---
# Vector VM-INGEST tier — the VM front door. Thin: accepts NDJSON over HTTPS
# (behind the logs-ingest Gateway) from puppet-managed VMs, attaches only a
# routing token, and publishes into JetStream (subject logs.vm.<host>). No
# parsing here — shaping happens in the transform tier after JetStream, so VM
# logs get the same durability/replay/fan-out as k8s logs.
data_dir: /vector-data-dir

api:
  enabled: true
  address: 0.0.0.0:8686

sources:
  vm_http:
    type: http_server
    address: 0.0.0.0:8080
    path: /
    method: POST
    decoding:
      codec: json
    framing:
      method: newline_delimited

transforms:
  # Routing metadata only: derive a NATS-subject-safe host token.
  tag:
    type: remap
    inputs:
      - vm_http
    source: |
      host = to_string(.host || .hostname || "unknown") ?? "unknown"
      .host_token = replace(host, r'[^a-zA-Z0-9_-]', "_")

sinks:
  to_jetstream:
    type: nats
    inputs:
      - tag
    url: nats://nats.logging.svc.cluster.local:4222
    connection_name: vector-vm-ingest
    subject: "logs.vm.{{ host_token }}"
    jetstream:
      enabled: true
    auth:
      strategy: user_password
      user_password:
        user: log-producer
        password: ${NATS_PRODUCER_PASSWORD}
    encoding:
      codec: json