# Private tailnet exposure of the VictoriaLogs INGEST endpoint so off-cluster log
# shippers (Vector on Docker hosts) can push to it. Provisions vlogs.<tailnet>.ts.net.
# Ingestion is unauthenticated — acceptable on the private tailnet; do not expose publicly.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: victorialogs
  namespace: monitoring
spec:
  ingressClassName: tailscale
  rules:
    - host: vlogs
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: vlsingle-main
                port:
                  number: 9428
  tls:
    - hosts:
        - vlogs