# ARGUS security-event ingestion + nginx logs (ADR-0038 Sec.2.5, ADR-0040 M7).
#
# Deliberately NOT copytruncate: internal/service/log_collector.go's tailer
# (streamFileAccessLogs / streamStreamAccessLogs) detects rotation by inode
# change and re-opens the new file at that path -- copytruncate keeps the
# same inode and truncates in place, which the tailer would never notice,
# silently stalling security-event ingestion until the file regrew past its
# old read offset. The default rename-then-create rotation this file uses
# instead changes the inode, which the tailer already handles correctly.
/var/log/argus/access_raw.log
/var/log/argus/stream_access.log
/var/log/argus/nginx-error.log {
    size 100M
    rotate 5
    missingok
    notifempty
    create 0644 argus argus
    sharedscripts
    compress
    delaycompress
    postrotate
        systemctl reload argus-nginx >/dev/null 2>&1 || true
    endscript
}

# modsec_audit.log gets its OWN stanza with a real restart, not reload.
#
# Confirmed by direct evidence (2026-09-04): nginx's core access/error logs
# reopen correctly on `reload` (SIGHUP) -- the comment that used to live here
# claiming "one shared postrotate reload covers all of them" was wrong for
# this file specifically. ModSecurity-nginx's audit-log file descriptor is
# opened once and never re-resolved by path afterward: neither `reload`
# (SIGHUP) nor a direct `SIGUSR1` (nginx's normal log-reopen signal) causes
# it to pick up the post-rotation file. Every already-forked worker --
# including brand-new workers spawned by a fresh reload -- kept writing into
# the old, already-unlinked inode indefinitely, so `ls`/`du` showed a small
# file while `df` kept climbing toward 100% with no visible cause. This is
# what filled the 4.1G /var partition and crashed PostgreSQL. Only a full
# `restart` (new master process) actually releases the old fd. A restart
# briefly drops in-flight connections, which is an acceptable trade-off for
# a rotation that runs at most once a day, versus silent unbounded disk
# growth. See the incident note in debian/argus-nginx-share/modsec-base.conf's
# SecAuditLogRelevantStatus comment for the companion fix that reduces how
# much this file grows in the first place.
/var/log/argus/modsec_audit.log {
    size 100M
    rotate 5
    missingok
    notifempty
    create 0644 argus argus
    compress
    delaycompress
    postrotate
        systemctl restart argus-nginx >/dev/null 2>&1 || true
    endscript
}
