doc: log rotation

.env.sample

@@ -159,10 +159,6 @@ WRITE_TIMEOUT=0s
 #COMPOSE_FILE="$COMPOSE_FILE:compose.smtp.yml"
 #SMTP_ENABLED=1
 
-## PGSQL recipe open port 5432
-#COMPOSE_FILE="$COMPOSE_FILE:compose.pgsql.yml"
-#PGSQL_ENABLED=1
-
 ## Compy
 #COMPOSE_FILE="$COMPOSE_FILE:compose.compy.yml"
 #COMPY_ENABLED=1
@@ -227,8 +223,8 @@ WRITE_TIMEOUT=0s
 #ANUBIS_SERVE_ROBOTS_TXT=true
 #ANUBIS_SLOG_LEVEL=INFO
 
-## Anubis metrics
-#COMPOSE_FILE="$COMPOSE_FILE:compose.anubis-metrics.yml"
-
 ## Enable onion service support
 #ONION_ENABLED=1
+
+## Access logs
+#COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"

README.md

@@ -5,7 +5,7 @@
 > https://docs.traefik.io
 
 <!-- metadata -->
-* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@javielico](https://git.coopcloud.tech/javielico), Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla)
+* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@decentral1se](https://git.coopcloud.tech/decentral1se), [@javielico](https://git.coopcloud.tech/javielico), Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla)
 * **Status**: `stable`
 * **Category**: Utilities
 * **Features**: ?
@@ -72,11 +72,24 @@ After deploying these changes, go to each recipe that supports Anubis
 and follow the process there.  **Enabling Anubis here is not enough for
 protection your apps.**
 
-If you want to collect Prometheus metrics for Anubis, for instance with
-[monitoring-ng](/monitoring-ng), uncomment the "Anubis metrics" section.
-
 ## Enabling onion service
 
 Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).
 
 [`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
+
+## Access logs
+
+To keep access logs on a volume, uncomment the "Access logs" section.
+
+You'll need to setup rotation yourself and send the USR1 signal to
+Traefik for reloading.  For instance, with `logrotate:
+
+```
+# /etc/logrotate.d/traefik.conf
+/var/lib/docker/volumes/traefik_SERVICE_NAME_access-logs/_data/access_log.jsonl {
+  postrotate
+    pkill -USR1 traefik
+  endscript
+}
+```

abra.sh

@@ -1,4 +1,3 @@
-export TRAEFIK_YML_VERSION=v32
+export TRAEFIK_YML_VERSION=v33
 export FILE_PROVIDER_YML_VERSION=v12
 export ENTRYPOINT_VERSION=v5
-export ANUBIS_YML_VERSION=v1

anubis.yml.tmpl

@@ -1,7 +0,0 @@
-bots:
-- import: (data)/meta/default-config.yaml
-{{ if eq (env "ANUBIS_METRICS_ENABLED") "true" }}
-metrics:
-  bind: ":9090"
-  network: "tcp"
-{{ end }}

compose.access-log.yml

@@ -0,0 +1,10 @@
+---
+version: "3.8"
+services:
+  app:
+    environment:
+      ACCESS_LOG_ENABLED: "true"
+    volumes:
+      - "access-logs:/var/log/"
+volumes:
+  access-logs:

compose.anubis-metrics.yml

@@ -1,11 +0,0 @@
----
-version: "3.8"
-services:
-  anubis:
-    environment:
-      ANUBIS_METRICS_ENABLED: "true"
-    deploy:
-      labels:
-      - "prometheus.io/scrape=true"
-      - "prometheus.io/port=9090"
-      - "prometheus.io/path=/metrics"

compose.anubis.yml

@@ -7,7 +7,7 @@ services:
       - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check"
       - "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true"
   anubis:
-    image: "ghcr.io/techarohq/anubis:v1.27.0"
+    image: "ghcr.io/techarohq/anubis:v1.26.2"
     environment:
       BIND: ":8080"
       TARGET: " "
@@ -19,10 +19,6 @@ services:
       OG_CACHE_CONSIDER_HOST: "${ANUBIS_OG_CACHE_CONSIDER_HOST}"
       SERVE_ROBOTS_TXT: "${ANUBIS_SERVE_ROBOTS_TXT}"
       SLOG_LEVEL: "${ANUBIS_SLOG_LEVEL:-INFO}"
-      POLICY_FNAME: "/data/cfg/botPolicy.yaml"
-    configs:
-    - source: anubis_yml
-      target: /data/cfg/botPolicy.yaml
     networks:
     - proxy
     deploy:
@@ -33,8 +29,3 @@ services:
       - "traefik.http.routers.anubis.entrypoints=web-secure"
       - "traefik.http.services.anubis.loadbalancer.server.port=8080"
       - "traefik.http.routers.anubis.service=anubis"
-configs:
-  anubis_yml:
-    name: ${STACK_NAME}_anubis_yml_${ANUBIS_YML_VERSION}
-    file: anubis.yml.tmpl
-    template_driver: golang

compose.pgsql.yml

@@ -1,12 +0,0 @@
----
-version: "3.8"
-
-services:
-  app:
-    environment:
-      - PGSQL_ENABLED
-    ports:
-      - target: 5432
-        published: 5432
-        protocol: tcp
-        mode: host

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "traefik:v3.7.10"
+    image: "traefik:v3.7.9"
     # Note(decentral1se): *please do not* add any additional ports here.
     # Doing so could break new installs with port conflicts. Please use
     # the usual `compose.$app.yml` approach for any additional ports
@@ -62,7 +62,7 @@ services:
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.4.3
+    image: lscr.io/linuxserver/socket-proxy:3.4.2
     deploy:
       endpoint_mode: dnsrr
     environment:

traefik.yml.tmpl

@@ -6,6 +6,21 @@ log:
   level: {{ env "LOG_LEVEL" }}
   maxAge: {{ env "LOG_MAX_AGE" }}
 
+{{ if eq (env "ACCESS_LOG_ENABLED") "true" }}
+accessLog:
+  format: "json"
+  filePath: "/var/log/access_log.jsonl"
+  fields:
+    defaultMode: "keep"
+    headers:
+      defaultMode: "keep"
+      names:
+        Authorization: "drop"
+        Cookie: "drop"
+    queryParameters:
+      defaultMode: "keep"
+{{ end }}
+
 providers:
   swarm:
     endpoint: "tcp://socket-proxy:2375"