From c4f9421f729d49d33dee5226554d1bbb7f506c64 Mon Sep 17 00:00:00 2001
From: f <f@sutty.nl>
Date: Tue, 25 Aug 2026 17:19:08 +0000
Subject: [PATCH] feat: access logs (#126)

<!--
Thank you for doing recipe maintenance work!
Please mark all checklist items which are relevant for your changes.
Please remove the checklist items which are not relevant for your changes.
Feel free to remove this comment.
-->

* [x] I have deployed and tested my changes
* [ ] I have [updated relevant versions in `abra.sh`](https://docs.coopcloud.tech/maintainers/upgrade/#updating-versions-in-the-abrash)
* [x] I have made my environment variable changes [backwards compatible](https://docs.coopcloud.tech/maintainers/upgrade/#backwards-compatible-environment-variable-changes)
* [ ] I have added a [release note entry](https://docs.coopcloud.tech/maintainers/upgrade/#creating-new-release-notes)

Reviewed-on: https://git.coopcloud.tech/coop-cloud/traefik/pulls/126
Reviewed-by: p4u1 <133+p4u1@noreply.git.coopcloud.tech>
Co-authored-by: f <f@sutty.nl>
---
 .env.sample            |  3 +++
 README.md              | 16 ++++++++++++++++
 abra.sh                |  2 +-
 compose.access-log.yml | 10 ++++++++++
 traefik.yml.tmpl       | 15 +++++++++++++++
 5 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 compose.access-log.yml

diff --git a/.env.sample b/.env.sample
index 046c2ad..81015a7 100644
--- a/.env.sample
+++ b/.env.sample
@@ -232,3 +232,6 @@ WRITE_TIMEOUT=0s
 
 ## Enable onion service support
 #ONION_ENABLED=1
+
+## Access logs
+#COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"
diff --git a/README.md b/README.md
index 6e141b9..2fdc351 100644
--- a/README.md
+++ b/README.md
@@ -80,3 +80,19 @@ If you want to collect Prometheus metrics for Anubis, for instance with
 Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).
 
 [`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
+
+## Access logs
+
+To keep access logs on a volume, uncomment the "Access logs" section.
+
+You'll need to setup rotation yourself and send the USR1 signal to
+Traefik for reloading.  For instance, with `logrotate:
+
+```
+# /etc/logrotate.d/traefik.conf
+/var/lib/docker/volumes/traefik_SERVICE_NAME_access-logs/_data/access_log.jsonl {
+  postrotate
+    pkill -USR1 traefik
+  endscript
+}
+```
diff --git a/abra.sh b/abra.sh
index 8c8cb8d..8abc11d 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v32
+export TRAEFIK_YML_VERSION=v33
 export FILE_PROVIDER_YML_VERSION=v12
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1
diff --git a/compose.access-log.yml b/compose.access-log.yml
new file mode 100644
index 0000000..23480ec
--- /dev/null
+++ b/compose.access-log.yml
@@ -0,0 +1,10 @@
+---
+version: "3.8"
+services:
+  app:
+    environment:
+      ACCESS_LOG_ENABLED: "true"
+    volumes:
+      - "access-logs:/var/log/"
+volumes:
+  access-logs:
diff --git a/traefik.yml.tmpl b/traefik.yml.tmpl
index 28277b9..3c4a175 100644
--- a/traefik.yml.tmpl
+++ b/traefik.yml.tmpl
@@ -6,6 +6,21 @@ log:
   level: {{ env "LOG_LEVEL" }}
   maxAge: {{ env "LOG_MAX_AGE" }}
 
+{{ if eq (env "ACCESS_LOG_ENABLED") "true" }}
+accessLog:
+  format: "json"
+  filePath: "/var/log/access_log.jsonl"
+  fields:
+    defaultMode: "keep"
+    headers:
+      defaultMode: "keep"
+      names:
+        Authorization: "drop"
+        Cookie: "drop"
+    queryParameters:
+      defaultMode: "keep"
+{{ end }}
+
 providers:
   swarm:
     endpoint: "tcp://socket-proxy:2375"