Skip to content

Traefik

GeoMetrikks parses Traefik JSON access logs. Traefik logs to stdout by default, so configure a file and the JSON format in your static configuration, and keep the User-Agent and Referer headers so analytics have them:

accessLog:
  filePath: "/var/log/traefik/access.log"
  format: json
  fields:
    headers:
      names:
        User-Agent: keep
        Referer: keep

Mount the log directory into the GeoMetrikks container (set ACCESS_LOG_DIR=/path/to/traefik/logs in .env, or edit the volume) and point the parser at it:

ACCESS_LOG_DIR=/var/log/traefik
LOGPARSER_LOG_PATHS=/var/log/access/access.log

The format is auto-detected per file; set LOGPARSER_LOG_FORMATS=traefik-json to pin it. Notes:

  • Rotate with logrotate and signal Traefik afterwards: docker kill --signal=USR1 traefik. GeoMetrikks follows the rotation.
  • Behind a CDN or load balancer, configure Traefik’s entryPoints.<name>.forwardedHeaders.trustedIPs so the logged client IP is the real client, not the proxy. With a trusted peer, Traefik logs the X-Forwarded-For chain as it arrived; GeoMetrikks takes the rightmost entry, the one your proxy appended. Do not set forwardedHeaders.insecure: it trusts the header from anyone, and a client can then place any address on the map. See docs/proxy-setup.md for the full real-IP setup, including tunnels.
  • GeoMetrikks cannot read Traefik’s stdout. Write the log to a file, and either tail it or ship it to Loki and read it from there (Loki setup).

Pangolin

Section titled “Pangolin”

Pangolin puts Traefik in front of its tunnels, so GeoMetrikks reads its log as a Traefik log. Run GeoMetrikks on the Pangolin server, where the log file is, or ship the file to Loki.

Pangolin’s installer turns the access log on only when you install CrowdSec with it. The log then goes to config/traefik/logs/access.log in the Pangolin directory. Without CrowdSec, add the accessLog block from Traefik setup to config/traefik/traefik_config.yml. Pangolin’s compose file already mounts config/traefik/logs at /var/log/traefik.

The CrowdSec install’s accessLog block drops every field it doesn’t list. GeoMetrikks parses what is left, but requests have no host, referrer or upstream time. Its filters also hide fast redirects: Traefik keeps a line when any filter matches, so a 3xx response under 100 ms is never logged. In config/traefik/traefik_config.yml, delete the filters block and add three names:

accessLog:
  fields:
    names:
      RequestHost: keep
      OriginDuration: keep
    headers:
      names:
        Referer: keep

Keep the names already in the lists, then run docker compose restart traefik in the Pangolin directory. Point GeoMetrikks at the logs:

ACCESS_LOG_DIR=/path/to/pangolin/config/traefik/logs
LOGPARSER_LOG_PATHS=/var/log/access/access.log
  • In the default install, Traefik receives connections straight from the internet, so the log carries the visitor’s address. Behind Cloudflare’s proxy, add Cloudflare’s ranges to forwardedHeaders.trustedIPs on the websecure entry point, as in docs/proxy-setup.md. If Gerbil’s SNI proxy sits in front of Traefik (port 443 mapped to 8443), Traefik logs the proxy’s address unless the entry point accepts PROXY protocol from it.
  • Pangolin’s guide to Traefik log rotation sets up logrotate for this file. GeoMetrikks follows the rotation.
  • Pangolin’s CrowdSec container doesn’t publish its LAPI port. To use the CrowdSec integration, publish port 8080 or put GeoMetrikks on the same Docker network.