From e4fe9e84bd2085ab852fde2a6382fedfa44c8ac4 Mon Sep 17 00:00:00 2001 From: "Emily (Agent)" Date: Sun, 9 Aug 2026 21:38:53 -0500 Subject: [PATCH] fix: nginx syslog access_log tag must not contain a hyphen The nginx_access syslog tag added in #37 (feat/emily-incident-logging) used tag=nginx-access. nginx's syslog sink only accepts alphanumeric characters and underscores in the tag field, so the generated nginx.conf failed its config test on linode: nginx: [emerg] syslog "tag" only allows alphanumeric characters and underscore in .../nginx.conf:114 Because nginx-pre-start failed, nginx.service crash-looped until it hit systemd's start-limit-hit and gave up entirely. Since Nextcloud is proxied through nginx (127.0.0.1:8080, fronted by haproxy's 'next' backend), this took next.thehellings.com down with a 503 from haproxy (phpfpm-nextcloud/postgresql/redis backends were all healthy and unaffected - purely an nginx config parse failure). Fix: use an underscore (nginx_access) instead of a hyphen. --- hosts/unstable/linode/default.nix | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/hosts/unstable/linode/default.nix b/hosts/unstable/linode/default.nix index 2c503e6..3f46122 100644 --- a/hosts/unstable/linode/default.nix +++ b/hosts/unstable/linode/default.nix @@ -325,10 +325,19 @@ in # Route nginx access logs through syslog/journald (rather than only to # /var/log/nginx/access.log, which the read-only monitoring account - # can't read) so `journalctl -t nginx-access` gives visibility into + # can't read) so `journalctl -t nginx_access` gives visibility into # Nextcloud request traffic during bandwidth investigations. + # + # NOTE: nginx's syslog "tag" only allows alphanumeric characters and + # underscores (no hyphens) - an earlier version of this used + # tag=nginx-access, which fails nginx's config test with: + # nginx: [emerg] syslog "tag" only allows alphanumeric characters + # and underscore in .../nginx.conf:114 + # That broke nginx.service (and, transitively, Nextcloud/next.thehellings.com, + # which is proxied through nginx on 127.0.0.1:8080) until nginx hit its + # systemd restart limit and gave up (start-limit-hit). appendHttpConfig = '' - access_log syslog:server=unix:/dev/log,tag=nginx-access combined; + access_log syslog:server=unix:/dev/log,tag=nginx_access combined; ''; };