From 462e1392da8871a452d0126e1c56eeaddb3c8c4d Mon Sep 17 00:00:00 2001 From: Dan Helfman Date: Mon, 13 Apr 2026 09:16:15 -0700 Subject: [PATCH] Add Loki mTLS to NEWS and remove unnecesary log (#1289). --- NEWS | 1 + borgmatic/hooks/monitoring/loki.py | 3 --- .../configuration/monitoring/loki.md | 21 ++++++++++++------- 3 files changed, 15 insertions(+), 10 deletions(-) diff --git a/NEWS b/NEWS index 3f5de9b9..dba32ba9 100644 --- a/NEWS +++ b/NEWS @@ -1,4 +1,5 @@ 2.1.5.dev0 + * #1289: Add mutual TLS support for the Loki monitoring hook. * #1292: Fix a "source directories do not exist" regression when configuration paths are relative symlinks and the bootstrap data source hook is enabled. * #1294: Fix a regression in which SSH warnings from remote repositories broke the "spot" check. diff --git a/borgmatic/hooks/monitoring/loki.py b/borgmatic/hooks/monitoring/loki.py index 0bde9915..23a62a2b 100644 --- a/borgmatic/hooks/monitoring/loki.py +++ b/borgmatic/hooks/monitoring/loki.py @@ -152,9 +152,6 @@ def initialize_monitor(hook_config, config, config_filename, monitoring_log_leve tls = hook_config.get('tls', {}) if bool(tls.get('cert_path')) != bool(tls.get('key_path')): - logger.critical( - 'Invalid Loki TLS configuration: cert_path and key_path must both be set or both be unset' - ) raise ValueError( 'Invalid Loki TLS configuration: cert_path and key_path must both be set or both be unset' ) diff --git a/docs/reference/configuration/monitoring/loki.md b/docs/reference/configuration/monitoring/loki.md index 1ee54fd4..599a9ccd 100644 --- a/docs/reference/configuration/monitoring/loki.md +++ b/docs/reference/configuration/monitoring/loki.md @@ -93,11 +93,16 @@ defaults for these flags in your borgmatic configuration via the ### Mutual TLS authentication -New in version **TBD** Since -Loki does not come with a built-in authentication layer [(doc)](https://grafana.com/docs/loki/latest/operations/authentication/), this feature is typically used -alongside a reverse proxy (such as [nginx](https://docs.nginx.com/waf/configure/secure-mtls/) or -[Traefik](https://doc.traefik.io/traefik/reference/routing-configuration/http/tls/tls-options/#client-authentication-mtls)) that handles mTLS termination. -If your setup is configured for mTLS authentication, you can provide a client certificate and private key: +New in version 2.1.5 Since Loki +does not come with a built-in authentication layer +[(doc)](https://grafana.com/docs/loki/latest/operations/authentication/), this +feature is typically used alongside a reverse proxy (such as +[nginx](https://docs.nginx.com/waf/configure/secure-mtls/) or +[Traefik](https://doc.traefik.io/traefik/reference/routing-configuration/http/tls/tls-options/#client-authentication-mtls)) +that handles mTLS termination. + +If your setup is configured for mTLS authentication, you can provide a client +certificate and private key: ```yaml loki: @@ -111,5 +116,7 @@ loki: key_path: /etc/borgmatic/loki-client.key ``` -Both `cert_path` and `key_path` must be [PEM-encoded](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail). They are passed directly -to the underlying HTTP client, so the standard mutual TLS handshake is performed for every request borgmatic sends to Loki. +Both `cert_path` and `key_path` must be +[PEM-encoded](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail). They are +passed directly to the underlying HTTP client, so the standard mutual TLS +handshake is performed for every request borgmatic sends to Loki.