Expose VictoriaLogs UI at vlogs.unkin.net behind oauth2-proxy (#498)

The vlselect query UI is only reachable in-cluster, so every log search needs a port-forward. Publish it at vlogs.unkin.net behind oauth2-proxy on the external (DMZ) Traefik.

- Add `apps/base/logging/vlogs`: external Gateway, http->https redirect and main HTTPRoute
- Terminate TLS with the reflected Let's Encrypt `*.unkin.net` wildcard; reflect it into `logging`
- Publish the `vlogs` A record at the DMZ gateway VIP from the bind-operator `unkin.net` zone
- Route all traffic through the `vlogs-oauth2` Service, upstreaming to `vlselect-logs:9471`
- Gate on the Authentik `vlogs` application, group `akP-vlogs-admin`
- Read OIDC credentials from `kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials`

Depends on unkin/terraform-authentik#40.

Reviewed-on: #498
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

This commit was merged in pull request #498.

This commit is contained in:

Unkin Agent

2026-09-27 17:21:40 +10:00

committed by

BenVincent

parent 90d512fadf

commit 6515e7f637

10 changed files with 312 additions and 2 deletions

									
										apps/base/logging/kustomization.yaml
									
		+1
		
												View File
												
				@@ -17,6 +17,7 @@ resources:

				  - configmap_logarchiver.yaml

				  - deployment_logarchiver.yaml

				  - logviewer

				  - vlogs

				# Vector pipelines are the single source of truth (also validated by

				# `vector test` in CI). Mounted into each tier via `existingConfigMaps`.