doc: log rotation

.env.sample

@@ -226,5 +226,5 @@ WRITE_TIMEOUT=0s
 ## Enable onion service support
 #ONION_ENABLED=1
 
-# YAML array of trusted subnets
-TRUSTED_IPS=
+## Access logs
+#COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"

README.md

@@ -77,3 +77,19 @@ protection your apps.**
 Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).
 
 [`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
+
+## Access logs
+
+To keep access logs on a volume, uncomment the "Access logs" section.
+
+You'll need to setup rotation yourself and send the USR1 signal to
+Traefik for reloading.  For instance, with `logrotate:
+
+```
+# /etc/logrotate.d/traefik.conf
+/var/lib/docker/volumes/traefik_SERVICE_NAME_access-logs/_data/access_log.jsonl {
+  postrotate
+    pkill -USR1 traefik
+  endscript
+}
+```

abra.sh

@@ -1,3 +1,3 @@
-export TRAEFIK_YML_VERSION=v32a
+export TRAEFIK_YML_VERSION=v33
 export FILE_PROVIDER_YML_VERSION=v12
 export ENTRYPOINT_VERSION=v5

compose.access-log.yml

@@ -0,0 +1,10 @@
+---
+version: "3.8"
+services:
+  app:
+    environment:
+      ACCESS_LOG_ENABLED: "true"
+    volumes:
+      - "access-logs:/var/log/"
+volumes:
+  access-logs:

traefik.yml.tmpl

@@ -6,6 +6,21 @@ log:
   level: {{ env "LOG_LEVEL" }}
   maxAge: {{ env "LOG_MAX_AGE" }}
 
+{{ if eq (env "ACCESS_LOG_ENABLED") "true" }}
+accessLog:
+  format: "json"
+  filePath: "/var/log/access_log.jsonl"
+  fields:
+    defaultMode: "keep"
+    headers:
+      defaultMode: "keep"
+      names:
+        Authorization: "drop"
+        Cookie: "drop"
+    queryParameters:
+      defaultMode: "keep"
+{{ end }}
+
 providers:
   swarm:
     endpoint: "tcp://socket-proxy:2375"
@@ -33,10 +48,6 @@ entrypoints:
           to: web-secure
   web-secure:
     address: ":443"
-{{ if ne (env "TRUSTED_IPS") "" }}
-    forwardedHeaders:
-      trustedIPs: {{ env "TRUSTED_IPS" }}
-{{ end }}
     transport:
       respondingTimeouts:
         readTimeout: {{ env "READ_TIMEOUT" }}