Adding AI-generated compose/config files for alloy/loki/grafana stack

loki/config/alloy.alloy

@@ -0,0 +1,98 @@
+// Alloy configuration
+// Collects: (1) Docker container logs, (2) Syslog from network devices (MikroTik etc.)
+// Pushes everything to local Loki instance.
+
+// ── Loki destination ──────────────────────────────────────────────────────────
+loki.write "local_loki" {
+  endpoint {
+    url = "http://loki:3100/loki/api/v1/push"
+  }
+}
+
+// ── Docker container log collection ──────────────────────────────────────────
+// Discovers all running containers and tails their logs automatically.
+// New containers are picked up without restarting Alloy.
+
+discovery.docker "containers" {
+  host = "unix:///var/run/docker.sock"
+}
+
+discovery.relabel "docker_labels" {
+  targets = discovery.docker.containers.targets
+
+  // Use container name as the job label (strips the leading slash Docker adds)
+  rule {
+    source_labels = ["__meta_docker_container_name"]
+    regex         = "/(.*)"
+    target_label  = "container"
+  }
+
+  // Carry through the Docker Compose service name if present
+  rule {
+    source_labels = ["__meta_docker_container_label_com_docker_compose_service"]
+    target_label  = "service"
+  }
+
+  // Carry through the Docker Compose project name if present
+  rule {
+    source_labels = ["__meta_docker_container_label_com_docker_compose_project"]
+    target_label  = "compose_project"
+  }
+
+  rule {
+    target_label = "source"
+    replacement  = "docker"
+  }
+}
+
+loki.source.docker "docker_logs" {
+  host          = "unix:///var/run/docker.sock"
+  targets       = discovery.relabel.docker_labels.output
+  forward_to    = [loki.write.local_loki.receiver]
+  relabeling {
+    source_labels = ["__meta_docker_container_name"]
+    regex         = "/(.*)"
+    target_label  = "container"
+  }
+}
+
+// ── Syslog receiver (MikroTik RB5009 and other network devices) ──────────────
+// Listens on UDP 514 and TCP 514.
+// On your RB5009, set the remote logging action to point at this host's IP.
+
+loki.source.syslog "network_syslog" {
+  listener {
+    address  = "0.0.0.0:514"
+    protocol = "udp"
+    labels = {
+      source = "syslog",
+      job    = "network_devices",
+    }
+  }
+  listener {
+    address  = "0.0.0.0:514"
+    protocol = "tcp"
+    labels = {
+      source = "syslog",
+      job    = "network_devices",
+    }
+  }
+
+  forward_to = [loki.process.syslog_relabel.receiver]
+}
+
+// Enrich syslog entries with a hostname label extracted from the syslog message
+loki.process "syslog_relabel" {
+  forward_to = [loki.write.local_loki.receiver]
+
+  stage.syslog {}   // Parses RFC3164/RFC5424 syslog and extracts hostname, app, facility, severity
+
+  stage.labels {
+    values = {
+      hostname = "hostname",   // Extracted by stage.syslog
+      app      = "app_name",   // e.g. "dhcp", "firewall", "interface" on RouterOS
+      severity = "severity",
+      facility = "facility",
+    }
+  }
+}

loki/config/grafana-datasources.yml

@@ -0,0 +1,16 @@
+# Grafana datasource provisioning
+# Automatically configures Loki as a datasource on first startup.
+# No manual setup needed in the Grafana UI.
+
+apiVersion: 1
+
+datasources:
+  - name: Loki
+    type: loki
+    access: proxy
+    url: http://loki:3100
+    isDefault: true
+    editable: false
+    jsonData:
+      maxLines: 5000
+      timeout: 60

loki/config/loki.yml

@@ -0,0 +1,56 @@
+# Loki configuration - single binary mode, suitable for homelab scale
+# Docs: https://grafana.com/docs/loki/latest/configuration/
+
+auth_enabled: false
+
+server:
+  http_listen_port: 3100
+  grpc_listen_port: 9096
+  log_level: warn
+
+common:
+  instance_addr: 127.0.0.1
+  path_prefix: /loki
+  storage:
+    filesystem:
+      chunks_directory: /loki/chunks
+      rules_directory: /loki/rules
+  replication_factor: 1
+  ring:
+    kvstore:
+      store: inmemory
+
+schema_config:
+  configs:
+    - from: 2024-01-01
+      store: tsdb
+      object_store: filesystem
+      schema: v13
+      index:
+        prefix: index_
+        period: 24h
+
+# ── Retention ─────────────────────────────────────────────────────────────────
+# Adjust these to suit your disk space. 90 days is a good starting point for
+# homelab troubleshooting — long enough to catch recurring issues.
+limits_config:
+  retention_period: 90d
+  ingestion_rate_mb: 4
+  ingestion_burst_size_mb: 8
+
+compactor:
+  working_directory: /loki/compactor
+  retention_enabled: true
+  retention_delete_delay: 2h
+  delete_request_store: filesystem
+
+# ── Query performance ─────────────────────────────────────────────────────────
+query_range:
+  results_cache:
+    cache:
+      embedded_cache:
+        enabled: true
+        max_size_mb: 100
+
+ruler:
+  alertmanager_url: http://localhost:9093