From a6487aeba9a1161599bc9a4179d551feb0d179fe Mon Sep 17 00:00:00 2001 From: stroblme Date: Wed, 28 Oct 2026 09:10:39 +0100 Subject: [PATCH] Traefik access log drops the request path, where a hook's secret sits --- docker/compose.dev.yml | 1 + docker/compose.traefik.yml | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/docker/compose.dev.yml b/docker/compose.dev.yml index eee2d45..2b40d8c 100644 --- a/docker/compose.dev.yml +++ b/docker/compose.dev.yml @@ -33,6 +33,7 @@ services: - --entrypoints.https.address=:443 - --accesslog - --accesslog.fields.queryparameters.defaultmode=drop + - --accesslog.fields.names.RequestPath=drop - --log - --log.level=DEBUG - --api diff --git a/docker/compose.traefik.yml b/docker/compose.traefik.yml index 5a0fa9f..307d0ec 100644 --- a/docker/compose.traefik.yml +++ b/docker/compose.traefik.yml @@ -71,6 +71,10 @@ services: # Without query strings: the live socket and a worker's attach carry their # token there, and Traefik can drop query values but not mask them - --accesslog.fields.queryparameters.defaultmode=drop + # Nor the request path: a webhook's secret is its last segment, and the + # path can be dropped but not masked in part. The engine's own request + # log keeps the path, with the secret masked. + - --accesslog.fields.names.RequestPath=drop # Enable the Traefik log, for configurations and errors - --log # Enable the Dashboard and API