash marker.