peter/borgmatic
1
0
Fork 0
mirror of https://github.com/borgmatic-collective/borgmatic.git synced 2026-08-01 14:13:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add Loki mTLS to NEWS and remove unnecesary log (#1289).

Browse Source
This commit is contained in:
Dan Helfman
2026-04-13 09:16:15 -07:00
parent 71e2762aa7
commit 462e1392da
3 changed files with 15 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
NEWS
+1
View File
@@ -1,4 +1,5 @@
2.1.5.dev0
* #1289: Add mutual TLS support for the Loki monitoring hook.
* #1292: Fix a "source directories do not exist" regression when configuration paths are relative
symlinks and the bootstrap data source hook is enabled.
* #1294: Fix a regression in which SSH warnings from remote repositories broke the "spot" check.
borgmatic/hooks/monitoring/loki.py
-3
View File
@@ -152,9 +152,6 @@ def initialize_monitor(hook_config, config, config_filename, monitoring_log_leve
tls = hook_config.get('tls', {})
if bool(tls.get('cert_path')) != bool(tls.get('key_path')):
logger.critical(
'Invalid Loki TLS configuration: cert_path and key_path must both be set or both be unset'
)
raise ValueError(
'Invalid Loki TLS configuration: cert_path and key_path must both be set or both be unset'
)
docs/reference/configuration/monitoring/loki.md
+14 -7
View File
@@ -93,11 +93,16 @@ defaults for these flags in your borgmatic configuration via the
### Mutual TLS authentication
<span class="minilink minilink-addedin">New in version **TBD**</span> Since
Loki does not come with a built-in authentication layer [(doc)](https://grafana.com/docs/loki/latest/operations/authentication/), this feature is typically used
alongside a reverse proxy (such as [nginx](https://docs.nginx.com/waf/configure/secure-mtls/) or
[Traefik](https://doc.traefik.io/traefik/reference/routing-configuration/http/tls/tls-options/#client-authentication-mtls)) that handles mTLS termination.
If your setup is configured for mTLS authentication, you can provide a client certificate and private key:
<span class="minilink minilink-addedin">New in version 2.1.5</span> Since Loki
does not come with a built-in authentication layer
[(doc)](https://grafana.com/docs/loki/latest/operations/authentication/), this
feature is typically used alongside a reverse proxy (such as
[nginx](https://docs.nginx.com/waf/configure/secure-mtls/) or
[Traefik](https://doc.traefik.io/traefik/reference/routing-configuration/http/tls/tls-options/#client-authentication-mtls))
that handles mTLS termination.
If your setup is configured for mTLS authentication, you can provide a client
certificate and private key:
```yaml
loki:
@@ -111,5 +116,7 @@ loki:
key_path: /etc/borgmatic/loki-client.key
```
Both `cert_path` and `key_path` must be [PEM-encoded](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail). They are passed directly
to the underlying HTTP client, so the standard mutual TLS handshake is performed for every request borgmatic sends to Loki.
Both `cert_path` and `key_path` must be
[PEM-encoded](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail). They are
passed directly to the underlying HTTP client, so the standard mutual TLS
handshake is performed for every request borgmatic sends to Loki.