// Grafana Alloy configuration — DVWA log collection pipeline
// Collects Docker container logs from the DVWA container and forwards to Loki.
// Preserves the full HTTP request line including URI and query parameters
// so SQL injection payloads are visible in Grafana log queries.

discovery.docker "containers" {
  host = "unix:///var/run/docker.sock"
}

discovery.relabel "dvwa_only" {
  targets = discovery.docker.containers.targets

  rule {
    source_labels = ["__meta_docker_container_name"]
    regex         = "/dvwa"
    action        = "keep"
  }

  rule {
    source_labels = ["__meta_docker_container_name"]
    target_label  = "container"
    regex         = "/(.*)"
  }
}

loki.source.docker "dvwa_logs" {
  host       = "unix:///var/run/docker.sock"
  targets    = discovery.relabel.dvwa_only.output
  labels     = {
    job = "dvwa",
  }
  forward_to = [loki.write.local.receiver]
}

loki.write "local" {
  endpoint {
    url = "http://loki:3100/loki/api/v1/push"
  }
}