{
  config,
  lib,
  pkgs,
  ...
}: {
  # This ensures the directory exists at boot, owned by traefik (writer) and readable by promtail.
  systemd.tmpfiles.rules = [
    "d /var/log/traefik 0755 traefik promtail -"
  ];

  services.promtail.configuration.scrape_configs = lib.mkAfter [
    {
      job_name = "traefik";
      static_configs = [
        {
          targets = ["localhost"];
          labels = {
            job = "traefik";
            host = config.networking.hostName;
            env = "proxmox";
            instance = "${config.networking.hostName}.lab"; # prometheus scrape target
            __path__ = "/var/log/traefik/*.log";
          };
        }
      ];
    }
  ];
}
