Exposing Loki to services outside a cluster

This sounds like an infrastructure question. Personally I’d recommend you to keep your entire Loki cluster internal, and use some sort of application load balancer or nginx setup on the edge with public IPs (and proper certificate of course).