diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index d76b76e..d71c4f2 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,21 +1,28 @@
 ---
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v2.4.0
+    rev: v4.3.0
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
       - id: check-yaml
       - id: check-added-large-files
       - id: check-merge-conflict
+
   - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
-    rev: v5.0.0
+    rev: v8.0.0
     hooks:
       - id: commitlint
         stages: [commit-msg]
         additional_dependencies: ['@commitlint/config-conventional']
+
   - repo: https://github.com/Yelp/detect-secrets
-    rev: v1.1.0
+    rev: v1.2.0
     hooks:
       - id: detect-secrets
         args: ['--baseline', '.secrets.baseline']
+
+  - repo: https://github.com/tfsec/tfsec
+    rev: v1.26.3
+    hooks:
+      - id: tfsec-system
diff --git a/.secrets.baseline b/.secrets.baseline
index 28f363c..a2c25cc 100644
--- a/.secrets.baseline
+++ b/.secrets.baseline
@@ -1,5 +1,5 @@
 {
-  "version": "1.1.0",
+  "version": "1.2.0",
   "plugins_used": [
     {
       "name": "ArtifactoryDetector"
diff --git a/loki.hcl.tpl b/loki.hcl.tpl
deleted file mode 100644
index 6206838..0000000
--- a/loki.hcl.tpl
+++ /dev/null
@@ -1,46 +0,0 @@
-auth_enabled: false
-
-server:
-  http_listen_port: 3100
-  grpc_listen_port: 9096
-
-common:
-  path_prefix: /tmp/loki
-  storage:
-    filesystem:
-      chunks_directory: /tmp/loki/chunks
-      rules_directory: /tmp/loki/rules
-  replication_factor: 1
-  ring:
-    instance_addr: 127.0.0.1
-    kvstore:
-      store: consul
-      consul:
-        host: localhost:8500
-
-
-schema_config:
-  configs:
-    - from: 2020-10-24
-      store: boltdb-shipper
-      object_store: filesystem
-      schema: v11
-      index:
-        prefix: index_
-        period: 24h
-
-ruler:
-  alertmanager_url: http://localhost:9093
-
-# By default, Loki will send anonymous, but uniquely-identifiable usage and configuration
-# analytics to Grafana Labs. These statistics are sent to https://stats.grafana.org/
-#
-# Statistics help us better understand how Loki is used, and they show us performance
-# levels for most users. This helps us prioritize features and documentation.
-# For more information on what's sent, look at
-# https://github.com/grafana/loki/blob/main/pkg/usagestats/stats.go
-# Refer to the buildReport method to see what goes into a report.
-#
-# If you would like to disable reporting, uncomment the following lines:
-#analytics:
-#  reporting_enabled: false
diff --git a/loki.nomad b/loki.nomad
deleted file mode 100644
index 6be4fe7..0000000
--- a/loki.nomad
+++ /dev/null
@@ -1,140 +0,0 @@
-variable "loki_version" {
-  type = string
-  default = "v2.5.0"
-  description = "Loki release to deploy. See https://github.com/grafana/loki/releases/"
-}
-job "loki" {
-  datacenters = ["dc1"]
-  type = "service"
-  name = "loki"
-  // migrate {}
-  meta {
-    auto-backup = true
-    backup-schedule = "@hourly"
-    backup-target-db = "postgres"
-  }
-  update {
-    max_parallel = 1
-    health_check = "checks"
-    min_healthy_time = "5s"
-    healthy_deadline = "60s"
-    progress_deadline = "3m"
-    auto_revert = true
-    auto_promote = true
-    canary = 1
-  }
-  priority = 80
-  group "log-server" {
-    count = 1
-
-    network {
-      port "loki_http_listen" {
-        static = 3100
-      }
-      port "loki_grpc_listen" {
-        static = 9096
-      }
-    }
-    service {
-      name = "loki-http-server"
-      tags = ["logs", "loki", "observability", "urlprefix-/loki"]
-      port = "loki_http_listen"
-
-      check {
-        name = "loki_http_alive"
-        type = "tcp"
-        interval = "10s"
-        timeout = "3s"
-      }
-
-      check {
-        name = "loki_http_ready"
-        type = "http"
-        path = "/ready"
-        port = "loki_http_listen"
-        interval = "10s"
-        timeout = "3s"
-      }
-    }
-    task "server" {
-      driver = "raw_exec"
-      config {
-        command = "loki"
-        args = [
-          "-config.file=local/loki.yml"
-        ]
-      }
-      resources {
-        cpu = 128
-        memory = 50
-      }
-      template {
-        // source = "local/loki.yml.tpl"
-        data = <<EOT
-auth_enabled: false
-
-server:
-  http_listen_port: 3100
-  grpc_listen_port: 9096
-ingester:
-  autoforget_unhealthy: true
-  lifecycler:
-    heartbeat_period: "15s"
-    min_ready_duration: "30s"
-ingester_client:
-  pool_config:
-    health_check_ingesters: true
-  remote_timeout: "5s"
-common:
-  replication_factor: 3
-  path_prefix: /tmp/loki
-  storage:
-    filesystem:
-#      directory: /tmp/loki
-      chunks_directory: /tmp/loki/chunks
-      rules_directory: /tmp/loki/rules
-  ring:
-    instance_addr: 127.0.0.1
-    kvstore:
-      store: consul
-
-schema_config:
-  configs:
-    - from: 2020-10-24
-      store: boltdb-shipper
-      object_store: filesystem
-      schema: v11
-      index:
-        prefix: index_
-        period: 24h
-
-ruler:
-  alertmanager_url: http://localhost:9093
-
-analytics:
-  reporting_enabled: false
-        EOT
-        destination = "local/loki.yml"
-      }
-      artifact {
-        source = "https://github.com/grafana/loki/releases/download/${var.loki_version}/loki-linux-${attr.cpu.arch}.zip"
-        options { # checksum depends on the cpu arch
-        }
-        destination = "local/loki"
-        mode = "file"
-      }
-      // artifact {
-      //   source = "http://minio-deploy-run.service.consul:9000/loki-bin/loki-linux-${attr.cpu.arch}.zip"
-      //   destination = "local/loki"
-      //   mode = "file"
-      // }
-      // artifact {
-      //   source = "http://minio-deploy-run.service.consul:9000/loki-config/loki.hcl.tpl"
-      //   destination = "local/loki.yml.tpl"
-      //   mode = "file"
-      // }
-
-    }
-
-  }
-}
diff --git a/loki/.terraform.lock.hcl b/loki/.terraform.lock.hcl
new file mode 100644
index 0000000..0029b38
--- /dev/null
+++ b/loki/.terraform.lock.hcl
@@ -0,0 +1,86 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/digitalocean/digitalocean" {
+  version     = "2.21.0"
+  constraints = "2.21.0"
+  hashes = [
+    "h1:gndflVS5/+cwQbVVI6NwwB3dYK7W2QkmZuWmFBH/0tI=",
+    "zh:122a4e7aa7315be52c484fa9b8e8681a42ad17e1f892ca17d6aeb575902df078",
+    "zh:192f9428d965d1a5d2629e6ec1c238c6815601fbc909f905bf94ff9359ba88f6",
+    "zh:20d88900cd24e9c05e2addeeb9fd5df285fba928d5f9981128352a6089fcec88",
+    "zh:30eb650c04e4c6ab0b06549a345dacdfaf5597f24e916ed82cad798a546783e6",
+    "zh:33864a8bc3f02507397d36bc5bf21ad1be11c188d2d0d45fe19063d0f949ff49",
+    "zh:34431ea6fe25e734ed851595f622ff848c325fbf2f799d85a6cfcadedc1e9063",
+    "zh:4be9ee1d632352504541d3629ce583e2b89ab9e5eb6a9d6547d37eb1c02dc341",
+    "zh:723436531aaec6a7d651b15857194993baee6e59d7b1b8c22176ee44065de905",
+    "zh:7305edf6305f3c0ba945509e679655d2b7c082f21723e2bd415c8f1f161a1a97",
+    "zh:acd2124cb1c604351f9482d47ab9a16a1887b8d9df049c8da0d0e3791326404d",
+    "zh:af6745bb9096a52e2570a758b55fd0a746b70d4bb04ba09ee33ab7dd63e87337",
+    "zh:b676c58bbfd08bd3960ed78740a23ed17d959ac0348cab08ad34aaeaff952c7d",
+    "zh:bfa739ac5fea3f89d9c403be91179729490370ed19b735070c9659e9265718aa",
+    "zh:c1d5a0d0995fddf0df03f1da49de9531ab45138cf0b24e67c45f23a38ba91c33",
+    "zh:cac52e76829a1fc01e165c4a66854b94b2813a21d392f6bddfacbba7edfd4f77",
+    "zh:d55cdd70b89e7e9cd674c0f39cdef93dd0ace1d361bbae65583df9defb7d4725",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/consul" {
+  version     = "2.15.1"
+  constraints = "2.15.1"
+  hashes = [
+    "h1:PexyQBRLDA+SR+sWlzYBZswry5O5h/tTfj87CaECtLc=",
+    "zh:1806830a3cf103e65e772a7d28fd4df2788c29a029fb2def1326bc777ad107ed",
+    "zh:252be544fb4c9daf09cad7d3776daf5fa66b62740d3ea9d6d499a7b1697c3433",
+    "zh:50985fe02a8e5ae47c75d7c28c911b25d7dc4716cff2ed55ca05889ab77a1f73",
+    "zh:54cf0ec90538703c66937c77e8d72a38d5af47437eb0b8b55eb5836c5d288878",
+    "zh:704f536c621337e06fffef6d5f49ac81f52d249f937250527c12884cb83aefed",
+    "zh:896d8ef6d0b555299f124eb25bce8a17d735da14ef21f07582098d301f47da30",
+    "zh:976277a85b0a0baafe267cc494f766448d1da5b6936ddcb3ce393bd4d22f08d2",
+    "zh:c7faa9a2b11bc45833a3e8e340f22f1ecf01597eaeffa7669234b4549d7dfa85",
+    "zh:caf851ef9c8ce482864badf7058f9278d4537112fa236efd8f1a9315801d9061",
+    "zh:db203435d58b0ac842540861b3307a623423275d85754c171773f3b210ae5b24",
+    "zh:f3d3efac504c9484a025beb919d22b290aa6dbff256f6e86c1f8ce7817e077e5",
+    "zh:f710a37190429045d109edd35de69db3b5f619919c2fa04c77a3a639fea9fd7d",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/nomad" {
+  version     = "1.4.17"
+  constraints = "1.4.17"
+  hashes = [
+    "h1:iPylWr144mqXvM8NBVMTm+MS6JRhqIihlpJG91GYDyA=",
+    "zh:146f97eacd9a0c78b357a6cfd2cb12765d4b18e9660a75500ee3e748c6eba41a",
+    "zh:2eb89a6e5cee9aea03a96ea9f141096fe3baf219b2700ce30229d2d882f5015f",
+    "zh:3d0f971f79b615c1014c75e2f99f34bd4b4da542ca9f31d5ea7fadc4e9de39c1",
+    "zh:46099a750c752ce05aa14d663a86478a5ad66d95aff3d69367f1d3628aac7792",
+    "zh:71e56006b013dcfe1e4e059b2b07148b44fcd79351ae2c357e0d97e27ae0d916",
+    "zh:74febd25d776688f0558178c2f5a0e6818bbf4cdaa2e160d7049da04103940f0",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:af18c064a5f0dd5422d6771939274841f635b619ab392c73d5bf9720945fdb85",
+    "zh:c133d7a862079da9f06e301c530eacbd70e9288fa2276ec0704df907270ee328",
+    "zh:c894cf98d239b9f5a4b7cde9f5c836face0b5b93099048ee817b0380ea439c65",
+    "zh:c918642870f0cafdbe4d7dd07c909701fc3ddb47cac8357bdcde1327bf78c11d",
+    "zh:f8f5655099a57b4b9c0018a2d49133771e24c7ff8262efb1ceb140fd224aa9b6",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/vault" {
+  version     = "3.7.0"
+  constraints = "3.7.0"
+  hashes = [
+    "h1:idawLPCbZgHIb+NRLJs4YdIcQgACqYiT5VwQfChkn+w=",
+    "zh:256b82692c560c76ad51414a2c003cadfa10338a9df333dbe22dd14a9ed16f95",
+    "zh:329ed8135a98bd6a000d014e40bc5981c6868cf50eedf454f1a1f72ac463bdf0",
+    "zh:3b32c18b492a6ac8e1ccac40d28cd42a88892ef8f3515291676136e3faac351c",
+    "zh:4c5ea8e80543b36b1999257a41c8b9cde852542251de82a94cff2f9d280ac2ec",
+    "zh:5d968ed305cde7aa3567a943cb2f5f8def54b40a2292b66027b1405a1cf28585",
+    "zh:60226d1a0a496a9a6c1d646800dd7e1bd1c4f5527e7307ff0bca9f4d0b5395e2",
+    "zh:71b11def501c994ee5305f24bd47ebfcca2314c5acca3efcdd209373d0068ac0",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:89be6b5db3be473bfd14422a9abf83245c4b22ce47a8fe463bbebf8e20958ab1",
+    "zh:8f91051d43ae309bb8f3f6a9659f0fd26b1b239faf671c139b4e9ad0d208db05",
+    "zh:b5114983273d3170878f657b92738b2c40953aedeef2e1840588ecaf1bc0827e",
+    "zh:fd56db01c5444dc8ca2e0ad2f13fc4c17735d0fdeb5960e23176fb3f5a5114d3",
+  ]
+}
diff --git a/loki/loki.nomad b/loki/loki.nomad
new file mode 100644
index 0000000..934c6dc
--- /dev/null
+++ b/loki/loki.nomad
@@ -0,0 +1,99 @@
+variable "access_key" {
+  type = string
+}
+
+variable "secret_key" {
+  type = string
+}
+
+variable "loki_version" {
+  type = string
+  default = "v2.6.0"
+}
+
+job "loki" {
+  datacenters = ["dc1"]
+  type = "service"
+  name = "loki"
+  // migrate {}
+  meta {
+    auto-backup = true
+    backup-schedule = "@hourly"
+    backup-target-db = "postgres"
+  }
+  update {
+    max_parallel = 1
+    health_check = "checks"
+    min_healthy_time = "5s"
+    healthy_deadline = "300s"
+    progress_deadline = "10m"
+    auto_revert = true
+    auto_promote = true
+    canary = 1
+  }
+  priority = 80
+  group "log-server" {
+    count = 1
+
+    network {
+      port "http" {
+        static = 3100
+      }
+      port "grpc" {
+        static = 9096
+      }
+    }
+    service {
+      name = "loki-http-server"
+      tags = ["logs", "loki", "observability", "urlprefix-/loki"]
+      port = "http"
+      on_update = "require_healthy"
+
+      check {
+        name = "loki_alive"
+        type = "grpc"
+        port = "grpc"
+        interval = "10s"
+        timeout = "3s"
+      }
+
+      check {
+        name = "loki_ready"
+        type = "http"
+        path = "/ready"
+        port = "http"
+        interval = "10s"
+        timeout = "3s"
+      }
+    }
+    task "server" {
+      driver = "exec"
+      env {
+        access_key = var.access_key
+        secret_key = var.secret_key
+      }
+      config {
+        command = "loki"
+        args = [
+          "-config.file=local/loki.yml"
+        ]
+      }
+      resources {
+        cpu = 128
+        memory = 200
+      }
+      template {
+        data = file("loki.yml.tpl")
+        destination = "local/loki.yml"
+        change_mode = "restart"
+      }
+      artifact {
+        source = "https://github.com/grafana/loki/releases/download/${var.loki_version}/loki-linux-${attr.cpu.arch}.zip"
+        options { # checksum depends on the cpu arch
+        }
+        destination = "local/loki"
+        mode = "file"
+      }
+    }
+  }
+}
diff --git a/loki/loki.yml.tpl b/loki/loki.yml.tpl
new file mode 100644
index 0000000..3cae90d
--- /dev/null
+++ b/loki/loki.yml.tpl
@@ -0,0 +1,34 @@
+auth_enabled: false
+
+server:
+  http_listen_port: {{ env "NOMAD_PORT_http" }}
+  grpc_listen_port: {{ env "NOMAD_PORT_grpc" }}
+memberlist:
+  join_members:
+    - loki-http-server
+schema_config:
+  configs:
+    - from: 2022-01-01
+      store: boltdb-shipper
+      object_store: s3
+      schema: v11
+      index:
+        prefix: index_
+        period: 24h
+common:
+  path_prefix: local/
+  replication_factor: 1
+  storage:
+    s3:
+      endpoint:  {{ key "jobs/loki/s3_endpoint" }}
+      bucketnames: {{ key "jobs/loki/logs_bucket" }}
+      access_key_id: {{ env "access_key" }}
+      secret_access_key: {{ env "secret_key" }}
+      s3forcepathstyle: true
+  ring:
+    kvstore:
+      store: consul
+ruler:
+  storage:
+    s3:
+      bucketnames: {{ key "jobs/loki/logs_bucket" }}
diff --git a/loki/main.tf b/loki/main.tf
new file mode 100644
index 0000000..fc480c0
--- /dev/null
+++ b/loki/main.tf
@@ -0,0 +1,99 @@
+terraform {
+  required_version = ">=1.2.0"
+  backend "consul" {
+    path = "nomad/loki"
+  }
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "3.7.0"
+    }
+    digitalocean = {
+      source  = "digitalocean/digitalocean"
+      version = "2.21.0"
+    }
+    nomad = {
+      source  = "hashicorp/nomad"
+      version = "1.4.17"
+    }
+    consul = {
+      source  = "hashicorp/consul"
+      version = "2.15.1"
+    }
+  }
+}
+
+provider "vault" {
+  # Configuration options
+}
+
+data "vault_kv_secret_v2" "digitalocean" {
+  mount = "digitalocean"
+  name  = "tokens"
+}
+
+provider "digitalocean" {
+  token             = jsondecode(data.vault_kv_secret_v2.digitalocean.data_json)["terraform"]
+  spaces_access_id  = jsondecode(data.vault_kv_secret_v2.digitalocean.data_json)["spaces_key"]
+  spaces_secret_key = jsondecode(data.vault_kv_secret_v2.digitalocean.data_json)["spaces_secret"]
+}
+
+provider "nomad" {
+
+}
+
+provider "consul" {
+
+}
+
+resource "digitalocean_spaces_bucket" "logs" {
+  region = var.doregion
+  name   = "hah-logs"
+  acl    = "private"
+  versioning {
+    enabled = true
+  }
+  lifecycle_rule {
+    # id      = "monthly"
+    enabled = true
+    prefix  = "fake_"
+    expiration {
+      days = 14
+    }
+  }
+  #tfsec:ignore:digitalocean-spaces-disable-force-destroy
+  force_destroy = true
+}
+
+resource "consul_keys" "bucket" {
+  datacenter = "dc1"
+
+  key {
+    path  = "jobs/loki/logs_bucket"
+    value = "digitalocean_spaces_bucket.logs.name"
+  }
+}
+
+resource "consul_keys" "endpoint" {
+  datacenter = "dc1"
+
+  key {
+    path  = "jobs/loki/s3_endpoint"
+    value = "https://${digitalocean_spaces_bucket.logs.region}.digitaloceanspaces.com"
+  }
+}
+
+resource "nomad_job" "loki" {
+  jobspec    = file("${path.module}/loki.nomad")
+  depends_on = [digitalocean_spaces_bucket.logs]
+  hcl2 {
+    enabled  = true
+    allow_fs = true
+    vars = {
+      "access_key" = jsondecode(data.vault_kv_secret_v2.digitalocean.data_json)["spaces_key"]
+      "secret_key" = jsondecode(data.vault_kv_secret_v2.digitalocean.data_json)["spaces_secret"]
+    }
+  }
+  purge_on_destroy = true
+  detach           = false
+}
diff --git a/loki/variables.tf b/loki/variables.tf
new file mode 100644
index 0000000..3466e43
--- /dev/null
+++ b/loki/variables.tf
@@ -0,0 +1,5 @@
+variable "doregion" {
+  description = "Name of the Digital Ocean region we're using"
+  default     = "ams3"
+  type        = string
+}