modules/nginx: enable access log

The "privacy" log format is essentially the default one, but with
IP/User-Agent info removed, hence the name.

Although I've already modified it to add scheme and host so I should
perhaps have chosen something more generic.

1 files changed, 8 insertions, 0 deletions

diff --git a/modules/server/nginx/default.nix b/modules/server/nginx/default.nix
index 33ba06defd86..2344197bcff6 100644
--- a/modules/server/nginx/default.nix
+++ b/modules/server/nginx/default.nix
@@ -10,4 +10,12 @@
   services.nginx.recommendedTlsSettings = true;
   services.nginx.recommendedGzipSettings = true;
   services.nginx.recommendedProxySettings = true;
+
+  services.nginx.commonHttpConfig = ''
+    log_format privacy '[$time_local] $request_method '
+                       '$scheme://$host$request_uri $status $body_bytes_sent';
+
+    # systemd catches syslog, and access_log doesn't support stdout/stderr.
+    access_log syslog:server=unix:/dev/log privacy;
+  '';
 }