🔐 Setup HTTPS with Self-Signed Certificate for Loki behind NGINX Reverse Proxy

📁 Step 1: Create Certificate Directory

sudo mkdir -p /etc/nginx/certs
cd /etc/nginx/certs

📝 Step 2: Create `loki-cert.conf` Configuration File

[req]
default_bits       = 2048
distinguished_name = req_distinguished_name
req_extensions     = req_ext
x509_extensions    = v3_ca
prompt             = no

[req_distinguished_name]
C  = IN
ST = Haryana
L  = Gurugram
O  = domainname
OU = domainname
CN = loki.domainname.com

[req_ext]
subjectAltName = @alt_names

[v3_ca]
subjectAltName = @alt_names
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,keyEncipherment
extendedKeyUsage = serverAuth

[alt_names]
DNS.1 = loki.domainname.com

🔑 Step 3: Generate SSL Certificate and Key

openssl req -x509 -nodes -days 3652 -newkey rsa:4096 \
  -keyout loki.key \
  -out loki.crt \
  -config loki-domainname.com-cert.conf

chmod -R +r /etc/nginx/certs

🌐 Step 4: NGINX Configuration for Loki HTTPS Proxy

Create or update your NGINX site config:

server {
    listen 443 ssl;
    server_name loki.domainname.com;

    ssl_certificate     /etc/nginx/certs/loki.crt;
    ssl_certificate_key /etc/nginx/certs/loki.key;

    # 🔐 Allow only /loki/api/v1/push with basic auth
      location = /loki/api/v1/push {
        proxy_pass http://localhost:3100;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        auth_basic "Push Access Only";
        auth_basic_user_file /etc/nginx/.htpasswd;
    }

    # ✅ Allow /ready endpoint without auth
    location = /ready {
        proxy_pass http://localhost:3100/ready;
    }

    # 🚫 Deny all other routes
    location / {
        return 403;
    }
}

http and https both

# cat /etc/nginx/sites-available/loki-staging.domainname.com.conf 
########################################
# 1) HTTP block – listens on :80
########################################
server {
    listen 80;
    server_name loki-staging.domainname.com;

    # Allow only /loki/api/v1/push with Basic Auth
    location = /loki/api/v1/push {
        proxy_pass http://localhost:3100;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        auth_basic "Push Access Only";
        auth_basic_user_file /etc/nginx/.htpasswd;
    }

    # Expose /ready without auth
    location = /ready {
        proxy_pass http://localhost:3100/ready;
    }

    # Deny everything else
    location / {
        return 403;
    }

}

########################################
# 2) HTTPS block – listens on :443 (your original server)
########################################
server {
    listen 443 ssl http2;
    server_name loki.domainname.com;

    ssl_certificate     /etc/nginx/certs/loki.crt;
    ssl_certificate_key /etc/nginx/certs/loki.key;

    # Allow only /loki/api/v1/push with Basic Auth
    location = /loki/api/v1/push {
        proxy_pass http://localhost:3100;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        auth_basic "Push Access Only";
        auth_basic_user_file /etc/nginx/.htpasswd;
    }

    # Expose /ready without auth
    location = /ready {
        proxy_pass http://localhost:3100/ready;
    }

    # Deny everything else
    location / {
        return 403;
    }
}

🔐 Step 5: Create Basic Auth User

sudo htpasswd -c /etc/nginx/.htpasswd pushuser
# Enter password: pushpassword

🌍 Step 6: Test the Endpoint (with `--insecure` for self-signed cert)

curl -v https://loki.domainname.com/ready --insecure

🏢 Step 7: Add Certificate to System Trust Store `It will remove the error of TLS verification failed`

sudo cp loki.crt /usr/local/share/ca-certificates/loki.crt
sudo update-ca-certificates

Promtail Configuration ot use certificate :

use this if above update-ca-certificates does not work or you want to use certificate in promtail config file

# This Should be added in Agent to work with Loki over HTTPS
clients:
  - url: https://loki.domainname.com/loki/api/v1/push
    tls_config:
      ca_file: /etc/promtail/certs/loki.crt
      insecure_skip_verify: false
    basic_auth:
      username: pushuser
      password: pushpassword

After adding the above configuration in promtail config file, restart promtail service to apply changes.

curl -v https://loki.domainname.com/ready --insecure

🔄 Step 8: Restart Promtail to Apply Changes

sudo systemctl restart promtail

✅ Now, Loki is served securely over HTTPS with self-signed certs and access control via NGINX.

EFK Stack

DataDog

Grafana Stack

Jaeger

Loki Stack

OpenSearch

Loki Https Nginx Setup LatestOfficial

🔐 Setup HTTPS with Self-Signed Certificate for Loki behind NGINX Reverse Proxy

📁 Step 1: Create Certificate Directory

📝 Step 2: Create `loki-cert.conf` Configuration File

🔑 Step 3: Generate SSL Certificate and Key

🌐 Step 4: NGINX Configuration for Loki HTTPS Proxy

http and https both

🔐 Step 5: Create Basic Auth User

🌍 Step 6: Test the Endpoint (with `--insecure` for self-signed cert)

🏢 Step 7: Add Certificate to System Trust Store `It will remove the error of TLS verification failed`

Promtail Configuration ot use certificate :

🔄 Step 8: Restart Promtail to Apply Changes

​🔐 Setup HTTPS with Self-Signed Certificate for Loki behind NGINX Reverse Proxy

​📁 Step 1: Create Certificate Directory

​📝 Step 2: Create loki-cert.conf Configuration File

​🔑 Step 3: Generate SSL Certificate and Key

​🌐 Step 4: NGINX Configuration for Loki HTTPS Proxy

​http and https both

​🔐 Step 5: Create Basic Auth User

​🌍 Step 6: Test the Endpoint (with --insecure for self-signed cert)

​🏢 Step 7: Add Certificate to System Trust Store It will remove the error of TLS verification failed

​Promtail Configuration ot use certificate :

​🔄 Step 8: Restart Promtail to Apply Changes

🔐 Setup HTTPS with Self-Signed Certificate for Loki behind NGINX Reverse Proxy

📁 Step 1: Create Certificate Directory

📝 Step 2: Create `loki-cert.conf` Configuration File

🔑 Step 3: Generate SSL Certificate and Key

🌐 Step 4: NGINX Configuration for Loki HTTPS Proxy

http and https both

🔐 Step 5: Create Basic Auth User

🌍 Step 6: Test the Endpoint (with `--insecure` for self-signed cert)

🏢 Step 7: Add Certificate to System Trust Store `It will remove the error of TLS verification failed`

Promtail Configuration ot use certificate :

🔄 Step 8: Restart Promtail to Apply Changes