From b4a38da20dd75022668c7812d66ecd7ec2ddae04 Mon Sep 17 00:00:00 2001
From: f <f@sutty.nl>
Date: Tue, 28 Jul 2026 14:19:49 -0300
Subject: [PATCH 1/4] feat: access logs

---
 .env.sample            |  3 +++
 abra.sh                |  2 +-
 compose.access-log.yml |  9 +++++++++
 traefik.yml.tmpl       | 17 +++++++++++++++++
 4 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 compose.access-log.yml

diff --git a/.env.sample b/.env.sample
index 9389641..6eb36bf 100644
--- a/.env.sample
+++ b/.env.sample
@@ -225,3 +225,6 @@ WRITE_TIMEOUT=0s
 
 ## Enable onion service support
 #ONION_ENABLED=1
+
+## Keep access logs
+#COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"
diff --git a/abra.sh b/abra.sh
index d5c01aa..202905e 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,3 +1,3 @@
-export TRAEFIK_YML_VERSION=v32
+export TRAEFIK_YML_VERSION=v33
 export FILE_PROVIDER_YML_VERSION=v12
 export ENTRYPOINT_VERSION=v5
diff --git a/compose.access-log.yml b/compose.access-log.yml
new file mode 100644
index 0000000..90e5d59
--- /dev/null
+++ b/compose.access-log.yml
@@ -0,0 +1,9 @@
+---
+services:
+  app:
+    environment:
+      ACCESS_LOG_ENABLED: "true"
+    volumes:
+      - "access-logs:/var/log/"
+volumes:
+  access-logs:
diff --git a/traefik.yml.tmpl b/traefik.yml.tmpl
index 28277b9..620d2c0 100644
--- a/traefik.yml.tmpl
+++ b/traefik.yml.tmpl
@@ -6,6 +6,23 @@ log:
   level: {{ env "LOG_LEVEL" }}
   maxAge: {{ env "LOG_MAX_AGE" }}
 
+{{ if eq (env "ACCESS_LOG_ENABLED") "true" }}
+accessLog:
+  format: "json"
+  filePath: "/var/log/access_log.jsonl"
+  filters:
+    retryAttempts: true
+  fields:
+    defaultMode: "keep"
+    headers:
+      defaultMode: "keep"
+      names:
+        Authorization: "drop"
+        Cookie: "drop"
+    queryParameters:
+      defaultMode: "keep"
+{{ end }}
+
 providers:
   swarm:
     endpoint: "tcp://socket-proxy:2375"
-- 
2.52.0


From ca914a5d9f39420eaeeada2e88c23735943de85f Mon Sep 17 00:00:00 2001
From: f <f@sutty.nl>
Date: Tue, 28 Jul 2026 14:51:59 -0300
Subject: [PATCH 2/4] fix: missing compose version

---
 compose.access-log.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/compose.access-log.yml b/compose.access-log.yml
index 90e5d59..23480ec 100644
--- a/compose.access-log.yml
+++ b/compose.access-log.yml
@@ -1,4 +1,5 @@
 ---
+version: "3.8"
 services:
   app:
     environment:
-- 
2.52.0


From a7f66744a4bd9e79408815c112c80ec804eeb2a2 Mon Sep 17 00:00:00 2001
From: f <f@sutty.nl>
Date: Tue, 28 Jul 2026 16:07:47 -0300
Subject: [PATCH 3/4] fix: don't filter

---
 traefik.yml.tmpl | 2 --
 1 file changed, 2 deletions(-)

diff --git a/traefik.yml.tmpl b/traefik.yml.tmpl
index 620d2c0..3c4a175 100644
--- a/traefik.yml.tmpl
+++ b/traefik.yml.tmpl
@@ -10,8 +10,6 @@ log:
 accessLog:
   format: "json"
   filePath: "/var/log/access_log.jsonl"
-  filters:
-    retryAttempts: true
   fields:
     defaultMode: "keep"
     headers:
-- 
2.52.0


From 68f07eff9bee88a3d634bfd5b085b77676cfcf5e Mon Sep 17 00:00:00 2001
From: f <f@sutty.nl>
Date: Fri, 31 Jul 2026 18:02:36 -0300
Subject: [PATCH 4/4] doc: log rotation

---
 .env.sample | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.env.sample b/.env.sample
index 6eb36bf..ee7b975 100644
--- a/.env.sample
+++ b/.env.sample
@@ -226,5 +226,7 @@ WRITE_TIMEOUT=0s
 ## Enable onion service support
 #ONION_ENABLED=1
 
-## Keep access logs
+## Keep access logs on a volume.
+# You'll need to setup rotation yourself and send the USR1 signal to
+# Traefik for reloading.
 #COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"
-- 
2.52.0