Add grafana_alloy role: scrape log files to Loki

roles/grafana_alloy/templates/alloy.service.j2

@@ -0,0 +1,30 @@
+[Unit]
+Description=Grafana Alloy
+Wants=network-online.target
+After=network-online.target
+Documentation="https://grafana.com/docs/alloy/"
+
+[Service]
+User=alloy
+Group=alloy
+Type=simple
+Environment=HOSTNAME=%H
+ExecStart=/usr/bin/alloy run {{ grafana_alloy_config_dir }}/config.alloy \
+    --storage.path={{ grafana_alloy_data_dir }} \
+    --server.http.listen-addr=127.0.0.1:12345 \
+    --disable-reporting
+ExecReload=/bin/kill -HUP $MAINPID
+
+# Security hardening
+ReadWritePaths={{ grafana_alloy_data_dir }}
+ProtectSystem=strict
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelTunables=true
+ProtectClock=yes
+RestrictSUIDSGID=true
+
+[Install]
+WantedBy=multi-user.target

roles/grafana_alloy/templates/config.alloy.j2

@@ -0,0 +1,24 @@
+// {{ ansible_managed }}
+
+local.file_match "logs" {
+  path_targets = [
+{% for path in grafana_alloy_log_paths %}
+    {__path__ = "{{ path }}", job = "varlogs", host = constants.hostname},
+{% endfor %}
+  ]
+}
+
+loki.source.file "logs" {
+  targets    = local.file_match.logs.targets
+  forward_to = [loki.process.default.receiver]
+}
+
+loki.process "default" {
+  forward_to = [loki.write.default.receiver]
+}
+
+loki.write "default" {
+  endpoint {
+    url = "{{ grafana_alloy_loki_url }}"
+  }
+}