Add CrowdSec OpenResty bouncer config - ENV: CROWDSEC_BOUNCER = 1 to enable. /data/crowdsec/crowdsec-openresty-bouncer.conf is the configuration file for it.

Add Admin dashboard logging to the /data/logs/admin-panel_[access/error].log  folder - ENV: ADMIN_PANEL_LOG = 1 to enable.

Add OpenResty error log (fallback_error.log) debug level - ENV: OPENRESTY_DEBUG = 1 to enable.

docker/Dockerfile

@@ -16,7 +16,8 @@ ENV SUPPRESS_NO_CONFIG_WARNING=1 \
         NODE_ENV=production \
         NPM_BUILD_VERSION="${BUILD_VERSION}" \
         NPM_BUILD_COMMIT="${BUILD_COMMIT}" \
-	NPM_BUILD_DATE="${BUILD_DATE}"
+        NPM_BUILD_DATE="${BUILD_DATE}" \
+        OPENRESTY_DEBUG="0"
 
 RUN echo "fs.file-max = 65535" > /etc/sysctl.conf \
         && apt-get update \

docker/rootfs/etc/cont-init.d/01_perms.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash
 set -e
 
 mkdir -p /data/logs
 echo "Changing ownership of /data/logs to $(id -u):$(id -g)"
 chown -R "$(id -u):$(id -g)" /data/logs
-

docker/rootfs/etc/cont-init.d/98_logging-options.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+set -e # Exit immediately if a command exits with a non-zero status.
+set -u # Treat unset variables as an error.
+
+# Redirect admin panel logs from /dev/null to log files if enabled
+if [[ ${ADMIN_PANEL_LOG} == "1" ]] || [[ ${ADMIN_PANEL_LOG} -eq 1 ]]; then
+  echo "Enabling admin dashboard logging"
+  echo "ADMIN_PANEL_LOG = $ADMIN_PANEL_LOG"
+  sed-patch 's|<ADMIN_ACCESS_LOG>|/data/logs/admin-panel_access.log standard|' /etc/nginx/conf.d/production.conf
+  sed-patch 's|<ADMIN_ERROR_LOG>|/data/logs/admin-panel_error.log warn|' /etc/nginx/conf.d/production.conf
+else
+  echo "Leaving admin dashboard logging off (default behavior)"
+  echo "ADMIN_PANEL_LOG = $ADMIN_PANEL_LOG"
+  sed-patch 's|<ADMIN_ACCESS_LOG>|/dev/null|' /etc/nginx/conf.d/production.conf
+  sed-patch 's|<ADMIN_ERROR_LOG>|/dev/null|' /etc/nginx/conf.d/production.conf
+fi
+
+if [[ ${OPENRESTY_DEBUG} == "1" ]] || [[ ${OPENRESTY_DEBUG} -eq 1 ]]; then
+  echo "Changing OpenResty ERROR (fallback_error.log) logging to level: DEBUG"
+  echo "OPENRESTY_DEBUG = $OPENRESTY_DEBUG"
+  sed-patch 's|<ERROR_LOG_LEVEL>|debug|' /etc/nginx/nginx.conf
+
+else
+  echo "Leaving OpenResty ERROR (fallback_error.log) logging at level: WARN (default behavior)"
+  echo "OPENRESTY_DEBUG = $OPENRESTY_DEBUG"
+  sed-patch 's|<ERROR_LOG_LEVEL>|warn|' /etc/nginx/nginx.conf
+fi

docker/rootfs/etc/cont-init.d/99_crowdsec-openresty-bouncer.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+set -e # Exit immediately if a command exits with a non-zero status.
+set -u # Treat unset variables as an error.
+
+# Redirect admin panel logs from /dev/null to log files if enabled
+if [[ ${ADMIN_PANEL_LOG} == "1" ]] || [[ ${ADMIN_PANEL_LOG} -eq 1 ]]; then
+  echo "Enabling admin dashboard logging"
+  echo "ADMIN_PANEL_LOG = $ADMIN_PANEL_LOG"
+  sed-patch 's|<ADMIN_ACCESS_LOG>|/data/logs/admin-panel_access.log standard|' /etc/nginx/conf.d/production.conf
+  sed-patch 's|<ADMIN_ERROR_LOG>|/data/logs/admin-panel_error.log warn|' /etc/nginx/conf.d/production.conf
+else
+  echo "Leaving admin dashboard logging off (default behavior)"
+  echo "ADMIN_PANEL_LOG = $ADMIN_PANEL_LOG"
+  sed-patch 's|<ADMIN_ACCESS_LOG>|/dev/null|' /etc/nginx/conf.d/production.conf
+  sed-patch 's|<ADMIN_ERROR_LOG>|/dev/null|' /etc/nginx/conf.d/production.conf
+fi
+
+if [[ ${OPENRESTY_DEBUG} == "1" ]] || [[ ${OPENRESTY_DEBUG} -eq 1 ]]; then
+  echo "Changing OpenResty ERROR (fallback_error.log) logging to level: DEBUG"
+  echo "OPENRESTY_DEBUG = $OPENRESTY_DEBUG"
+  sed-patch 's|<ERROR_LOG_LEVEL>|debug|' /etc/nginx/nginx.conf
+
+else
+  echo "Leaving OpenResty ERROR (fallback_error.log) logging at level: WARN (default behavior)"
+  echo "OPENRESTY_DEBUG = $OPENRESTY_DEBUG"
+  sed-patch 's|<ERROR_LOG_LEVEL>|warn|' /etc/nginx/nginx.conf
+fi
+
+❯ cat docker/rootfs/etc/cont-init.d/99_crowdsec-openresty-bouncer.sh
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+set -e # Exit immediately if a command exits with a non-zero status.
+set -u # Treat unset variables as an error.
+
+log() {
+  echo "[cont-init.d] $(basename "$0"): $*"
+}
+
+if [ "${CROWDSEC_BOUNCER}" == "1" ] || [ "${CROWDSEC_BOUNCER}" -eq 1 ]; then
+  mkdir -p /data/crowdsec
+  #Install Crowdsec Bouncer Config.
+  [ -f /data/crowdsec/crowdsec-openresty-bouncer.conf ] || cp /crowdsec/crowdsec-openresty-bouncer.conf /data/crowdsec/crowdsec-openresty-bouncer.conf
+  mkdir -p /etc/nginx/lualib/plugins/crowdsec/
+  cp /crowdsec/lua/* /etc/nginx/lualib/plugins/crowdsec/
+  cp /crowdsec/crowdsec_openresty.conf /etc/nginx/conf.d/
+  sed-patch 's|ok, err = require "crowdsec".allowIp(ngx.var.remote_addr)|local ok, err = require "crowdsec".allowIp(ngx.var.remote_addr)|' /etc/nginx/lualib/plugins/crowdsec/access.lua
+fi

docker/rootfs/etc/nginx/conf.d/production.conf

@@ -5,7 +5,9 @@ server {
 
         server_name nginxproxymanager;
         root /app/frontend;
-	access_log /dev/null;
+        # Replaced with /dev/null by default unless ADMIN_PANEL_LOG is set to '1'
+        access_log <ADMIN_ACCESS_LOG>;
+        error_log <ADMIN_ERROR_LOG>;
 
         location /api {
                 return 302 /api/;

docker/rootfs/etc/nginx/nginx.conf

@@ -9,7 +9,7 @@ worker_processes auto;
 # Enables the use of JIT for regular expressions to speed-up their processing.
 pcre_jit on;
 
-error_log /data/logs/fallback_error.log warn;
+error_log /data/logs/fallback_error.log <ERROR_LOG_LEVEL>;
 
 # Includes files with directives to load dynamic modules.
 include /etc/nginx/modules/*.conf;