Frank
93d1181fee
- Migrate all 127 non-reserved docs to OKF v0.1 frontmatter (type/description/tags/timestamp); fix 13 YAML issues, 2 duplicate-FM blocks, strip reserved-page FM - Restructure log.md to OKF (## YYYY-MM-DD, newest-first) - Fact-check against scripts/AGENTS.md ground truth: fix 6 false 'Active' banners on retired runbooks, 96->114 GiB GTT, deployment.md vs deploy-plan.py/deploy-remote.sh, Deployment Flow frank-medium=Quadlet, Calibre 9.9.0->9.15.0 + CVE-2025-7404 conflation, Copyparty v1.20.24, RomM 5.3.0 breaking change - Move *arr docs to new FrankBook-Pro/ section (git mv, link-safe) - Write active runbook bodies from ground truth (frank-large, frank-small) - Add 3 research briefs + HTML report: Local TTS and Voice Cloning, AI Job Search and Resume Tools, Most Popular Self-Hosted AI Apps (Jun-Sep 2026) - Add upstream-version rows to ComfyUI/OpenWebUI/Hermes app docs - All 336 tests pass; 136 pages, 0 unresolved wikilinks
64 lines
2.7 KiB
Markdown
64 lines
2.7 KiB
Markdown
---
|
|
type: reference
|
|
description: "Loki is the log aggregation backend of the observability stack."
|
|
tags:
|
|
- infrastructure
|
|
- loki
|
|
timestamp: 2026-09-11
|
|
---
|
|
|
|
# Loki
|
|
|
|
Loki is the log aggregation backend of the observability stack. It stores and queries container and system logs. It replaces the need for a full ELK stack.
|
|
|
|
**Host:** Dankclaw — **Port:** 3100 (loopback) — **Docs:** https://grafana.com/docs/loki/latest
|
|
|
|
## Facts
|
|
|
|
| Item | Value |
|
|
|------|-------|
|
|
| Image | `franksdank/loki:latest` (local build: upstream + a static busybox for the healthcheck) |
|
|
| Published | `127.0.0.1:3100` → 3100, loopback only |
|
|
| Unit | `dankclaw/observability/quadlet/loki.container` → `loki.service` |
|
|
| Mode | single-binary (all components in one process) |
|
|
| Storage | filesystem, `/opt/loki/data` |
|
|
| Auth | `auth_enabled: false` (single-tenant homelab) |
|
|
| Schema | v13 / TSDB |
|
|
| Retention | 30 days, enforced by the compactor |
|
|
|
|
## Configuration
|
|
|
|
`shared/loki/loki-config.yaml` is the source of truth, installed to `/opt/loki/config/loki-config.yaml` on every deploy. Key settings:
|
|
|
|
- `schema_config` v13 with `store: tsdb` and a filesystem object store.
|
|
- `compactor` with `retention_enabled: true` so logs do not grow without bound.
|
|
- `replication_factor: 1` for a single instance.
|
|
|
|
## Volumes
|
|
|
|
| Container path | Host path |
|
|
|----------------|-----------|
|
|
| `/loki` | `/opt/loki/data` |
|
|
| `/etc/loki` | `/opt/loki/config` |
|
|
|
|
## Healthcheck
|
|
|
|
Loki responds on `/ready` with 200. The health command is **not** in the unit: a unit `HealthCmd` reaches podman as `CMD-SHELL`, i.e. `/bin/sh -c`, and this image is distroless with no shell at all. It ships in `dankclaw/loki/Containerfile` as an exec-form `HEALTHCHECK` instead (which is why the image carries busybox, and why the build must pass `--format docker` — the OCI image format has no `HEALTHCHECK` field and silently drops it).
|
|
|
|
## Log Shipping
|
|
|
|
The [[Alloy]] agent on Dankclaw ships container and journal logs to `http://loki:3100/loki/api/v1/push` — by container name on the `dankclaw_default` network, never through the vhost (a non-browser client cannot solve the Anubis challenge).
|
|
|
|
## Gotchas
|
|
|
|
- Filesystem storage grows; keep compactor retention on.
|
|
- Loki and Alloy must agree on the push URL: `http://loki:3100/loki/api/v1/push`.
|
|
- The listener is loopback-only now. Shipping logs from a second host would need the unit's publish changed (or a shared network), not just an Alloy install — Loki has no authentication of its own, so that decision is a security one, not a config one.
|
|
- Nothing queries Loki yet: Grafana has no datasource configured. See the state note in [[Observability]].
|
|
|
|
## See Also
|
|
|
|
- [[Alloy]] — the log shipper
|
|
- [[Grafana]] — the query frontend
|
|
- [[Observability]] — the whole stack
|