Skip to content

Stack Overview

Finch deploys a self-contained observability stack on a single Linux server. Everything runs in containers, created, managed and maintained by finchctl.

The stack gives you logs, metrics, and continuous profiling in one place, pre-configured and secured without manually integrating half a dozen tools.

What you get

Once deployed, the stack provides:

  • Log aggregation - collect, store, and search logs from systemd journals, Docker containers, and plain files across all enrolled agents.
  • Metrics - short-term storage and querying of Prometheus-compatible metrics scraped by agents from your services.
  • Continuous profiling - CPU and memory profiles sent by agents, stored and browseable over time.
  • Grafana - a single dashboard interface for all three signal types, with pre-built dashboards included and alerting rules ready to customize.

All data endpoints are protected by JWT authentication. Agents receive a token at enrollment time; no manual configuration of Loki, Mimir, or Pyroscope push URLs is needed.

Data retention

All three storage backends - Loki, Mimir, and Pyroscope - are configured with a 72-hour retention period. Data older than 72 hours is automatically deleted.

This is intentional: Finch is designed for short-term operational visibility, not long-term archival. For compliance, audit, or capacity-planning requirements that need longer retention, export or sync the data directories before they are purged:

/var/lib/finch/loki/data
/var/lib/finch/mimir/data
/var/lib/finch/pyroscope/data

These directories can be synced to an object store (e.g. S3-compatible) or a backup destination using any standard tooling (rclone, restic, cron scripts). This is outside the scope of Finch and must be managed manually.

Services

The stack runs seven containers. See Services for a full breakdown of each component and its role.

How it fits together

your apps / servers
       │
   [Alloy agent]          ← enrolled via finchctl on each host
       │ logs / metrics / profiles
       ▼
   [Traefik]              ← TLS termination, auth middleware
       │
   ┌───┴────────────────┐
   │  Loki  Mimir  Pyro │  ← storage backends
   └───────────────────┬┘
                       │
                   [Grafana]  ← visualization

For the full request flow and control plane details, see Architecture.