Merge pull request #220 from profullstack/codex/agentdb-caddy-access-log-20261031

dev2: log AgentDB access safely for ThreatCrush

Author: sh1pt-actions-fleet[bot]

dev2/dev2-edge

@@ -155,7 +155,16 @@ def caddy_site(site, s):
     if site.get("gzip"):
         lines.append("\tencode gzip")
     if site.get("access_log"):
-        lines += ["\tlog {", f"\t\toutput file /var/log/caddy/{site['hosts'][0]}.access.log", "\t}"]
+        lines += ["\tlog {", f"\t\toutput file /var/log/caddy/{site['hosts'][0]}.access.log"]
+        if site.get("sanitize_query"):
+            lines += [
+                "\t\tformat filter {",
+                '\t\t\trequest>uri regexp `\\?.*` ""',
+                "\t\t\trequest>headers delete",
+                "\t\t\tresp_headers delete",
+                "\t\t}",
+            ]
+        lines.append("\t}")
     if "proxy" in site and site.get("retry"):
         # While the app restarts (a deploy), hold the request and keep dialing instead of
         # answering 502: webhooks that drive live calls (Telnyx) must not fail mid-call.

dev2/edge/edge.json

@@ -18,6 +18,7 @@
     { "hosts": ["pit.world"], "proxy": 8787, "max_body": "1MiB" },
     { "hosts": ["www.pit.world"], "redirect": "https://pit.world{uri}" },
     { "hosts": ["ad.network.pit.world"], "proxy": 8800, "max_body": "1MiB", "gzip": true },
+    { "hosts": ["agent.database.pit.world"], "proxy": 18080, "max_body": "512KiB", "gzip": true, "access_log": true, "sanitize_query": true },
     { "hosts": ["group.call.pit.world"], "proxy": 8810, "max_body": "1MiB", "retry": "20s",
       "//": "group.call (moshcoder/group.call): no gzip, so the room page's server-sent events are not held back; retry holds Telnyx webhooks across a deploy instead of 502" },
     { "hosts": ["*.*.pit.world", "*.*.*.pit.world"], "proxy": 8787, "max_body": "30MiB", "gzip": true,

test/dev2-edge.test.ts

@@ -157,12 +157,18 @@ describe('dev2-edge render', () => {
       const head = site.hosts.map((h: string) => `https://${h}`).join(', ') + ' {';
       expect(caddy).toContain(head);
       const block = caddy.slice(caddy.indexOf(head), caddy.indexOf('\n}\n', caddy.indexOf(head)));
-      if (site.proxy) expect(block).toContain(`import edge_proxy ${site.proxy}`);
+      if (site.proxy && site.retry) expect(block).toContain(`reverse_proxy 127.0.0.1:${site.proxy}`);
+      else if (site.proxy) expect(block).toContain(`import edge_proxy ${site.proxy}`);
       if (site.root) expect(block).toContain(`root * ${site.root}`);
       if (site.redirect) expect(block).toContain(`redir ${site.redirect} 301`);
       if (site.max_body) expect(block).toContain(`max_size ${site.max_body}`);
       expect(block).toContain(site.moshpit ? 'import edge_tls_moshpit' : 'import edge_tls');
     }
+    const agentDb = caddy.slice(caddy.indexOf('https://agent.database.pit.world {'));
+    expect(agentDb).toContain('output file /var/log/caddy/agent.database.pit.world.access.log');
+    expect(agentDb).toContain('request>uri regexp `\\?.*` ""');
+    expect(agentDb).toContain('request>headers delete');
+    expect(agentDb).toContain('resp_headers delete');
     expect(caddy).toMatch(/\(edge_tls_moshpit\) \{\s+tls \{\s+load \/etc\/caddy\/edge-certs\s+protocols tls1\.3/);
   });