Direct the log to a specific file/directory

[Eirikr70]

Hello, I manage a public SearXNG instance through Docker and would like to harden it a bit. I use LinuxServer/Docker-Swag as a reverse proxy and would like to protect SearXNG with Fail2ban, which is included in the reverse-proxy container. In order to do that, I would need to create a volume for Swag to access the log file. That log file being in the Docker directory, it would be quite dirty to link it as a volume to Swag. Is there any way to write the log of SearXNG as a file in a dedicated place ?

[Eirikr70]

So, I have solved the problem by

• copying the log file to an Docker-external path with a Systemd service,
• setting up a filter and a jail in Fail2ban.

I leave here the code that I set up in that aim, in case someone would be interested. I welcome any constructive comments.
The executable file for the Systemd service

eric@odroid:~/startup$ cat copie-log-searxng.sh
#!/bin/bash

readonly CONTAINER='searxng'

readonly DEST_FILE='/srv/nas/logs/searxng/searxng.log'

echo $$ > /home/eric/startup/pid_copie_log

ERROR=0

while ERROR==0 ; do :

  read -r LOG_FILE < <(docker inspect --format '{{.LogPath}}' "${CONTAINER}")

  tail -Fn 1 "${LOG_FILE}" >> "${DEST_FILE}"

  ERROR=$?

done

The service unit file

eric@odroid:~/startup$ cat /etc/systemd/system/copie-log-searxng.service
[Unit]
Description=Copie des logs searxng issues du conteneur Docker vers le répertoire logs pour pouvoir y accéder via fail2ban
Requires=docker.service

[Service]
ExecStart=/home/eric/startup/copie-log-searxng.sh
Type=simple
Restart=on-success

[Install]
WantedBy=multi-user.target

The Fail2ban filter

eric@odroid:~/swag$ cat config/fail2ban/filter.d/searxng-botsearch.conf
# Fail2Ban filter for searxng
#
#

[Definition]


failregex = ^.* ERROR:searx\.botdetection\.ip_limit: BLOCK: too many request from <HOST>\/32 in SUSPICIOUS_IP_WINDOW \(redirect to \/\).*

The Fail2ban jail

[searxng-botsearch]
enabled = true
port    = http,https
filter  = searxng-botsearch
logpath = /config/log/searxng/searxng.log
maxretry = 1
bantime = 14400

[Eirikr70]

I must confess that the Systemd service is not totally reliable if I remove and start the Docker container. I will try to find a solution.

[Eirikr70]

So, as promised, I have revised the copie-log-searxng.sh file in order to make it more stable in case of stopping / starting the container with Docker compose. Here is what I get (hope you are not angry at infinite loops). Of course the paths must be adjusted to you configuration.
All coments welcome.

eric@odroid:~/startup$ cat copie-log-searxng.sh
#!/bin/bash

readonly CONTAINER='searxng'

readonly DEST_FILE='/srv/nas/logs/searxng/searxng.log'

readonly PID_FILE='/home/eric/startup/pid_copie_searxng'

while true ; do

  read -r LOG_FILE < <(docker inspect --format '{{.LogPath}}' "${CONTAINER}")

  tail -Fn 1 "${LOG_FILE}" >> "${DEST_FILE}" &

  echo "$!" > "${PID_FILE}"

  while [[ $( docker inspect --format '{{.LogPath}}' "${CONTAINER}" ) == "${LOG_FILE}" ]] ; do

    sleep 2

  done

  kill $( cat "${PID_FILE}" )

done