Keep proxy failure telemetry without sensitive request URLs

gateway-admin-cert.service

@@ -2,4 +2,5 @@
 Description=Renew only the two gateway administration host certificates
 [Service]
 Type=oneshot
+TimeoutStartSec=15min
 ExecStart=/bin/sh /opt/gateway-admin-proxy/provision/renew-gateway-admin.sh

render.py

@@ -9,6 +9,20 @@ import re
 CA = '/etc/ssl/certs/ca-certificates.crt'
 ACME = '/var/lib/gateway-admin-proxy/acme'
 CF_TRUST = '/etc/nginx/white-proxy-cloudflare-realip.conf'
+HEALTH_MAP = '''log_format gateway_admin_proxy_health '$time_iso8601 host=$host status=$status upstream_status=$upstream_status duration=$request_time';
+map $status $gateway_admin_proxy_log_failure {
+    ~^[45] 1;
+    default 0;
+}
+'''
+
+
+def private_logs():
+    # Nginx error lines include the entire request URI, including subscription tokens.
+    # Keep critical diagnostics plus status-only failure records for these new vhosts.
+    return '''    access_log /var/log/nginx/gateway-admin-proxy.health.log gateway_admin_proxy_health if=$gateway_admin_proxy_log_failure;
+    error_log /var/log/nginx/gateway-admin-proxy.error.log crit;
+'''
 
 
 def proxy_lines(upstream, tls_name, host, alias=None):
@@ -48,7 +62,7 @@ def http_server(names, redirect=True):
     listen 80;
     listen [::]:80;
     server_name {names};
-    access_log off;
+{private_logs()}
     location ^~ /.well-known/acme-challenge/ {{
         root {ACME};
         try_files $uri =404;
@@ -95,15 +109,14 @@ def https_server(names, certificate, content, cloudflare=False, white_ip=None, k
     ssl_certificate_key {certificate}/{key_name};
     ssl_protocols TLSv1.2 TLSv1.3;
     client_max_body_size 20m;
-    access_log off;
-    error_log /var/log/nginx/gateway-admin-proxy.error.log warn;
+{private_logs()}
 {trusted}{content}
 }}
 '''
 
 
 def render_gateway(stage, legacy_path, white_ip):
-    files = {'00-gateway-admin-proxy-maps.conf': '''map $http_upgrade $gateway_admin_proxy_connection {
+    files = {'00-gateway-admin-proxy-maps.conf': HEALTH_MAP + '''map $http_upgrade $gateway_admin_proxy_connection {
     default upgrade;
     '' close;
 }
@@ -133,7 +146,7 @@ def render_gateway(stage, legacy_path, white_ip):
 
 def render_white(stage, legacy_certificate, skip_legacy=False):
     files = {}
-    maps = '''map $http_upgrade $gateway_admin_proxy_connection {
+    maps = HEALTH_MAP + '''map $http_upgrade $gateway_admin_proxy_connection {
     default upgrade;
     '' close;
 }

renew-gateway-admin.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 set -eu
 umask 077
-exec certbot renew --quiet \
+exec certbot renew --quiet --no-random-sleep-on-renew \
   --config-dir /etc/gateway-admin-letsencrypt \
   --work-dir /var/lib/gateway-admin-proxy/certbot \
   --logs-dir /var/log/gateway-admin-certbot \

renew-white-legacy.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 set -eu
 umask 077
-exec certbot renew --quiet \
+exec certbot renew --quiet --no-random-sleep-on-renew \
   --config-dir /etc/white-proxy-letsencrypt \
   --work-dir /var/lib/white-proxy-certbot \
   --logs-dir /var/log/white-proxy-certbot \

white-proxy-cert.service

@@ -2,4 +2,5 @@
 Description=Renew isolated public wildcard certificate for legacy white proxy
 [Service]
 Type=oneshot
+TimeoutStartSec=30min
 ExecStart=/bin/sh /opt/gateway-admin-proxy/provision/renew-white-legacy.sh