cleanup

config/monitoring/alloy.alloy

@@ -0,0 +1,72 @@
+// Log pipeline: files, Docker, journald → Loki (replaces Promtail).
+// See: https://grafana.com/docs/alloy/latest/set-up/migrate/from-promtail/
+
+loki.write "default" {
+  endpoint {
+    url = "http://loki:3100/loki/api/v1/push"
+  }
+}
+
+// varlogs: /var/log/**/*.log
+loki.source.file "varlogs" {
+  targets = [
+    { __path__ = "/var/log/**/*.log", job = "varlogs", host = "cyberdeck" },
+  ]
+  forward_to = [loki.write.default.receiver]
+  file_match {
+    enabled   = true
+    sync_period = "10s"
+  }
+}
+
+// docker: container logs with docker parsing and container label from path
+loki.source.file "docker" {
+  targets = [
+    { __path__ = "/var/lib/docker/containers/*/*-json.log", job = "docker", host = "cyberdeck" },
+  ]
+  forward_to = [loki.process.docker.receiver]
+  file_match {
+    enabled   = true
+    sync_period = "10s"
+  }
+}
+
+loki.process "docker" {
+  forward_to = [loki.relabel.docker.receiver]
+  stage.docker {}
+}
+
+loki.relabel "docker" {
+  forward_to = [loki.write.default.receiver]
+  rule {
+    source_labels = ["filename"]
+    regex         = "/var/lib/docker/containers/([^/]+)/.*"
+    target_label  = "container"
+    replacement   = "$1"
+  }
+}
+
+// journald: systemd journal with unit, host, level labels
+loki.relabel "journald" {
+  forward_to = []
+  rule {
+    source_labels = ["__journal__systemd_unit"]
+    target_label  = "unit"
+  }
+  rule {
+    source_labels = ["__journal__hostname"]
+    target_label  = "host"
+  }
+  rule {
+    source_labels = ["__journal__priority_keyword"]
+    target_label  = "level"
+  }
+}
+
+loki.source.journal "journald" {
+  forward_to    = [loki.write.default.receiver]
+  relabel_rules = loki.relabel.journald.rules
+  labels        = { job = "journald", host = "cyberdeck" }
+  path          = "/var/log/journal"
+  max_age       = "12h"
+}

config/monitoring/loki-config.yaml

@@ -1,49 +1,55 @@
+# Loki 3.6 single-binary config (from official loki-local-config.yaml).
+# See: https://grafana.com/docs/loki/latest/configure/
+
 auth_enabled: false
 
 server:
   http_listen_port: 3100
+  http_listen_address: 0.0.0.0
+  grpc_listen_port: 9096
   log_level: info
+  grpc_server_max_concurrent_streams: 1000
 
-ingester:
-  wal:
-    dir: /loki/wal
-  lifecycler:
-    ring:
-      kvstore:
-        store: inmemory
-      replication_factor: 1
-  chunk_idle_period: 5m
-  chunk_target_size: 1048576
-  max_transfer_retries: 0
+common:
+  instance_addr: 127.0.0.1
+  path_prefix: /loki
+  storage:
+    filesystem:
+      chunks_directory: /loki/chunks
+      rules_directory: /loki/rules
+  replication_factor: 1
+  ring:
+    kvstore:
+      store: inmemory
+
+query_range:
+  results_cache:
+    cache:
+      embedded_cache:
+        enabled: true
+        max_size_mb: 100
+
+limits_config:
+  metric_aggregation_enabled: true
+  enable_multi_variant_queries: true
 
 schema_config:
   configs:
     - from: 2020-10-24
-      store: boltdb
+      store: tsdb
       object_store: filesystem
-      schema: v11
+      schema: v13
       index:
         prefix: index_
-        period: 168h
+        period: 24h
 
-storage_config:
-  boltdb:
-    directory: /loki/index
-  filesystem:
-    directory: /loki/chunks
+pattern_ingester:
+  enabled: true
+  metric_aggregation:
+    loki_address: localhost:3100
 
-limits_config:
-  enforce_metric_name: false
-  reject_old_samples: true
-  reject_old_samples_max_age: 168h
-  split_queries_by_interval: 15m
+ruler:
+  alertmanager_url: http://localhost:9093
 
-querier:
-  max_outstanding_per_tenant: 4096
-
-chunk_store_config:
-  max_look_back_period: 0s
-
-table_manager:
-  retention_deletes_enabled: true
-  retention_period: 168h
+frontend:
+  encoding: protobuf

config/monitoring/promtail-config.yaml

@@ -1,48 +0,0 @@
-server:
-  http_listen_port: 9080
-  grpc_listen_port: 0
-
-positions:
-  filename: /tmp/positions.yaml
-
-clients:
-  - url: http://loki:3100/loki/api/v1/push
-
-scrape_configs:
-  - job_name: varlogs
-    static_configs:
-      - targets: [localhost]
-        labels:
-          job: varlogs
-          host: cyberdeck
-          __path__: /var/log/**/*.log
-
-  - job_name: docker
-    static_configs:
-      - targets: [localhost]
-        labels:
-          job: docker
-          host: cyberdeck
-          __path__: /var/lib/docker/containers/*/*-json.log
-    pipeline_stages:
-      - docker: {}
-    relabel_configs:
-      - source_labels: [__path__]
-        regex: "/var/lib/docker/containers/([^/]+)/.*"
-        target_label: container
-        replacement: "$1"
-
-  - job_name: journald
-    journal:
-      path: /var/log/journal
-      max_age: 12h
-      labels:
-        job: journald
-        host: cyberdeck
-    relabel_configs:
-      - source_labels: [__journal__systemd_unit]
-        target_label: unit
-      - source_labels: [__journal__hostname]
-        target_label: host
-      - source_labels: [__journal__priority_keyword]
-        target_label: level