From a2df13569394034cdd1b61c39cd2b3c306ac5563 Mon Sep 17 00:00:00 2001
From: Bot <bots@bryanmail.net>
Date: Sat, 12 Sep 2026 00:20:56 -0700
Subject: [PATCH] traefik: fix corrupted logrotate config (was double
 base64-encoded)

---
 traefik/logrotate/traefik-logs.conf | 44 ++++++++++++++++++++++++++++-
 1 file changed, 43 insertions(+), 1 deletion(-)

diff --git a/traefik/logrotate/traefik-logs.conf b/traefik/logrotate/traefik-logs.conf
index ac6add8..feb80e5 100644
--- a/traefik/logrotate/traefik-logs.conf
+++ b/traefik/logrotate/traefik-logs.conf
@@ -1 +1,43 @@
-IyBUcmFlZmlrIGFjY2Vzcy9lcnJvciBsb2cgcm90YXRpb24KIwojIENPTlRFWFQ6IHRyYWVmaWtfcmV2ZXJzZS1wcm94eSBydW5zIGluIFN3YXJtIGBtb2RlOiBnbG9iYWxgICh0cmFlZmlrLnlhbWwpLAojIG1lYW5pbmcgb25lIGluc3RhbmNlIHJ1bnMgb24gRUFDSCBvZiBkb2NrZXItMS9kb2NrZXItMi9kb2NrZXItMy4gQWxsIHRocmVlCiMgd3JpdGUgdG8gdGhlIFNBTUUgcGh5c2ljYWwgZmlsZSB2aWEgdGhlIHNoYXJlZCBDZXBoRlMgYmluZCBtb3VudAojIC92b2x1bWUxL2RvY2tlci90cmFlZmlrL2xvZ3MgLT4gL3RyYWVmaWsvbG9ncyAoaWRlbnRpY2FsIHBhdGggZnJvbSBhbnkgbm9kZSAtLQojIHNlZSBpbmZyYSBjb250ZXh0OiAvdm9sdW1lMS9kb2NrZXIgaXMgYSBzaGFyZWQgQ2VwaEZTIG1vdW50KS4KIwojIGBjb3B5dHJ1bmNhdGVgIGlzIFJFUVVJUkVEIGhlcmUgKG5vdCB0aGUgZGVmYXVsdCBjcmVhdGUrc2lnbmFsIGFwcHJvYWNoKToKIyBUcmFlZmlrIGhhcyBubyBTSUdVU1IxL1NJR0hVUCAicmVvcGVuIGxvZyBmaWxlIiBoYW5kbGluZywgYW5kIGV2ZW4gaWYgaXQKIyBkaWQsIGNvb3JkaW5hdGluZyBhIHJlb3BlbiBzaWduYWwgYWNyb3NzIDMgaW5kZXBlbmRlbnQgcGVyLW5vZGUgY29udGFpbmVycwojIHdyaXRpbmcgdG8gb25lIHNoYXJlZCBpbm9kZSBpcyB1bm5lY2Vzc2FyeSBjb21wbGV4aXR5LiBjb3B5dHJ1bmNhdGUga2VlcHMKIyBldmVyeSB3cml0ZXIncyBleGlzdGluZyBmaWxlIGRlc2NyaXB0b3IgdmFsaWQgKHRydW5jYXRlcyBpbiBwbGFjZSkgc28gYWxsCiMgdGhyZWUgVHJhZWZpayBwcm9jZXNzZXMga2VlcCBhcHBlbmRpbmcgdG8gdGhlIHNhbWUgaW5vZGUgd2l0aCB6ZXJvCiMgc2lnbmFsaW5nLiBUcmFkZW9mZjogYSBoYW5kZnVsIG9mIGxvZyBsaW5lcyB3cml0dGVuIGluIHRoZSBleGFjdAojIGNvcHkvdHJ1bmNhdGUgaW5zdGFudCBjYW4gYmUgbG9zdCAtLSBhY2NlcHRhYmxlIGZvciBkaWFnbm9zdGljIGFjY2Vzcy9lcnJvcgojIGxvZ3MsIG5vdCB1c2VkIGZvciBhbnl0aGluZyB0cmFuc2FjdGlvbmFsLgojCiMgU2l6ZS10cmlnZ2VyZWQgKG5vdCBjYWxlbmRhci10cmlnZ2VyZWQpIG9uIHB1cnBvc2U6IHRoaXMgZmlsZSBjYW4gZ3JvdyBmYXN0CiMgdW5kZXIgYnVyc3RzIChzZWUgaW5jaWRlbnQgdGhhdCBwcm9tcHRlZCB0aGlzIC0tIDE1LjVHQiBhY2N1bXVsYXRlZCB3aXRoCiMgLS1sb2cubGV2ZWw9REVCVUcgc2V0KS4gYHNpemVgIGlzIGNoZWNrZWQgZXZlcnkgdGltZSB0aGUgd3JhcHBlciBzY3JpcHQgcnVucwojIChjcm9uLCBldmVyeSAxNSBtaW51dGVzIC0tIHNlZSBpbnN0YWxsLnNoKSwgc28gaXQgY2Fubm90IGJhbGxvb24gdW5ib3VuZGVkCiMgYmV0d2VlbiBjaGVja3MgdGhlIHdheSBhIHBsYWluIGBkYWlseWAgaW50ZXJ2YWwgd291bGQuCiMKIyBJbnN0YWxsZWQgdmlhIGluc3RhbGwuc2ggb24gQUxMIFRIUkVFIGRvY2tlciBMWENzIChkb2NrZXItMSwgZG9ja2VyLTIsCiMgZG9ja2VyLTMpIC0tIHNlZSBSRUFETUUubWQuIFRoaXMgaXMgYSBIT1NULWxldmVsIGNyb24vbG9ncm90YXRlIGNvbmZpZywKIyBvdXRzaWRlIHRoZSBXb29kcGVja2VyL3N0YWNrLWRlcGxveS5zaCBwaXBlbGluZSAoZG9ja2VyIHN0YWNrIGRlcGxveSBoYXMgbm8KIyBtZWNoYW5pc20gdG8gdG91Y2ggaG9zdCBjcm9uKSwgc28gaXQgbXVzdCBiZSBhcHBsaWVkIG1hbnVhbGx5IG9uY2UgcGVyIG5vZGUsCiMgbm90IHZpYSBhIHN0YWNrIHJlZGVwbG95LgoKL3ZvbHVtZTEvZG9ja2VyL3RyYWVmaWsvbG9ncy8qLmxvZyB7CiAgICBzaXplIDI1ME0KICAgIHJvdGF0ZSA0OAogICAgbWF4YWdlIDE0CiAgICBjb21wcmVzcwogICAgZGVsYXljb21wcmVzcwogICAgbWlzc2luZ29rCiAgICBub3RpZmVtcHR5CiAgICBjb3B5dHJ1bmNhdGUKICAgIGRhdGVleHQKICAgIGRhdGVmb3JtYXQgLSVZJW0lZC0lSCVNJVMKICAgIHN1IHJvb3Qgcm9vdAp9Cg==
\ No newline at end of file
+# Traefik access/error log rotation
+#
+# CONTEXT: traefik_reverse-proxy runs in Swarm `mode: global` (traefik.yaml),
+# meaning one instance runs on EACH of docker-1/docker-2/docker-3. All three
+# write to the SAME physical file via the shared CephFS bind mount
+# /volume1/docker/traefik/logs -> /traefik (identical path from any node --
+# see infra context: /volume1/docker is a shared CephFS mount).
+#
+# `copytruncate` is REQUIRED here (not the default create+signal approach):
+# Traefik has no SIGUSR1/SIGHUP "reopen log file" handling, and even if it
+# did, coordinating a reopen signal across 3 independent per-node containers
+# writing to one shared inode is unnecessary complexity. copytruncate keeps
+# every writer's existing file descriptor valid (truncates in place) so all
+# three Traefik processes keep appending to the same inode with zero
+# signaling. Tradeoff: a handful of log lines written in the exact
+# copy/truncate instant can be lost -- acceptable for diagnostic access/error
+# logs, not used for anything transactional.
+#
+# Size-triggered (not calendar-triggered) on purpose: this file can grow fast
+# under bursts (see incident that prompted this -- 15.5GB accumulated with
+# --log.level=DEBUG set). `size` is checked every time the wrapper script runs
+# (cron, every 15 minutes -- see install.sh), so it cannot balloon unbounded
+# between checks the way a plain `daily` interval would.
+#
+# Installed via install.sh on ALL THREE docker LXCs (docker-1, docker-2,
+# docker-3) -- see README.md. This is a HOST-level cron/logrotate config,
+# outside the Woodpecker/stack-deploy.sh pipeline (docker stack deploy has no
+# mechanism to touch host cron), so it must be applied manually once per node,
+# not via a stack redeploy.
+
+/volume1/docker/traefik/logs/*.log {
+    size 250M
+    rotate 48
+    maxage 14
+    compress
+    delaycompress
+    missingok
+    notifempty
+    copytruncate
+    dateext
+    dateformat -%Y%m%d-%H%M%S
+    su root root
+}