// Log pipeline: files, Docker, journald → Loki (replaces Promtail).
// See: https://grafana.com/docs/alloy/latest/set-up/migrate/from-promtail/

loki.write "default" {
  endpoint {
    url = "http://loki:3100/loki/api/v1/push"
  }
}

// varlogs: /var/log/**/*.log
loki.source.file "varlogs" {
  targets = [
    { __path__ = "/var/log/**/*.log", job = "varlogs", host = "cyberdeck" },
  ]
  forward_to = [loki.write.default.receiver]
  file_match {
    enabled   = true
    sync_period = "10s"
  }
}

// docker: container logs with docker parsing and container label from path
loki.source.file "docker" {
  targets = [
    { __path__ = "/var/lib/docker/containers/*/*-json.log", job = "docker", host = "cyberdeck" },
  ]
  forward_to = [loki.process.docker.receiver]
  file_match {
    enabled   = true
    sync_period = "10s"
  }
}

loki.process "docker" {
  forward_to = [loki.relabel.docker.receiver]
  stage.docker {}
}

loki.relabel "docker" {
  forward_to = [loki.write.default.receiver]
  rule {
    source_labels = ["filename"]
    regex         = "/var/lib/docker/containers/([^/]+)/.*"
    target_label  = "container"
    replacement   = "$1"
  }
}

// journald: systemd journal with unit, host, level labels
loki.relabel "journald" {
  forward_to = []
  rule {
    source_labels = ["__journal__systemd_unit"]
    target_label  = "unit"
  }
  rule {
    source_labels = ["__journal__hostname"]
    target_label  = "host"
  }
  rule {
    source_labels = ["__journal__priority_keyword"]
    target_label  = "level"
  }
}

loki.source.journal "journald" {
  forward_to    = [loki.write.default.receiver]
  relabel_rules = loki.relabel.journald.rules
  labels        = { job = "journald", host = "cyberdeck" }
  path          = "/var/log/journal"
  max_age       = "12h"
}