diff --git a/app/loki/templates.cue b/app/loki/templates.cue
new file mode 100644
index 0000000..a202eaf
--- /dev/null
+++ b/app/loki/templates.cue
@@ -0,0 +1,26 @@
+package loki
+
+import "du5t1n.me/cfg/base/schema/instructions"
+
+templates: [...instructions.#RenderInstruction] & [
+	{
+		template: "loki/config.yml"
+		dest:     "/etc/loki/config.yml"
+		hooks: {
+			changed: [{run: "systemctl try-restart loki"}]
+		}
+	},
+	{
+		template: "loki/loki.container"
+		dest:     "/etc/containers/systemd/loki.container"
+		hooks: {
+			changed: [
+				{
+					run:       "systemctl daemon-reload"
+					immediate: true
+				},
+				{run: "systemctl restart loki"},
+			]
+		}
+	},
+]
diff --git a/host/loki0.pyrocufflink.blue.cue b/host/loki0.pyrocufflink.blue.cue
new file mode 100644
index 0000000..f1d4f03
--- /dev/null
+++ b/host/loki0.pyrocufflink.blue.cue
@@ -0,0 +1,6 @@
+import (
+	"du5t1n.me/cfg/env/prod"
+)
+
+ssh:  prod.ssh
+sudo: prod.sudo
diff --git a/host/loki0.pyrocufflink.blue.post.sh b/host/loki0.pyrocufflink.blue.post.sh
new file mode 100644
index 0000000..17c32eb
--- /dev/null
+++ b/host/loki0.pyrocufflink.blue.post.sh
@@ -0,0 +1 @@
+. scripts/no-coreos-default-sudo.sh
diff --git a/host/loki0.pyrocufflink.blue.pre.sh b/host/loki0.pyrocufflink.blue.pre.sh
new file mode 100644
index 0000000..92a083e
--- /dev/null
+++ b/host/loki0.pyrocufflink.blue.pre.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+. scripts/pam-ssh-agent-auth.sh
+
+install_packages
diff --git a/instructions/loki0.pyrocufflink.blue.cue b/instructions/loki0.pyrocufflink.blue.cue
new file mode 100644
index 0000000..165c035
--- /dev/null
+++ b/instructions/loki0.pyrocufflink.blue.cue
@@ -0,0 +1,13 @@
+import (
+	"list"
+
+	"du5t1n.me/cfg/app/collectd"
+	"du5t1n.me/cfg/app/loki"
+	"du5t1n.me/cfg/env/prod"
+)
+
+render: list.Concat([
+	collectd.templates,
+	loki.templates,
+	prod.templates,
+])
diff --git a/templates/loki/config.yml b/templates/loki/config.yml
new file mode 100644
index 0000000..b11f2f0
--- /dev/null
+++ b/templates/loki/config.yml
@@ -0,0 +1,37 @@
+auth_enabled: false
+
+server:
+  http_listen_port: 3100
+  grpc_listen_port: 9096
+
+common:
+  instance_addr: 127.0.0.1
+  path_prefix: /var/lib/loki
+  storage:
+    filesystem:
+      chunks_directory: /var/lib/loki/chunks
+      rules_directory: /var/lib/loki/rules
+  replication_factor: 1
+  ring:
+    kvstore:
+      store: inmemory
+
+query_range:
+  results_cache:
+    cache:
+      embedded_cache:
+        enabled: true
+        max_size_mb: 100
+
+schema_config:
+  configs:
+  - from: 2020-10-24
+    store: tsdb
+    object_store: filesystem
+    schema: v12
+    index:
+      prefix: index_
+      period: 24h
+
+query_scheduler:
+  max_outstanding_requests_per_tenant: 1024
diff --git a/templates/loki/loki.container b/templates/loki/loki.container
new file mode 100644
index 0000000..e3f31e9
--- /dev/null
+++ b/templates/loki/loki.container
@@ -0,0 +1,18 @@
+# vim: set ft=systemd :
+[Unit]
+Description=Grafana Loki
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+StateDirectory=%P
+
+[Container]
+Image=docker.io/grafana/loki:2.9.4
+Exec=-config.file=/etc/loki/config.yml
+Volume=%S/%P:/var/lib/loki:rw,Z,U
+Volume=/etc/loki:/etc/loki:ro
+PublishPort=3100:3100
+
+[Install]
+WantedBy=multi-user.target