From fb044d2c309e618e3d2e6eb5911411bdbddf8d88 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 2 Sep 2026 17:56:15 +0200 Subject: [PATCH] gateway: file nginx error lines at their own severity Filtering the gateway's journal by severity returned nothing while nginx was logging [error] continuously. Measured against nginx.service: `-p warning` and `-p err` over 24h both said "No entries", while the unfiltered query returned a continuous stream of [error] lines. The failure is inverted rather than merely missing. A severity filter is how you ask "is anything wrong", and here it answered "no" *because* the errors were misfiled -- one step from recording "gateway clean, no warnings in 24h". Cause: the module default is `error_log stderr`, and systemd files that whole stream at one priority regardless of what each line says. Routing to syslog preserves per-line severity, so [error] lands as err and every existing severity filter starts working without changing a consumer. Uses the module's own `logError` option rather than appendConfig: nixpkgs emits `error_log ${cfg.logError};` at exactly one site, in the main context, so the option guarantees the placement. Transport only -- no level suffix, so nginx keeps its default `error` threshold and this changes where lines are filed, not which lines exist. Gated with `nginx -t` on the flake-locked nginx against the exact string shipped here, with a deliberately invalid syslog target as the control that the test can fail on this directive. gixy (what the module's own validateConfigFile actually runs) reports no issues. What that does NOT prove: that journald files the lines at the right severity. `nginx -t` is a parse check; only a deploy shows the effect. --- nix/host-modules/hive-gateway/default.nix | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/nix/host-modules/hive-gateway/default.nix b/nix/host-modules/hive-gateway/default.nix index c15f5816..c3130905 100644 --- a/nix/host-modules/hive-gateway/default.nix +++ b/nix/host-modules/hive-gateway/default.nix @@ -385,6 +385,19 @@ in recommendedGzipSettings = true; recommendedOptimisation = true; inherit (nginxTree) virtualHosts; + + # Route the error log through syslog so each line keeps its own + # severity. The module default is `stderr`, and systemd files that + # whole stream at one priority regardless of what each line says — + # so `journalctl -p err -u nginx` returns nothing while nginx is + # logging `[error]` continuously. That failure is inverted rather + # than merely missing: a severity filter is how you ask "is anything + # wrong", and it answers "no" *because* the errors are misfiled. + # + # Transport only — no level suffix, so nginx keeps its default + # `error` threshold and this changes where lines are filed, not + # which lines exist. + logError = "syslog:server=unix:/dev/log,nohostname,tag=nginx"; }; # ⚠️ NO `SupplementaryGroups = [ "hive-core" ]` on nginx, and its