unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Expose VictoriaLogs UI at vlogs.unkin.net behind oauth2-proxy #498

Merged
benvin merged 2 commits from benvin/vlogs-external into main 2026-09-27 17:21:41 +10:00
Conversation 0 Commits 2 Files Changed 10
+312 -2
unkin-agent commented 2026-09-27 10:15:01 +10:00
Member
Copy Link
Copy Source

The vlselect query UI is only reachable in-cluster, so every log search needs a port-forward. Publish it at vlogs.unkin.net behind oauth2-proxy on the external (DMZ) Traefik.

  • Add apps/base/logging/vlogs: external Gateway, http->https redirect and main HTTPRoute
  • Terminate TLS with the reflected Let's Encrypt *.unkin.net wildcard; reflect it into logging
  • Publish the vlogs A record at the DMZ gateway VIP from the bind-operator unkin.net zone
  • Route all traffic through the vlogs-oauth2 Service, upstreaming to vlselect-logs:9471
  • Gate on the Authentik vlogs application, group akP-vlogs-admin
  • Read OIDC credentials from kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials

Depends on unkin/terraform-authentik#40.

The vlselect query UI is only reachable in-cluster, so every log search needs a port-forward. Publish it at vlogs.unkin.net behind oauth2-proxy on the external (DMZ) Traefik. - Add `apps/base/logging/vlogs`: external Gateway, http->https redirect and main HTTPRoute - Terminate TLS with the reflected Let's Encrypt `*.unkin.net` wildcard; reflect it into `logging` - Publish the `vlogs` A record at the DMZ gateway VIP from the bind-operator `unkin.net` zone - Route all traffic through the `vlogs-oauth2` Service, upstreaming to `vlselect-logs:9471` - Gate on the Authentik `vlogs` application, group `akP-vlogs-admin` - Read OIDC credentials from `kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials` Depends on unkin/terraform-authentik#40.
unkin-agent added 1 commit 2026-09-27 10:15:01 +10:00
Expose VictoriaLogs UI at vlogs.unkin.net behind oauth2-proxy
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
8c929e44ee 
The vlselect query UI is only reachable in-cluster, so log searches need a
port-forward. Front it with the same oauth2-proxy pattern logviewer uses.

- Add apps/base/logging/vlogs: vlogs Gateway (vault-issuer TLS, traefik-internal)
  plus http->https redirect and main HTTPRoute
- Route all traffic through the vlogs-oauth2 Service into oauth2-proxy, which
  upstreams to vlselect-logs:9471
- Gate access on the Authentik vlogs application, group akP-vlogs-admin
- Source OIDC credentials from kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials
unkin-agent added 1 commit 2026-09-27 11:25:02 +10:00
Serve vlogs.unkin.net on the external Traefik with the wildcard cert
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
cbdb4caabe 
Front the VictoriaLogs UI on the DMZ gateway VIP, terminate TLS with the
reflected Let's Encrypt *.unkin.net wildcard, and publish the apex A record
from the bind-operator unkin.net zone.
benvin merged commit 6515e7f637 into main 2026-09-27 17:21:41 +10:00
benvin deleted branch benvin/vlogs-external 2026-09-27 17:21:42 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#498
Delete Branch "benvin/vlogs-external"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?