Merge pull request #466 from NewMediaCaucus/dev

Don't let docker logs go nuts

Author: shimmeringtrashpile

README.md

@@ -6,8 +6,9 @@ Always name a feature branch "feature" plus description
 
 1. [Important File Locations](#important-file-locations)
 2. [Workflow Proposal](#workflow-proposal)
-3. [Further Reading](#further-reading)
-4. [Rolling Back](#rolling-back)
+3. [Production log limits](#production-log-limits)
+4. [Further Reading](#further-reading)
+5. [Rolling Back](#rolling-back)
 
 ## Important File Locations
 
@@ -55,6 +56,21 @@ Still needed:
 
 - Solution to back up content and media folders to offline storage
 
+## Production log limits
+
+Production is configured so container and application logs do not fill disk.
+
+**Docker container logs** (stdout/stderr, i.e. `docker logs`) are limited by the logging driver:
+
+- **docker-compose.prod.yml** and **deploy-prod.sh** use the `json-file` driver with `max-size: 10m` and `max-file: 3` for both the webserver and certbot containers. Docker keeps at most three 10 MB log files per container.
+
+**Application log files** (Apache, PHP, Certbot) in `apache-logs/`, `php-logs/`, and `letsencrypt-logs/` are rotated on the **prod server** using logrotate:
+
+- The config is in **logrotate.prod.conf** (rotate after 10M, keep 5 rotated files, compress, safe for open files).
+- On the prod server, install it once from the repo root:
+  - `sudo cp logrotate.prod.conf /etc/logrotate.d/nmc-website`
+- If the app is not in `/home/nmcdev/nmc-website`, edit the paths at the top of `logrotate.prod.conf`. Logrotate runs via cron (typically daily); no container restart needed.
+
 ## Further Reading
 
 1. [Git large file storage info](https://docs.github.com/en/repositories/working-with-files/managing-large-files/collaboration-with-git-large-file-storage)

deploy-prod.sh

@@ -28,6 +28,9 @@ sudo docker run -d \
   --hostname newmediacaucus.org \
   -p 80:80 \
   -p 443:443 \
+  --log-driver json-file \
+  --log-opt max-size=10m \
+  --log-opt max-file=3 \
   -v /home/nmcdev/nmc-website:/var/www/html/ \
   -v ./custom-php.prod.ini:/etc/php/8.3/apache2/conf.d/custom-php.ini \
   -v ./php-logs:/var/log/php-logs \
@@ -61,6 +64,9 @@ fi
 echo "Starting certbot container for automatic renewal..."
 sudo docker run -d \
   --name certbot \
+  --log-driver json-file \
+  --log-opt max-size=10m \
+  --log-opt max-file=3 \
   -v /etc/letsencrypt:/etc/letsencrypt \
   -v ./letsencrypt-logs:/var/log/letsencrypt \
   -v /var/run/docker.sock:/var/run/docker.sock \

docker-compose.prod.yml

@@ -19,6 +19,11 @@ services:
       - ./id.env
     depends_on:
       - certbot
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
     networks:
       - webnet
 
@@ -38,6 +43,11 @@ services:
       - DOMAIN=newmediacaucus.org
       - EMAIL=admin@newmediacaucus.org
     restart: unless-stopped
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
     networks:
       - webnet
 

logrotate.prod.conf

@@ -0,0 +1,16 @@
+# Logrotate config for NMC website prod (Apache, PHP, Certbot logs).
+# Install on prod server: sudo cp logrotate.prod.conf /etc/logrotate.d/nmc-website
+# (or symlink). Adjust base path below if the app is not in /home/nmcdev/nmc-website.
+
+/home/nmcdev/nmc-website/apache-logs/
+/home/nmcdev/nmc-website/php-logs/
+/home/nmcdev/nmc-website/letsencrypt-logs/
+{
+    rotate 5
+    size 10M
+    missingok
+    notifempty
+    compress
+    delaycompress
+    copytruncate
+}