The default Pangolin install does not enable Traefik access logging.
When CrowdSec is selected during installation, the installer enables Traefik access logs (required for CrowdSec to detect threats).
These logs are written to: config/traefik/logs/access.log (on the host)
Without log rotation, this file grows indefinitely, which is the issue reported in #2644.
This change fixes the problem only in the CrowdSec installation path, keeping the default install unaffected.
What changed
File modified:install/crowdsec.go
Added a new function: setupTraefikLogRotate()
This function is called from installCrowdsec() immediately after the directory config/traefik/logs/ is created.
The function writes a logrotate configuration file to /etc/logrotate.d/pangolin-traefik using the absolute path to the access log (resolved from the install directory).
Note:copytruncate is the key directive. It copies the log file and then truncates the original in place.
This allows Traefik to continue writing to the same open file descriptor without needing a restart or SIGHUP signal.
If the installer is not running as root, it skips writing the file and instead prints the full configuration to stdout (with the actual resolved path), allowing the user to set it up manually.
Testing
The generated config was validated directly with logrotate:
# Check that the config parses cleanly
logrotate --debug /etc/logrotate.d/pangolin-traefik
# Force rotation (first time)
logrotate --force --state /tmp/test.state /etc/logrotate.d/pangolin-traefik
# Force rotation again (second time)
logrotate --force --state /tmp/test.state /etc/logrotate.d/pangolin-traefik
Observed behavior:
access.log is truncated in place after each rotation (Traefik’s file handle remains valid)
Most recent rotated file stays uncompressed for easy inspection (delaycompress)
Older files are compressed to .gz
After 7 rotations, the oldest file is automatically deleted
No changes were made to the default (non-CrowdSec) installation path as suggested by @oschwartz10612.
PS : Can someone please go through this comment and verify if a follow up PR like this is required where we are dropping the unused fields from crowdsec installation?
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/2873
**Author:** [@sidd190](https://github.com/sidd190)
**Created:** 4/19/2026
**Status:** 🔄 Open
**Base:** `dev` ← **Head:** `fix/crowdsec-traefik-logrotate`
---
### 📝 Commits (2)
- [`2c8b7b5`](https://github.com/fosrl/pangolin/commit/2c8b7b5ca5ccc031f60f4c3b627483bade477ecc) (fix): Added a logrotate function to the crowdsec.go installer file
- [`473bce8`](https://github.com/fosrl/pangolin/commit/473bce856d4d864875caa6786a4185bbe15802d2) Pass installdir as a parameter
### 📊 Changes
**2 files changed** (+71 additions, -2 deletions)
<details>
<summary>View changed files</summary>
📝 `install/crowdsec.go` (+70 -1)
📝 `install/main.go` (+1 -1)
</details>
### 📄 Description
# Add logrotate config for Traefik access logs when CrowdSec is installed
Fixes #2644
**Documentation Update :** https://github.com/fosrl/docs-v2/pull/98
## What and why
The default Pangolin install does not enable Traefik access logging.
When **CrowdSec** is selected during installation, the installer enables Traefik access logs (required for CrowdSec to detect threats).
These logs are written to:
`config/traefik/logs/access.log` (on the host)
Without log rotation, this file grows indefinitely, which is the issue reported in #2644.
This change fixes the problem **only** in the CrowdSec installation path, keeping the default install unaffected.
## What changed
**File modified:** `install/crowdsec.go`
- Added a new function: `setupTraefikLogRotate()`
- This function is called from `installCrowdsec()` immediately after the directory `config/traefik/logs/` is created.
- The function writes a logrotate configuration file to `/etc/logrotate.d/pangolin-traefik` using the absolute path to the access log (resolved from the install directory).
### Logrotate configuration written:
```conf
/opt/pangolin/config/traefik/logs/access.log {
daily
rotate 7
compress
delaycompress
missingok
notifempty
copytruncate
}
```
> **Note:** `copytruncate` is the key directive. It copies the log file and then truncates the original in place.
> This allows Traefik to continue writing to the same open file descriptor without needing a restart or SIGHUP signal.
If the installer is **not running as root**, it skips writing the file and instead prints the full configuration to stdout (with the actual resolved path), allowing the user to set it up manually.
## Testing
The generated config was validated directly with `logrotate`:
```bash
# Check that the config parses cleanly
logrotate --debug /etc/logrotate.d/pangolin-traefik
# Force rotation (first time)
logrotate --force --state /tmp/test.state /etc/logrotate.d/pangolin-traefik
# Force rotation again (second time)
logrotate --force --state /tmp/test.state /etc/logrotate.d/pangolin-traefik
```
### Observed behavior:
- access.log is truncated in place after each rotation (Traefik’s file handle remains valid)
- Most recent rotated file stays uncompressed for easy inspection (delaycompress)
- Older files are compressed to .gz
- After 7 rotations, the oldest file is automatically deleted
No changes were made to the default (non-CrowdSec) installation path as suggested by @oschwartz10612.
PS : Can someone please go through [this comment](https://github.com/fosrl/pangolin/issues/2644#issuecomment-4275201183) and verify if a follow up PR like this is required where we are dropping the unused fields from crowdsec installation?
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/2873
Author: @sidd190
Created: 4/19/2026
Status: 🔄 Open
Base:
dev← Head:fix/crowdsec-traefik-logrotate📝 Commits (2)
2c8b7b5(fix): Added a logrotate function to the crowdsec.go installer file473bce8Pass installdir as a parameter📊 Changes
2 files changed (+71 additions, -2 deletions)
View changed files
📝
install/crowdsec.go(+70 -1)📝
install/main.go(+1 -1)📄 Description
Add logrotate config for Traefik access logs when CrowdSec is installed
Fixes #2644
Documentation Update : https://github.com/fosrl/docs-v2/pull/98
What and why
The default Pangolin install does not enable Traefik access logging.
When CrowdSec is selected during installation, the installer enables Traefik access logs (required for CrowdSec to detect threats).
These logs are written to:
config/traefik/logs/access.log(on the host)Without log rotation, this file grows indefinitely, which is the issue reported in #2644.
This change fixes the problem only in the CrowdSec installation path, keeping the default install unaffected.
What changed
File modified:
install/crowdsec.gosetupTraefikLogRotate()installCrowdsec()immediately after the directoryconfig/traefik/logs/is created./etc/logrotate.d/pangolin-traefikusing the absolute path to the access log (resolved from the install directory).Logrotate configuration written:
If the installer is not running as root, it skips writing the file and instead prints the full configuration to stdout (with the actual resolved path), allowing the user to set it up manually.
Testing
The generated config was validated directly with
logrotate:Observed behavior:
No changes were made to the default (non-CrowdSec) installation path as suggested by @oschwartz10612.
PS : Can someone please go through this comment and verify if a follow up PR like this is required where we are dropping the unused fields from crowdsec installation?
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.