From 06d5d26dde4ef010657da3472ed456a4c931b09d Mon Sep 17 00:00:00 2001
From: oddlama <oddlama@oddlama.org>
Date: Sun, 18 Jun 2023 16:03:41 +0200
Subject: [PATCH] fix: apparently ':' is not a great character for basic auth

---
 hosts/ward/microvms/grafana/default.nix       |   2 +-
 hosts/ward/microvms/loki/default.nix          |   3 +--
 .../loki/secrets/loki-basic-auth-hashes.age   | Bin 1130 -> 1049 bytes
 modules/promtail.nix                          |   2 +-
 4 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/hosts/ward/microvms/grafana/default.nix b/hosts/ward/microvms/grafana/default.nix
index 028f570..5124e9c 100644
--- a/hosts/ward/microvms/grafana/default.nix
+++ b/hosts/ward/microvms/grafana/default.nix
@@ -115,7 +115,7 @@ in {
           url = "https://${sentinelCfg.proxiedDomains.loki}";
           orgId = 1;
           basicAuth = true;
-          basicAuthUser = "${nodeName}:grafana-loki-basic-auth-password";
+          basicAuthUser = "${nodeName}+grafana-loki-basic-auth-password";
           secureJsonData.basicAuthPassword = "$__file{${config.age.secrets.grafana-loki-basic-auth-password.path}}";
         }
       ];
diff --git a/hosts/ward/microvms/loki/default.nix b/hosts/ward/microvms/loki/default.nix
index b5c5e08..21931dd 100644
--- a/hosts/ward/microvms/loki/default.nix
+++ b/hosts/ward/microvms/loki/default.nix
@@ -41,7 +41,7 @@ in {
             file,
           }: ''
             echo " -> Aggregating "${lib.escapeShellArg host}":"${lib.escapeShellArg name}"" >&2
-            echo -n ${lib.escapeShellArg host}":"${lib.escapeShellArg name}" "
+            echo -n ${lib.escapeShellArg host}"+"${lib.escapeShellArg name}" "
             ${decrypt} ${lib.escapeShellArg file} \
               | ${pkgs.caddy}/bin/caddy hash-password --algorithm bcrypt \
               || die "Failure while aggregating caddy basic auth hashes"
@@ -55,7 +55,6 @@ in {
       useACMEHost = sentinelCfg.lib.extra.matchingWildcardCert lokiDomain;
       extraConfig = ''
         import common
-        skip_log
         basicauth {
           import ${sentinelCfg.age.secrets.loki-basic-auth-hashes.path}
         }
diff --git a/hosts/ward/microvms/loki/secrets/loki-basic-auth-hashes.age b/hosts/ward/microvms/loki/secrets/loki-basic-auth-hashes.age
index 63dcba521dd2cf703e7017211e7aa396f66c4ca9..122be11c716efbd4902d6ff853ff6f14365fa643 100644
GIT binary patch
delta 1032
zcmV+j1o!*u2$=|wAb&+pT32^@G;&FKN<vj{P+50MHdJvpX?itOdRAgKK~OhJWmZ~p
zbw*WDa|&28dPPq|X*ow$Pd0E;Qc7BJQfFCkX=g)Yab!|eD>!mtIaEnkVPY|FRSGRW
zAaH4REpRe5HXwL$Q)M_&AVG3aYb$VBOEx)fNl;5RWl3#rQ-3jNPFiL{Y-2e@N>^tz
zGe>H2QFB*NPc;fTT5(cxc}-C>WJGpRGjA|APB%eWcxF&ZWO`?DH*$7#GFN0ZQ!!~W
zH**RtJ|HwqFGXBqQE)A1a%Ew2WgsvuUV1A=Rv=JWNi;uDLm*^g3P){IYgsrqaWha(
zR5o!?O-y2FaesJZVsC9%I7V(^IWTE=byZAvIc9icSw}Q8M0#;iV{=MIYG+|;ZbDHq
zO$se7Eg)HSYI#{`N=|rpY-3keHcV4DFLYQ#OGrafbwyEeacOWbIAKmnK~yy>YYN{t
zx6b7q3*H-e{Sq7Y8pjdPm18jVj9AJhn{`Lj`$C`F{C_j4)+cs~!4k!kI*WF4X^O-e
zD4z_%<<|ASFMKYHuhqMgBD|dYvav9Nwv7twCuhr^GU3_^#;8>&L(nx)n&XmAOz<yl
zoAUR8gX<&M|4r^<<KUn9OzD5;d}VL^<dc|g@(qZ&+8i2#zWpqJb{lek%&b8MU-CP*
z>ugo7E`Ls!Jsr0sSO5jD*_I?9_S^&Rw$Hm|<WEX4T1zGazVYm_kWb-MO-r{nvRR+D
zy4dSFb*kH3Lr#TwdT|(_Lp9@UiGqcrk<fxiHK24AaI?JD0sbJe{E~z3b(o6zRcqpw
zI~b_J8>YueCTs4yR%{9M*hy~08}jxtxGL|*TYvds4P;G5!o4xSKdA-#5S@7r*85?&
zDCD^jGZ+$$jqXL0t|U>{ed@y%GW^R-(q5ygm)Yg}^o{JWQ{_bk!I8{mB$(ke({7ET
zW+MAQd~=qS+#aJ-rafRRnS-PSObnyvgT|^sJMVwRMEE(fOx@B4_u{ILc#p@hf4Td{
zr+=_}jpqePP3tV<zr%goUcQY5S4)n#b77f{!I`y#E9|41>*Fe#MJCRAI1gJq@C;Q8
z_>@vAvPQ2x^K*j*lrqu#cO*Sb2G!Ff3(;!IdoU@K<a0+AaL~JEoYwy6+o~`L^@y`o
zB8=O3S!wKbjz^-LynMTbeeK)9+j_7Rnt!u*=>ND%_Tz_RigKQ@3(4(dY`k1cCxOzZ
zZeZz63jk)dVBEVm<&<tpb&mc&62t^R$1f~;+wg-LtbnFP3*IEpNPty{@}>9O{l&Gk
zAoKqA*~uOAn!#=%hJ60V#_sC@k}edgz|P$kaPGd^PFF3q)A3yL13Xh#)6C@Dy8${I
Cq}<K`

delta 1113
zcmV-f1g86$2<ixsAb&z_XGCyoG)QekF+*1`K}9uLOE+~kWOhYCYIQkjV@EemQ*TsB
zD^*fzX9`v;MsQP2LS|Jkcu_f2G-*>XSYcIYRV!~uV{t1`O<Gu2a4R!IV|HbBGzu*~
zAaH4REpRe5HXwL$Q)M_&AVD~DHF;8Ed2458S6FaxPH|>5G=EQ6K{G@!L1Io~Q7=YI
zGILgIS65?tLqQ5?Z#PFoSz1L(dN*omPE%M%MrT7eXlZ43XGAzRZ)QP6XJa&PO)_$F
zbubDoJ|Hk8B04rPDlKPnWnpt=AYCmhI9wo7J6mB?dq7YiS153JUrJISBz!VRduB#`
z3Tii1GEX&PWPe9!R8dnmV{|lnN>DRmLUA@tMNw3EQcGcXPeDjjaBXp7S!6_GH%w4i
zW==$9NqT2tR#HcCVKNG3S~W~+b}~3~L|S4;SXM@FOgA=UM{qJTMOt@9FE~XwHBM+Z
zS8ZZtY%4=}M{`zgRW*2INo8U*SVM6)dS+t^Y*7j=Eq^T_H&IPbLPctENmWg8SvOHP
zS2S-@R5VI2N;7G1K}B+EN>fE;aW!`|QaN`DA{;&b{YHp?z~7|o>Ju%4Pn%d_o^kjk
z4PX>>Sex9!f<}g}G}g&Nsb$100=m~?z@#yU>-A`#ik=w>4yk_cEHRab<2SjN%^|Le
z<`Rep(|>MZ`OF{B)=H1=rR60&jf_GTXD{sY^-gX;hEAd5trYN=WH<nG4FKQ>C46s!
zGmDY5;lrk@lABNm(qYbODeP>1EKsfvs|B6XDksn9Oy9C~7l^A@=nE^EG2I)g*jwNC
z;KZNK+l!`($FvVHDs(g$-a)PR^46`eP%bU#Zh!BA_U|>BZxW_D(<QY|BAWX6;{TFF
zSd4sximNkJYuLv<&EgKV+Eolma|3sPCSfbX<Z|h5cNO=5(0#Ax=l-zBIRCuSp&MIt
z(BuoyQg`sa+HE&e&q~xd5j=u-NudoRMg8Ny$zf~s|Dk}AAi^@0<`5-$LYX9C`?s@o
zKY#XhyAB|e`zm<8e||h&4aC_<Y9NUL@;nFLp}OyAJPLC}j6T#*3e&>k9;1uFDqZg9
zL|ZiQ=+?cE-p18;AU7PzjOUg6LgkP$uSf|BD~!mNy_i%NwTPab<H+;QD=B;&WGv;c
z6xq#BdI`RVztN|5<@Pc>G}EC(=oYTmYJUcVgW4DUg1u>jq}dIDO+U$bIHC3a@AT7z
zv{aid-TFXpn83=}t#IaFQhk*R>|jAJ$MBwc@x24nY;AbIaC>X8xiVe|iWQ}aW&cx6
zj(xOrmGE8#1?&rX=t#KXCf6S6SB!>WmKggGnSGeGqARn#DFiAdd}Muxe+t$fAW}sx
zH0n^T74T}K+?tS*s{{fOEBsv?Nc#sII&huUN)3c!4}c~yLM1gR(w7E30HvMF^dV(Y
f3*|qD<m7rALSbiJ4q0<;E#0zaP6mjpBNRi8Vy4}Y

diff --git a/modules/promtail.nix b/modules/promtail.nix
index c1ab389..415a141 100644
--- a/modules/promtail.nix
+++ b/modules/promtail.nix
@@ -48,7 +48,7 @@ in {
 
         clients = [
           {
-            basic_auth.username = "${nodeName}:promtail-loki-basic-auth-password";
+            basic_auth.username = "${nodeName}+promtail-loki-basic-auth-password";
             basic_auth.password_file = config.age.secrets.promtail-loki-basic-auth-password.path;
             url = "https://${nodes.${cfg.proxy}.config.proxiedDomains.loki}/loki/api/v1/push";
           }