[CodexManvik]

Every service's logs, the Prometheus metrics and the Postgres audit trail are now viewable at their own URL.

Deploy	URL
docker-compose	http://localhost:3000
Helm on kind	http://localhost:30300 (or kubectl port-forward svc/grafana 3000:3000)

Grafana opens on a provisioned IntelliOps — Logs, metrics and audit dashboard, and viewing it needs no login:

• Service logs from every container, newest first, with a service filter and a regex search box. The Explore view accepts raw LogQL, e.g. {service="action"} |= "remediation".
• Log volume and errors/warnings per minute, by service.
• Metrics: CPU, p99 latency, error rate and service_up from the existing Prometheus.
• Audit trail: the latest 500 audit_records rows from Postgres.

How it works

• Loki (single binary, 72h retention) stores the logs.
• Grafana Alloy ships them: through the Docker socket in compose, and through the Kubernetes API in the chart. The chart uses loki.source.kubernetes with a namespace-scoped read-only Role, so there's no hostPath and no DaemonSet. Alloy drops /health, /ready and /metrics access lines, which were most of the volume, and lifts level out of JSON lines into a label.
• One copy of the config, under deploy/k8s/platform/files/observability/. Compose bind-mounts it and Helm reads it with .Files.Get. The dashboard is generated by scripts/make-grafana-dashboard.py.
• Chart settings: observability.enabled (on by default) turns the stack on or off. When it's on, the services switch to JSON logs, so levels are searchable. kind-config-full.yaml maps NodePort 30300; an existing cluster has to be recreated to pick that up.
• Pinned images: grafana/grafana:11.3.0, grafana/loki:3.2.1, grafana/alloy:v1.4.3 (tags verified on Docker Hub).
• Access: anonymous visitors are read-only Viewers. That's switchable off with GRAFANA_ANONYMOUS=false or observability.grafana.anonymous=false. The admin password is admin unless overridden.

Verification

Ran locally against the real compose stack:

• Loki and Grafana healthy, and all three datasources (Prometheus, Loki, Postgres) report OK.
• All 18 compose services appear in Loki, and JSON lines carry a level label.
• The probe-noise filter works: zero /health, /ready and /metrics lines ingested after it was enabled, while other lines keep flowing.
• In the browser, the log-volume chart, the log stream, the CPU panel (5 services) and the audit-trail table (878 rows) all render.
• The Kubernetes Alloy config was checked with the real v1.4.3 binary. It parses and evaluates, including the drop stage and sys.env; the only errors were the expected "no in-cluster config".
• helm lint passes, and helm template renders all resources. The embedded ConfigMap files parse as JSON/YAML, and --set observability.enabled=false renders none of them.
• tests/test_observability_config.py checks the dashboard only references provisioned datasource UIDs, and that every file the chart reads exists.
• The CI compose smoke now also checks Loki and Grafana readiness, datasource health, and that service logs actually reach Loki.
• Not run: a live kind install.

Independent of #74; the two branches merge cleanly (checked with git merge-tree).

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: b945461f-899f-4073-b8c2-7d08077e0beb

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.