added loki to our monitoring stack and updated the docs

README.md

@@ -8,6 +8,7 @@ A self-hosted homelab running on Docker Compose, built and maintained on an Ubun
 ![Ansible](https://img.shields.io/badge/Ansible-EE0000?style=flat&logo=ansible&logoColor=white)
 ![Prometheus](https://img.shields.io/badge/Prometheus-E6522C?style=flat&logo=prometheus&logoColor=white)
 ![Grafana](https://img.shields.io/badge/Grafana-F46800?style=flat&logo=grafana&logoColor=white)
+![Loki](https://img.shields.io/badge/Loki-F5A623?style=flat&logo=grafana&logoColor=white)
 
 ## Overview
 
@@ -17,7 +18,7 @@ This is a real, running homelab — not a demo. It's deployed on a home Ubuntu s
 
 | Service | Folder | Purpose |
 |---|---|---|
-| **Monitoring stack** | `docker-compose/monitoring-grafana-promethues-cadvisor-node-exporter/` | Prometheus for metrics collection, Grafana for dashboards, cAdvisor for per-container resource stats, node-exporter for host-level metrics |
+| **Monitoring stack** | `docker-compose/monitoring-grafana-promethues-cadvisor-node-exporter/` | Prometheus for metrics, Grafana for dashboards, cAdvisor for per-container resource stats, node-exporter for host-level metrics, plus Loki + Grafana Alloy for centralized container log aggregation — see [Monitoring Stack](docs/Monitoring-Stack.md) |
 | **Pi-hole** | `docker-compose/pihole/` | Network-wide DNS-level ad and tracker blocking |
 | **Portainer** | `docker-compose/portainer/` | Web UI for managing and monitoring all Docker containers on the host |
 | **DockScope** | `docker-compose/dockscope/` | 3D visual dashboard mapping containers, networks, and dependencies, with anomaly detection and crash diagnostics — see [DockScope](docs/DockScope.md) |
@@ -39,7 +40,7 @@ Not everything in this repo runs permanently. Some folders are kept purely as re
 
 | Lab | Folder | Purpose |
 |---|---|---|
-| **Elastic Stack (ELK)** | `docker-compose/elk/` | Elasticsearch + Kibana, security-enabled, sized for this hardware — a modern-workflow (Elastic Agent/Fleet) alternative to an older Filebeat/Metricbeat-based course reference. Not run continuously since Prometheus/Grafana already cover monitoring here — see [Elastic Stack (ELK)](docs/ElasticStack.md) |
+| **Elastic Stack (ELK)** | `docker-compose/elk/` | Elasticsearch + Kibana, security-enabled, sized for this hardware — a modern-workflow (Elastic Agent/Fleet) alternative to an older Filebeat/Metricbeat-based course reference. Not run continuously since Loki now covers centralized logging here — see [Elastic Stack (ELK)](docs/ElasticStack.md) |
 
 ## Repository structure
 
@@ -47,7 +48,15 @@ Not everything in this repo runs permanently. Some folders are kept purely as re
 homelab/
 ├── docker-compose/
 │   ├── monitoring-grafana-promethues-cadvisor-node-exporter/
-│   │   └── docker-compose.yml
+│   │   ├── docker-compose.yml
+│   │   ├── alloy/
+│   │   │   └── config.alloy
+│   │   ├── grafana/
+│   │   │   └── provisioning/
+│   │   │       └── datasources/
+│   │   │           └── loki.yml
+│   │   └── prometheus/
+│   │       └── prometheus.yml
 │   ├── pihole/
 │   │   ├── docker-compose.yml
 │   │   └── .env.example
@@ -146,6 +155,7 @@ Rather than pulling and recreating manually, every always-on stack has a matchin
 - Passwords referenced in compose files are injected via environment variables, never hardcoded.
 - The AI coding agent (`docker-compose/openhands/`) currently uses a third-party API aggregator as its LLM backend — see [AI Coding Agent](docs/AI-Agent.md) for details and caveats. It has no access to the Docker socket or other containers on the host.
 - **DockScope** (`docker-compose/dockscope/`) mounts `/var/run/docker.sock`, the same as Portainer — this grants it effectively root-equivalent access to the Docker host, and it currently has no built-in authentication on its web UI, so it's kept LAN-only and not exposed through the reverse proxy. See [DockScope](docs/DockScope.md).
+- **Grafana Alloy** (part of the monitoring stack) also mounts `/var/run/docker.sock` read-only, needed to discover containers and tail their logs.
 
 ## Lessons learned
 
@@ -156,6 +166,9 @@ Rather than pulling and recreating manually, every always-on stack has a matchin
 - Wildcard TLS certs (`*.home`) are rejected by browsers on single-label local domains — certificates for local reverse proxies need explicit hostnames listed instead. See [Reverse Proxy](docs/Reverse-Proxy.md).
 - Grouping all Compose stacks under one `docker-compose/` folder (rather than flat at repo root) kept the structure readable once Ansible playbooks were added as a sibling — a flat repo mixing deployment configs and automation code got confusing fast.
 - Newer Docker images can silently raise the minimum CPU generation required (base-OS changes, not anything in the compose file itself) — hit this running Elasticsearch 9.x on older hardware. See [Elastic Stack (ELK)](docs/ElasticStack.md).
+- **Promtail is end-of-life as of March 2026** and removed outright as of Loki 3.7.3 — any current Loki setup should use Grafana Alloy for log shipping instead. Worth checking a project's actual current-recommended tooling before following an older tutorial, since agent names and workflows in this space have moved fast.
+- Bind-mounted container data directories can end up owned by the wrong UID after mixing `sudo` and non-`sudo` commands on the same folder — this silently broke Loki's ability to write its own working directory, surfacing only as a `permission denied` deep in its startup logs.
+- Community Grafana dashboards built for older Loki/Promtail label conventions (e.g. `container_name`) don't automatically work against a fresh Alloy-based label schema (`container`, `service_name`) — worth checking a dashboard's expected labels against your actual pipeline's labels before assuming an import error means something's broken on your end.
 
 ## Roadmap