# Traefik access/error log rotation
#
# CONTEXT: traefik_reverse-proxy runs in Swarm `mode: global` (traefik.yaml),
# meaning one instance runs on EACH of docker-1/docker-2/docker-3. All three
# write to the SAME physical file via the shared CephFS bind mount
# /volume1/docker/traefik/logs -> /traefik (identical path from any node --
# see infra context: /volume1/docker is a shared CephFS mount).
#
# `copytruncate` is REQUIRED here (not the default create+signal approach):
# Traefik has no SIGUSR1/SIGHUP "reopen log file" handling, and even if it
# did, coordinating a reopen signal across 3 independent per-node containers
# writing to one shared inode is unnecessary complexity. copytruncate keeps
# every writer's existing file descriptor valid (truncates in place) so all
# three Traefik processes keep appending to the same inode with zero
# signaling. Tradeoff: a handful of log lines written in the exact
# copy/truncate instant can be lost -- acceptable for diagnostic access/error
# logs, not used for anything transactional.
#
# Size-triggered (not calendar-triggered) on purpose: this file can grow fast
# under bursts (see incident that prompted this -- 15.5GB accumulated with
# --log.level=DEBUG set). `size` is checked every time the wrapper script runs
# (cron, every 15 minutes -- see install.sh), so it cannot balloon unbounded
# between checks the way a plain `daily` interval would.
#
# Installed via install.sh on ALL THREE docker LXCs (docker-1, docker-2,
# docker-3) -- see README.md. This is a HOST-level cron/logrotate config,
# outside the Woodpecker/stack-deploy.sh pipeline (docker stack deploy has no
# mechanism to touch host cron), so it must be applied manually once per node,
# not via a stack redeploy.

/volume1/docker/traefik/logs/*.log {
    size 250M
    rotate 48
    maxage 14
    compress
    delaycompress
    missingok
    notifempty
    copytruncate
    dateext
    dateformat -%Y%m%d-%H%M%S
    su root root
}