Logging framework: logfmt events in our scripts, container labels + rotated json-file logs, Caddy JSON access logs; LOGGING.md

Store-agnostic: journald + Docker logs are the only taps any collector (Alloy/Loki, VictoriaLogs, Netdata) needs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docker-compose.yml

@@ -1,5 +1,13 @@
+# Log framework (LOGGING.md): every container keeps rotated json-file logs and carries labels a collector can use as
+# low-cardinality stream labels without parsing: vanguard.service / vanguard.category.
+x-logging: &vglog
+  driver: json-file
+  options: { max-size: "50m", max-file: "5" }
+
 services:
   mediamtx:
+    logging: *vglog
+    labels: { vanguard.service: mediamtx, vanguard.category: stream }
     image: bluenviron/mediamtx:latest-ffmpeg     # alpine variant: has sh + wget for the is-live Discord hook
     container_name: mediamtx
     user: "1000:1000"             # recordings owned by the debian user, so the archive pull can delete them
@@ -22,6 +30,8 @@ services:
     restart: unless-stopped
 
   copyparty:
+    logging: *vglog
+    labels: { vanguard.service: copyparty, vanguard.category: media }
     image: copyparty/ac:latest
     container_name: copyparty
     ports:
@@ -33,6 +43,8 @@ services:
     restart: unless-stopped
 
   syncthing:
+    logging: *vglog
+    labels: { vanguard.service: syncthing, vanguard.category: intake }
     image: syncthing/syncthing:latest
     container_name: syncthing
     environment:
@@ -48,6 +60,8 @@ services:
     restart: unless-stopped
 
   caddy:
+    logging: *vglog
+    labels: { vanguard.service: caddy, vanguard.category: auth }
     image: caddy:latest
     container_name: caddy
     depends_on: [copyparty]
@@ -64,6 +78,8 @@ services:
 
   # ---------------------------------------------------------------- identity (Authentik)
   authentik-db:
+    logging: *vglog
+    labels: { vanguard.service: authentik-db, vanguard.category: auth }
     image: docker.io/library/postgres:16-alpine
     container_name: authentik-db
     environment:
@@ -81,6 +97,8 @@ services:
     restart: unless-stopped
 
   authentik-redis:
+    logging: *vglog
+    labels: { vanguard.service: authentik-redis, vanguard.category: auth }
     image: docker.io/library/redis:alpine
     container_name: authentik-redis
     command: --save 60 1 --loglevel warning
@@ -94,6 +112,8 @@ services:
     restart: unless-stopped
 
   authentik-server:
+    logging: *vglog
+    labels: { vanguard.service: authentik-server, vanguard.category: auth }
     image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2025.8}
     container_name: authentik-server
     command: server
@@ -118,6 +138,8 @@ services:
     restart: unless-stopped
 
   authentik-worker:
+    logging: *vglog
+    labels: { vanguard.service: authentik-worker, vanguard.category: auth }
     image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2025.8}
     container_name: authentik-worker
     command: worker
@@ -133,6 +155,8 @@ services:
 
   # ---------------------------------------------------------------- watching (Jellyfin, direct play only)
   jellyfin:
+    logging: *vglog
+    labels: { vanguard.service: jellyfin, vanguard.category: media }
     image: jellyfin/jellyfin:latest
     container_name: jellyfin
     user: "1000:1000"
@@ -150,6 +174,8 @@ services:
 
   # ---------------------------------------------------------------- database (for the Discord bot and friends)
   mariadb:
+    logging: *vglog
+    labels: { vanguard.service: mariadb, vanguard.category: infra }
     image: mariadb:11
     container_name: mariadb
     network_mode: host              # PUBLIC on 3306: host networking so the nftables input rules (db_allow / rate
@@ -174,6 +200,8 @@ services:
 
   # ---------------------------------------------------------------- Discord bot (python; code lives in ./bot/app)
   discord-bot:
+    logging: *vglog
+    labels: { vanguard.service: discord-bot, vanguard.category: bot }
     build: ./bot
     container_name: discord-bot
     user: "1000:1000"
@@ -208,6 +236,8 @@ services:
 
   # ---------------------------------------------------------------- Gitea + Actions runner
   gitea:
+    logging: *vglog
+    labels: { vanguard.service: gitea, vanguard.category: code }
     image: docker.gitea.com/gitea:1.24
     container_name: gitea
     environment:
@@ -253,6 +283,8 @@ services:
     restart: unless-stopped
 
   act_runner:
+    logging: *vglog
+    labels: { vanguard.service: act_runner, vanguard.category: deploy }
     image: docker.gitea.com/act_runner:latest
     container_name: act_runner
     environment: