Pim van Pelt
143aad9063
Build and release tooling:
- Makefile with help as default; targets: build/build-amd64/build-arm64,
test, lint, proto, pkg-deb, docker, docker-push, clean, plus
install-deps (+ three sub-targets for apt / Go toolchain / Go tools).
- internal/version package; -ldflags -X injects Version/Commit/Date into
every binary. -version flag on all four binaries (nginx-logtail version
for the CLI).
- Dockerfile takes VERSION/COMMIT/DATE build-args and forwards them.
- .deb output lands in build/; .gitignore ignores /build/.
Debian package:
- debian/build-deb.sh packages all four static binaries into a single
nginx-logtail_<ver>_<arch>.deb using dpkg-deb.
- Binary layout: /usr/sbin/nginx-logtail-{collector,aggregator,frontend}
and /usr/bin/nginx-logtail.
- nginx-logtail(8) manpage.
- Three systemd units (collector, aggregator, frontend) shipped under
/lib/systemd/system/. Installed but never enabled or started — the
operator opts in per host.
- Collector runs as _logtail:www-data (log access); aggregator and
frontend as _logtail:_logtail. postinst creates the system user/group
idempotently.
- Single shared env file /etc/default/nginx-logtail rendered from a
template at first install with %HOSTNAME% substituted. Sensible
defaults for every COLLECTOR_*, AGGREGATOR_*, FRONTEND_* variable;
plus COLLECTOR_ARGS / AGGREGATOR_ARGS / FRONTEND_ARGS escape hatches
appended to ExecStart. Not a dpkg conffile: operator edits survive
upgrades and dpkg --purge removes it.
Versioned UDP wire format:
- ParseUDPLine dispatches on a leading "v<N>\t" tag; v1 routes to the
existing 12-field parser. Unknown/missing versions fail closed so
future v2 parsers can land before emitters are upgraded.
- Tests updated; design.md FR-2.2 rewritten to make the version tag
normative.
Docs:
- README.md gains a Quick Start (Debian / Docker Compose / from source).
- user-guide.md rewritten around Installation and Configuration: full
env-var table, UDP-only default explained, precise file/UDP log_format
layouts, note that operators can emit "0" for unknown \$is_tor / \$asn.
- Drilldown cycle, frontend filter table, and CLI --group-by list all
include source_tag. UDP counters documented in the Prometheus section.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
98 lines
3.7 KiB
Plaintext
98 lines
3.7 KiB
Plaintext
# /etc/default/nginx-logtail
|
|
#
|
|
# Shared configuration for the nginx-logtail collector, aggregator, and
|
|
# frontend systemd units. Every flag that every binary accepts has a
|
|
# matching environment variable (COLLECTOR_*, AGGREGATOR_*, FRONTEND_*);
|
|
# the units start their binary with no explicit arguments beyond the
|
|
# optional *_ARGS escape hatch, so everything is driven from here.
|
|
#
|
|
# This file is generated by nginx-logtail's postinst on first install
|
|
# (hostname substituted) and is NOT a dpkg conffile. Operator edits are
|
|
# preserved across upgrades. `dpkg --purge nginx-logtail` removes it.
|
|
|
|
# ==========================================================================
|
|
# Collector (nginx-logtail-collector.service)
|
|
# ==========================================================================
|
|
|
|
# gRPC listen address for TopN/Trend queries and the aggregator's
|
|
# StreamSnapshots subscription.
|
|
COLLECTOR_LISTEN=:9090
|
|
|
|
# Prometheus /metrics listen address. Set to "" to disable the endpoint.
|
|
COLLECTOR_PROM_LISTEN=:9100
|
|
|
|
# Comma-separated log file paths or glob patterns to tail. At least one of
|
|
# COLLECTOR_LOGS, COLLECTOR_LOGS_FILE, or COLLECTOR_LOGTAIL_PORT must be set,
|
|
# otherwise the collector refuses to start. Leave empty to run UDP-only (no
|
|
# file tailer goroutine is started when no patterns are supplied).
|
|
COLLECTOR_LOGS=
|
|
|
|
# Alternative to COLLECTOR_LOGS: a file listing one path/glob per line.
|
|
# Lines starting with # are ignored.
|
|
COLLECTOR_LOGS_FILE=
|
|
|
|
# Name for this collector in query responses, ListTargets, and snapshot
|
|
# streams. Defaults to the short hostname at install time.
|
|
COLLECTOR_SOURCE=%HOSTNAME%
|
|
|
|
# IPv4 prefix length for client address bucketing (CIDR). /24 groups a
|
|
# class-C worth of clients into one key.
|
|
COLLECTOR_V4PREFIX=24
|
|
|
|
# IPv6 prefix length. /48 matches the typical residential allocation.
|
|
COLLECTOR_V6PREFIX=48
|
|
|
|
# How often to rescan COLLECTOR_LOGS globs for new/removed files.
|
|
COLLECTOR_SCAN_INTERVAL=10s
|
|
|
|
# UDP port that receives ipng_stats_logtail datagrams from the companion
|
|
# nginx-ipng-stats-plugin. Set to 0 to disable the UDP listener entirely.
|
|
COLLECTOR_LOGTAIL_PORT=9514
|
|
|
|
# UDP bind address. Keep as 127.0.0.1 unless the plugin emits from a
|
|
# different host; the listener has no authentication.
|
|
COLLECTOR_LOGTAIL_BIND=127.0.0.1
|
|
|
|
# Extra arguments appended to the collector argv after the env-var-derived
|
|
# flags. Useful for flags without an env-var form, or temporary overrides.
|
|
COLLECTOR_ARGS=
|
|
|
|
# ==========================================================================
|
|
# Aggregator (nginx-logtail-aggregator.service)
|
|
# ==========================================================================
|
|
|
|
# gRPC listen address. Frontend and CLI point their --target at this.
|
|
AGGREGATOR_LISTEN=:9091
|
|
|
|
# Comma-separated host:port addresses of every collector this aggregator
|
|
# should subscribe to. Mandatory — aggregator refuses to start empty.
|
|
AGGREGATOR_COLLECTORS=localhost:9090
|
|
|
|
# Display name for this aggregator in query responses.
|
|
AGGREGATOR_SOURCE=%HOSTNAME%
|
|
|
|
# Extra arguments appended to the aggregator argv.
|
|
AGGREGATOR_ARGS=
|
|
|
|
# ==========================================================================
|
|
# Frontend (nginx-logtail-frontend.service)
|
|
# ==========================================================================
|
|
|
|
# HTTP listen address for the dashboard.
|
|
FRONTEND_LISTEN=:8080
|
|
|
|
# Default gRPC endpoint the dashboard queries. The aggregator by default;
|
|
# override with ?target=host:port per request, or change here to point
|
|
# directly at a collector.
|
|
FRONTEND_TARGET=localhost:9091
|
|
|
|
# Default number of table rows shown per view. Dashboard users can
|
|
# override with ?n=N on individual URLs.
|
|
FRONTEND_N=25
|
|
|
|
# Meta-refresh interval (seconds). Set 0 to disable auto-refresh.
|
|
FRONTEND_REFRESH=30
|
|
|
|
# Extra arguments appended to the frontend argv.
|
|
FRONTEND_ARGS=
|