loki: internal log store on backend_net, no Traefik route, auth_enabled: false because access is limited to internal Docker networking.
alloy: Docker log collector. It mounts /var/run/docker.sock:ro as a documented observability exception and forwards Docker container logs to Loki.

Host sync

Before first deploy, sync the checked-in config files to appdata:

mkdir -p /mnt/user/appdata/loki/config /mnt/user/appdata/loki/data
mkdir -p /mnt/user/appdata/alloy/config /mnt/user/appdata/alloy/data
cp /mnt/user/services/homelab-infra/ops/loki/config/loki-config.yml /mnt/user/appdata/loki/config/loki-config.yml
cp /mnt/user/services/homelab-infra/ops/loki/config/config.alloy /mnt/user/appdata/alloy/config/config.alloy

Restore posture

Loki data is transient operational telemetry. Docker raw logs remain the first fallback, Loki chunks on disk are a convenience cache, and ntfy critical events provide the external first-crash marker.