# Promtail — ships container logs (via the Docker socket, all containers on this host) and
# journald (systemd units: rootnode-platform.service, rootnode-lab-host.service, docker,
# sshd, fail2ban) to Loki. Deliberately does NOT centralize raw student terminal/command
# output — the Lab image's own stdout is Lab-lifecycle noise (k3s boot logs, entrypoint
# output), not the actual PTY session content, which never leaves the container's terminal
# WebSocket in the first place. See docs/OBSERVABILITY.md §"what's excluded and why."

server:
  http_listen_port: 9080

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:
  - job_name: docker
    docker_sd_configs:
      - host: unix:///var/run/docker.sock
        refresh_interval: 15s
    relabel_configs:
      - source_labels: [__meta_docker_container_name]
        target_label: container
      - source_labels: [__meta_docker_container_label_com_docker_compose_service]
        target_label: service
    pipeline_stages:
      # Never ship secrets — a defense-in-depth scrub in case a service ever accidentally logs
      # one (the app itself is expected to never log tokens/passwords per its own conventions,
      # e.g. docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md's "never log raw session tokens").
      - replace:
          expression: '(?i)(password|token|secret)=[^&\s]+'
          replace: '$1=***REDACTED***'

  - job_name: journal
    journal:
      max_age: 24h
      labels:
        job: systemd-journal
    relabel_configs:
      - source_labels: [__journal__systemd_unit]
        target_label: unit