@@ -28,3 +28,3 @@
     '''
 
-    def __init__(self, url, dry_run):
+    def __init__(self, url, dry_run, tls_cert_file=None, tls_key_file=None):

@@ -77,6 +79,7 @@ class Loki_log_buffer:
                     'Content-Type': 'application/json',
                     'User-Agent': 'borgmatic',
                 },
+                cert=(self.tls_cert_file, self.tls_key_file) if self.tls_cert_file else None,

@@ -89,3 +92,3 @@
     '''
 
-    def __init__(self, url, send_logs, log_level, dry_run):
+    def __init__(self, url, send_logs, dry_run, tls_cert_file=None, tls_key_file=None):

@@ -140,3 +143,3 @@
     '''
     url = hook_config.get('url')
-    loki = Loki_log_handler(url, hook_config.get('send_logs', False), monitoring_log_level, dry_run)
+    tls = hook_config.get('tls', {}) or {}

@@ -92,0 +94,4 @@
+### Mutual TLS authentication
+
+<span class="minilink minilink-addedin">New in version **TBD**</span> If your
+Loki instance is configured for mTLS authentication, you can provide a client

@@ -92,0 +109,4 @@
+        key_file: /etc/borgmatic/loki-client.key
+```
+
+Both `cert_file` and `key_file` must be PEM-encoded. They are passed directly

@@ -92,0 +111,4 @@
+
+Both `cert_file` and `key_file` must be PEM-encoded. They are passed directly
+to the underlying HTTP client, so the standard mutual TLS handshake is
+performed for every request borgmatic sends to Loki.

@@ -142,1 +152,3 @@
-    loki = Loki_log_handler(url, hook_config.get('send_logs', False), monitoring_log_level, dry_run)
+    tls = hook_config.get('tls', {})
+
+    if bool(tls.get('cert_path')) != bool(tls.get('key_path')):

@@ -143,0 +157,4 @@
+        )
+        raise ValueError(
+            'Invalid Loki TLS configuration: cert_path and key_path must both be set or both be unset'
+        )

@@ -81,0 +124,4 @@
+    }
+
+    with pytest.raises(ValueError):
+        module.initialize_monitor(hook_config, {}, 'test.yaml', 1, False)