Logging framework: logfmt events in our scripts, container labels + rotated json-file logs, Caddy JSON access logs; LOGGING.md

Store-agnostic: journald + Docker logs are the only taps any collector (Alloy/Loki, VictoriaLogs, Netdata) needs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

configure.py

@@ -133,6 +133,20 @@ def ask_name(kind, taken):
         return n
 
 # ------------------------------------------------------------------ writers
+# Access log per site, JSON on stderr (docker logs). Identity headers Authentik injected are kept (who did what);
+# cookies and tokens are dropped. See LOGGING.md.
+CADDY_LOG = """	log {
+		output stderr
+		format filter {
+			wrap json
+			fields {
+				request>headers>Cookie delete
+				request>headers>Authorization delete
+				request>headers>X-Stream-Auth delete
+			}
+		}
+	}
+"""
 AUTHENTIK_FORWARD_AUTH = """	# /logout on every gated host = sign out of the Discord login (domain-wide session)
 	redir /logout /outpost.goauthentik.io/sign_out 302
 	# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
@@ -148,7 +162,7 @@ AUTHENTIK_FORWARD_AUTH = """	# /logout on every gated host = sign out of the Dis
 
 def gate(required_group=""):
     """Caddy lines: Authentik forward-auth, then deny unless X-Authentik-Groups contains required_group."""
-    block = AUTHENTIK_FORWARD_AUTH
+    block = CADDY_LOG + AUTHENTIK_FORWARD_AUTH
     if required_group:
         g = re.escape(required_group)
         block += f"""	@lacks_group not header_regexp X-Authentik-Groups (^|\\|){g}(\\||$)
@@ -270,7 +284,7 @@ groups: {{http.request.header.X-Authentik-Groups}}"
 # vanguard:git
 {git_host} {{
 	encode zstd gzip
-	reverse_proxy 127.0.0.1:3000
+{CADDY_LOG}	reverse_proxy 127.0.0.1:3000
 }}
 """
     if auth_host:
@@ -278,7 +292,7 @@ groups: {{http.request.header.X-Authentik-Groups}}"
 # vanguard:auth
 {auth_host} {{
 	encode zstd gzip
-	reverse_proxy 127.0.0.1:9000
+{CADDY_LOG}	reverse_proxy 127.0.0.1:9000
 }}
 """
     if watch_host:
@@ -286,7 +300,7 @@ groups: {{http.request.header.X-Authentik-Groups}}"
 # vanguard:watch
 {watch_host} {{
 	encode zstd gzip
-	reverse_proxy 127.0.0.1:8096
+{CADDY_LOG}	reverse_proxy 127.0.0.1:8096
 }}
 """
     Path("Caddyfile").write_text(f"""# vanguard:main