24 lines
1.2 KiB
Terraform
24 lines
1.2 KiB
Terraform
|
# Loki write/push endpoint for EXTERNAL hosts (currently rpi-sofia's promtail).
|
||
|
|
#
|
||
|
|
# Loki runs SingleBinary with the gateway disabled and auth_enabled=false, so it
|
||
|
|
# is ClusterIP-only (svc "loki":3100) and unreachable from off-cluster. An
|
||
|
|
# external log shipper like the Sofia Raspberry Pi cannot POST to
|
||
|
|
# /loki/api/v1/push without this ingress.
|
||
|
|
#
|
||
|
|
# auth = "none": promtail ships logs programmatically (no browser, no Authentik
|
||
|
|
# SSO cookie dance). The allow_local_access_only middleware (192.168.0.0/16 +
|
||
|
|
# 10.0.0.0/8) gates the endpoint to LAN/VPN only — the correct model for a
|
||
|
|
# LAN-only Pi, mirroring the idrac-redfish-exporter ingress in this module.
|
||
|
|
module "loki-write-ingress" {
|
||
|
|
source = "../../../../modules/kubernetes/ingress_factory"
|
||
|
|
# auth = "none": rpi-sofia's promtail pushes logs programmatically (no browser, no Authentik SSO cookie); gated to LAN/VPN by allow_local_access_only below.
|
||
|
|
auth = "none"
|
||
|
|
namespace = kubernetes_namespace.monitoring.metadata[0].name
|
||
|
|
name = "loki"
|
||
|
|
root_domain = "viktorbarzin.lan"
|
||
|
|
tls_secret_name = var.tls_secret_name
|
||
|
|
allow_local_access_only = true
|
||
|
|
ssl_redirect = false
|
||
|
|
port = 3100
|
||
|
|
}
|