- Migrate all 127 non-reserved docs to OKF v0.1 frontmatter (type/description/tags/timestamp); fix 13 YAML issues, 2 duplicate-FM blocks, strip reserved-page FM - Restructure log.md to OKF (## YYYY-MM-DD, newest-first) - Fact-check against scripts/AGENTS.md ground truth: fix 6 false 'Active' banners on retired runbooks, 96->114 GiB GTT, deployment.md vs deploy-plan.py/deploy-remote.sh, Deployment Flow frank-medium=Quadlet, Calibre 9.9.0->9.15.0 + CVE-2025-7404 conflation, Copyparty v1.20.24, RomM 5.3.0 breaking change - Move *arr docs to new FrankBook-Pro/ section (git mv, link-safe) - Write active runbook bodies from ground truth (frank-large, frank-small) - Add 3 research briefs + HTML report: Local TTS and Voice Cloning, AI Job Search and Resume Tools, Most Popular Self-Hosted AI Apps (Jun-Sep 2026) - Add upstream-version rows to ComfyUI/OpenWebUI/Hermes app docs - All 336 tests pass; 136 pages, 0 unresolved wikilinks
2.7 KiB
type, description, tags, timestamp
| type | description | tags | timestamp | ||
|---|---|---|---|---|---|
| reference | Loki is the log aggregation backend of the observability stack. |
|
2026-09-11 |
Loki
Loki is the log aggregation backend of the observability stack. It stores and queries container and system logs. It replaces the need for a full ELK stack.
Host: Dankclaw — Port: 3100 (loopback) — Docs: https://grafana.com/docs/loki/latest
Facts
| Item | Value |
|---|---|
| Image | franksdank/loki:latest (local build: upstream + a static busybox for the healthcheck) |
| Published | 127.0.0.1:3100 → 3100, loopback only |
| Unit | dankclaw/observability/quadlet/loki.container → loki.service |
| Mode | single-binary (all components in one process) |
| Storage | filesystem, /opt/loki/data |
| Auth | auth_enabled: false (single-tenant homelab) |
| Schema | v13 / TSDB |
| Retention | 30 days, enforced by the compactor |
Configuration
shared/loki/loki-config.yaml is the source of truth, installed to /opt/loki/config/loki-config.yaml on every deploy. Key settings:
schema_configv13 withstore: tsdband a filesystem object store.compactorwithretention_enabled: trueso logs do not grow without bound.replication_factor: 1for a single instance.
Volumes
| Container path | Host path |
|---|---|
/loki |
/opt/loki/data |
/etc/loki |
/opt/loki/config |
Healthcheck
Loki responds on /ready with 200. The health command is not in the unit: a unit HealthCmd reaches podman as CMD-SHELL, i.e. /bin/sh -c, and this image is distroless with no shell at all. It ships in dankclaw/loki/Containerfile as an exec-form HEALTHCHECK instead (which is why the image carries busybox, and why the build must pass --format docker — the OCI image format has no HEALTHCHECK field and silently drops it).
Log Shipping
The Alloy agent on Dankclaw ships container and journal logs to http://loki:3100/loki/api/v1/push — by container name on the dankclaw_default network, never through the vhost (a non-browser client cannot solve the Anubis challenge).
Gotchas
- Filesystem storage grows; keep compactor retention on.
- Loki and Alloy must agree on the push URL:
http://loki:3100/loki/api/v1/push. - The listener is loopback-only now. Shipping logs from a second host would need the unit's publish changed (or a shared network), not just an Alloy install — Loki has no authentication of its own, so that decision is a security one, not a config one.
- Nothing queries Loki yet: Grafana has no datasource configured. See the state note in Observability.
See Also
- Alloy — the log shipper
- Grafana — the query frontend
- Observability — the whole stack