diff --git a/docker-compose/loki/docker-compose.yml.j2 b/docker-compose/loki/docker-compose.yml.j2
index 7d9fff63..4c6f43cd 100644
--- a/docker-compose/loki/docker-compose.yml.j2
+++ b/docker-compose/loki/docker-compose.yml.j2
@@ -43,3 +43,4 @@ volumes:
 # TODO: http://vm-test-2204.mgrote.net:9080/targets + wenn firewall aus
 # TODO: grafana dashboard und datasource als code? +  https://grafana.com/docs/grafana/latest/administration/provisioning/#datasources
 # TODO: URLS: http://docker10.mgrote.net:3101/explore?orgId=1&left=%7B%22datasource%22:%22U4h5CxgHz%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22datasource%22:%7B%22type%22:%22loki%22,%22uid%22:%22U4h5CxgHz%22%7D%7D%5D,%22range%22:%7B%22from%22:%22now-1h%22,%22to%22:%22now%22%7D%7D + http://docker10.mgrote.net:3100/ready + http://vm-test-2204.mgrote.net:9080/config
+# TODO: grafana an LDAP: https://github.com/lldap/lldap/blob/main/example_configs/grafana_ldap_config.toml
diff --git a/group_vars/all.yml b/group_vars/all.yml
index 933a2a86..97d19070 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -14,6 +14,7 @@ ansible_forgejo_user_pass: "{{ lookup('viczem.keepass.keepass', 'user_setup_forg
 ### patrickjahns.promtail
 promtail_version: "3.0.0" # TODO renovate
 promtail_loki_server_url: "http://docker10.mgrote.net:3100" # TODO passt das für blocky?
+promtail_user_additional_groups: root
 promtail_config_scrape_configs:
   - job_name: system
     static_configs: