feat: migrate Loki to community Monolithic chart

argocd/apps/36-loki.yaml

@@ -7,21 +7,16 @@ metadata:
     argocd.argoproj.io/sync-wave: "36"
 spec:
   project: kernelcafe
-  source:
-    repoURL: https://grafana.github.io/helm-charts
-    chart: loki
-    targetRevision: 6.45.2
-    helm:
-      values: |
-        deploymentMode: SingleBinary
-        singleBinary:
-          replicas: 1
-        loki:
-          auth_enabled: false
-          commonConfig:
-            replication_factor: 1
-          storage:
-            type: filesystem
+  sources:
+    - repoURL: https://grafana-community.github.io/helm-charts
+      chart: loki
+      targetRevision: 18.13.1
+      helm:
+        valueFiles:
+          - $values/infrastructure/loki/values.yaml
+    - repoURL: https://github.com/systemdbrew/kernelcafe.git
+      targetRevision: main
+      ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: loki

argocd/kernelcafe-project.yaml

@@ -14,6 +14,7 @@ spec:
     - https://traefik.github.io/charts
     - https://prometheus-community.github.io/helm-charts
     - https://grafana.github.io/helm-charts
+    - https://grafana-community.github.io/helm-charts
     - quay.io/jetstack/charts
   destinations:
     - namespace: '*'

docs/dependency-audit.md

@@ -2,23 +2,27 @@
 
 This public repository intentionally pins infrastructure dependencies rather than tracking floating tags. Pins are reviewed against upstream release channels before being changed.
 
-Audit date: 2026-09-14
+Audit date: 2026-09-15
 
 | Component | Public pin | Audit result |
 | --- | --- | --- |
 | Longhorn | 1.12.1 | Keep. Matches the KernelCafe production baseline and current v1.12 maintenance line. |
 | Vault Helm | 0.34.1 | Keep. Official chart currently pairs this with Vault 2.0.4. |
 | External Secrets Operator | 2.10.0 | Keep. Current upstream release. |
-| MetalLB | 0.16.1 | Updated from 0.15.3 to the current stable chart. |
+| MetalLB | 0.16.1 | Updated from 0.15.3 to the reviewed stable chart. |
 | cert-manager | v1.21.2 | Keep. Current documented upstream chart. |
 | Traefik | 41.5.0 | Updated from 40.2.0. Chart values were migrated from `logs.general` to the v41 `log` syntax. Review CRD upgrade notes before applying over an existing installation. |
 | kube-prometheus-stack | 90.1.1 | Keep. Current KernelCafe/public pin; upstream releases rapidly, so newer patch releases should be reviewed rather than blindly chased. |
 | Alloy | 1.11.0 | Updated from 1.2.1. This chart carries Alloy 1.18.0. |
-| Loki | 6.45.2 | Migration required; do not blindly bump. The OSS Loki chart moved from Grafana's original chart repository to `grafana-community/helm-charts` in March 2026 and the community chart has since introduced breaking deployment-mode changes. |
+| Loki | 18.13.1 | Migrated to the Grafana Community chart using Monolithic mode, TSDB v13, filesystem storage and explicit persistent-volume retention. |
 
-## Loki migration gate
+## Loki migration
 
-The existing Loki manifest is intentionally left unchanged in this audit PR. It uses the old Grafana repository and `deploymentMode: SingleBinary`. The current community chart renamed SingleBinary to Monolithic as of chart 12.0.0. A safe migration therefore needs a dedicated PR that renders the new chart, translates values, verifies persistent-storage behavior, and confirms Alloy's gateway endpoint before changing the public example.
+The public Loki reference now uses the community-maintained chart repository and `deploymentMode: Monolithic`, replacing the legacy `SingleBinary` naming from the 6.x chart line. The example deliberately runs one replica with `commonConfig.replication_factor: 1` and TSDB v13.
+
+Filesystem storage is intentional for this small, single-replica homelab/reference deployment. It keeps the example self-contained and durable through a Longhorn PVC, but it is not an HA storage design. Larger or highly available Loki installations should use a supported external object store and an appropriate deployment topology.
+
+The StatefulSet PVC policy is explicitly retained on deletion and scale-down. This avoids relying on chart defaults for log-data retention. Alloy continues to write through the chart-provided `loki-gateway` service.
 
 ## Multus and Whereabouts
 

infrastructure/loki/values.yaml

@@ -0,0 +1,59 @@
+deploymentMode: Monolithic
+
+loki:
+  auth_enabled: false
+  commonConfig:
+    replication_factor: 1
+  schemaConfig:
+    configs:
+      - from: "2024-04-01"
+        store: tsdb
+        object_store: filesystem
+        schema: v13
+        index:
+          prefix: loki_index_
+          period: 24h
+  storage:
+    type: filesystem
+
+singleBinary:
+  replicas: 1
+  persistence:
+    enabled: true
+    storageClass: longhorn-standard
+    accessModes:
+      - ReadWriteOnce
+    size: 20Gi
+    enableStatefulSetAutoDeletePVC: false
+    whenDeleted: Retain
+    whenScaled: Retain
+
+# Keep all non-monolithic Loki targets disabled. These components are used by
+# the scalable/distributed deployment modes and are intentionally omitted from
+# this small-cluster reference design.
+backend:
+  replicas: 0
+read:
+  replicas: 0
+write:
+  replicas: 0
+ingester:
+  replicas: 0
+querier:
+  replicas: 0
+queryFrontend:
+  replicas: 0
+queryScheduler:
+  replicas: 0
+distributor:
+  replicas: 0
+compactor:
+  replicas: 0
+indexGateway:
+  replicas: 0
+bloomPlanner:
+  replicas: 0
+bloomBuilder:
+  replicas: 0
+bloomGateway:
+  replicas: 0