infrastructure/roles/loki/templates/nginx.d.conf.j2

# We don't want to log (/loki/api/v1/push) request from yourself as it would cause a infinite loop
map $remote_addr $loggable {
    {{ wireguard_address }} 0;
    default 1;
}

server {
    listen       {{ wireguard_address }}:80;

    access_log   /var/log/nginx/loki/access.log main;
    access_log   /var/log/nginx/loki/access.log.json json_main if=$loggable;
    error_log    /var/log/nginx/loki/error.log;

    location = /loki/api/v1/push {
        if ($http_authorization != "Bearer {{ vault_loki_token }}") {
            return 403;
        }

        proxy_pass http://127.0.0.1:3100$request_uri;
    }

    # We return a 200 so the monitoring is happy!
    location = / {
        default_type text/plain;
        return 200 'Nothing to see here..\n';
    }

    location / {
        return 404;
    }
}