commit b2f7bd8648d36ddf25ad724e80632856fd83bfb8
parent 3f7f22e1a835567249f07617ca86b0fc0f0b9ab8
Author: Florian Dold <dold@taler.net>
Date: Tue, 25 Aug 2026 21:23:01 +0200
paivana-httpd: keep routine request logs at DEBUG
Diffstat:
5 files changed, 22 insertions(+), 12 deletions(-)
diff --git a/debian/paivana-httpd.service b/debian/paivana-httpd.service
@@ -55,6 +55,14 @@ ExecStart=/usr/bin/paivana-httpd -c /etc/paivana/paivana.conf -f -L INFO
StandardOutput=journal
StandardError=journal
+# libgnunetcurl records every completed outbound request at INFO. That is
+# useful while debugging, but turns the production journal into an access log
+# for every request Paivana proxies. Keep INFO for Paivana's lifecycle and
+# recovery messages while limiting that library source file to actionable
+# severities. GNUNET_FORCE_LOG takes precedence over ExecStart's -L INFO; the
+# final rule deliberately restores INFO for every other source file.
+Environment="GNUNET_FORCE_LOG=;curl.c;;;WARNING/;;;;INFO"
+
# Hardening. paivana-httpd needs a listening socket handed to it,
# outbound TCP to the merchant backend and the origin, and read access
# to its own configuration -- nothing else. DynamicUser is deliberately
diff --git a/src/backend/paivana-httpd_cookie.c b/src/backend/paivana-httpd_cookie.c
@@ -187,7 +187,7 @@ PAIVANA_HTTPD_check_cookie (const char *cookie,
GNUNET_memcmp_priv (&c,
&h))
{
- GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
"Cookie hash does not match!\n");
return false;
}
@@ -200,7 +200,7 @@ PAIVANA_HTTPD_check_cookie (const char *cookie,
one HKDF on a value that was going to be rejected anyway. */
if (GNUNET_TIME_absolute_is_past (a.abs_time))
{
- GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
"Cookie expired %s ago\n",
GNUNET_TIME_relative2s (
GNUNET_TIME_absolute_get_duration (a.abs_time),
diff --git a/src/backend/paivana-httpd_daemon.c b/src/backend/paivana-httpd_daemon.c
@@ -228,10 +228,12 @@ create_response (void *cls,
TALER_EC_PAIVANA_PAYWALL_DISABLED,
NULL);
}
- GNUNET_log (GNUNET_ERROR_TYPE_INFO,
- "Client POSTed payment, checking validity\n");
if (NULL == rc->hp)
+ {
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Client POSTed payment, checking validity\n");
rc->hp = PAIVANA_HTTPD_payment_create (rc->connection);
+ }
return PAIVANA_HTTPD_payment_handle (rc->hp,
upload_data,
upload_data_size);
@@ -323,7 +325,7 @@ create_response (void *cls,
bearer credential the client paid for, it outlives its own
Max-Age in the log file, and anyone sharing the client's address
-- everyone behind one NAT -- could replay it. */
- GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
"Client sent an access cookie for %s: %s\n",
website,
ok ? "good" : "invalid");
@@ -340,14 +342,14 @@ create_response (void *cls,
GNUNET_free (website);
/* #GNUNET_OK only says a response was queued; besides the
redirect to the paywall that may be a 414 or a 400. */
- GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
"A paywall applies, response queued: %s\n",
(GNUNET_OK == ret) ? "ok" : "failed");
return (GNUNET_OK == ret) ? MHD_YES : MHD_NO;
}
}
GNUNET_free (website);
- GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
"Request OK, no paywall applies!\n");
rc->do_forward = true;
do_forward:
@@ -388,7 +390,7 @@ mhd_completed_cb (void *cls,
if (NULL == rc)
return;
if (MHD_REQUEST_TERMINATED_COMPLETED_OK != toe)
- GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
"MHD encountered error handling request to %s: %d\n",
rc->url,
toe);
diff --git a/src/backend/paivana-httpd_helper.c b/src/backend/paivana-httpd_helper.c
@@ -1030,7 +1030,7 @@ PAIVANA_HTTPD_resolve_forwarding (const struct PAIVANA_HTTPD_Forwarding *fi,
if (have_lines (fi->forwarded))
{
if (have_lines (fi->xff))
- GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
"Both Forwarded and X-Forwarded-For present; using"
" Forwarded\n");
from_forwarded = true;
@@ -1053,7 +1053,7 @@ PAIVANA_HTTPD_resolve_forwarding (const struct PAIVANA_HTTPD_Forwarding *fi,
cl->ca = GNUNET_memdup (el[sel].addr,
el[sel].addr_len);
cl->ca_len = el[sel].addr_len;
- GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
"Client address is based on %s: `%s'\n",
from_forwarded
? MHD_HTTP_HEADER_FORWARDED
@@ -1066,7 +1066,7 @@ PAIVANA_HTTPD_resolve_forwarding (const struct PAIVANA_HTTPD_Forwarding *fi,
cannot turn into bytes: legal, but nothing to bind a cookie
to. The peer is what we know for certain, and a header the
client controls must never be able to take that away. */
- GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
"Forwarding chain names no client address at `%s';"
" falling back to the socket peer\n",
el[sel].node);
diff --git a/src/backend/paivana-httpd_templates.c b/src/backend/paivana-httpd_templates.c
@@ -1327,7 +1327,7 @@ PAIVANA_HTTPD_return_template (struct MHD_Connection *connection,
path, this runs before any payment, and a stale bookmark or a
crawler would otherwise write an ERROR-level "Assertion failed" per
request. A 404 is the whole answer. */
- GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
"No template `%s', returning 404\n",
template);
return TALER_MHD_reply_with_error (connection,
