Implement phase 1 foundations

project-docs/runbooks/loki-setup.md

@@ -0,0 +1,29 @@
+# Loki Setup Runbook
+
+## Starter local/Portainer stack
+
+Use `deploy/loki/docker-compose.yml` and `deploy/loki/promtail-config.yml`.
+
+```sh
+cd deploy/loki
+docker compose up -d
+```
+
+## Verify Loki
+
+```sh
+curl -fsS http://localhost:3100/ready
+curl -G http://localhost:3100/loki/api/v1/labels
+```
+
+## Useful LogQL examples
+
+```logql
+{service="api"} |= "error"
+{stack="second-brain"} |~ "(?i)(panic|fatal|exception)"
+{stream="stderr"} |~ "(?i)(error|failed|timeout)"
+```
+
+## Portainer notes
+
+For Portainer deployment, mount the Docker socket and Docker container log directory read-only into Promtail. The included compose does this for a single Docker host. Multi-node Swarm setups need Promtail on each node or another log shipping strategy.