Alloy receives syslog on 514/udp and 1514/tcp from network devices, forwards to a local Loki instance; Grafana provisioned with Loki as default datasource. Compose bind-mounts config from /mnt/containers/logging/... on the host (staged separately) since Portainer's GitOps pull only fetches the compose file, not the repo's other files.