From a382a3b883d9ee53f0d82a75f50889431ec4a865 Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Sun, 30 Aug 2026 23:26:16 -0700
Subject: [PATCH] caddy: put loki.franksdank.cloud behind the Anubis+Authentik
 guard chain
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Loki's public vhost had zero auth — any host that can resolve DNS could
query all logs via LogQL. The vhost now terminates at anubis:8923 and
authenticated traffic returns at the internal :8017 listener, where a new
@loki host handler routes to loki:3100. The outpost proxy provider
'loki-proxy' (external_host https://loki.franksdank.cloud/, internal_host
http://caddy:8017) was created before this deploy — provider-first
ordering so authenticated traffic never hits the outpost error page.
Ingestion is unaffected: Alloy pushes to loki:3100 on the compose network.
---
 dankclaw/Caddyfile | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index be5e2a3..6445ee9 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -147,9 +147,11 @@ prometheus.franksdank.cloud {
 	}
 }
 
-# --- Loki ---
+# --- Loki (guarded: Anubis → Authentik; loki-proxy provider, internal_host caddy:8017) ---
 loki.franksdank.cloud {
-	reverse_proxy loki:3100
+	reverse_proxy anubis:8923 {
+		header_up X-Real-Ip {remote_host}
+	}
 }
 
 # --- Pi-hole (quadlet on slirp4netns; published 8083) ---
@@ -295,6 +297,11 @@ http://:8017 {
 		reverse_proxy comfyui:8188
 	}
 
+	@loki host loki.franksdank.cloud
+	handle @loki {
+		reverse_proxy loki:3100
+	}
+
 	@prometheus host prometheus.franksdank.cloud
 	handle @prometheus {
 		reverse_proxy prometheus:9090