Frank
a382a3b883
Loki's public vhost had zero auth — any host that can resolve DNS could query all logs via LogQL. The vhost now terminates at anubis:8923 and authenticated traffic returns at the internal :8017 listener, where a new @loki host handler routes to loki:3100. The outpost proxy provider 'loki-proxy' (external_host https://loki.franksdank.cloud/, internal_host http://caddy:8017) was created before this deploy — provider-first ordering so authenticated traffic never hits the outpost error page. Ingestion is unaffected: Alloy pushes to loki:3100 on the compose network.