From fa1f518fce026869b49a7edc29713d2da85e45fb Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sun, 9 Aug 2026 10:46:02 -0700 Subject: [PATCH 1/3] Add X-Blog-Check to the keep-list this document already describes The access-log section said request headers are dropped except Referer and User-Agent. The host added X-Blog-Check to that allowlist when the header was introduced, which is the only reason request_X-Blog-Check appears at all, so the outward pass and the log description contradicted each other in the same file. The keep-list is named as the precondition rather than left as trivia. A header absent from it does not appear in the log, which reads exactly like a request that never sent one, and that is the negative-result trap this file now states as a rule. The reason the list is an allowlist is unchanged and still the point: it is what keeps the Pangolin resource access token out of a file that is retained and copied off the host. Found by Copilot review on #83. Co-Authored-By: Claude Opus 5 (1M context) --- OPERATIONS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OPERATIONS.md b/OPERATIONS.md index efcb837..9daa83c 100644 --- a/OPERATIONS.md +++ b/OPERATIONS.md @@ -299,7 +299,7 @@ Widen `== 404` to `>= 400` for the whole non-200 sweep the table above describes ### Retention Is the Prerequisite, and It Belongs to the Host -**On the VPS the reviewable record is Traefik's access log**, at `/var/log/traefik/access.log`, one JSON object per line, one line per request, across every hostname the host serves. `RequestPath` carries the query string, so the legacy `/?p=` traffic is visible as itself. Request headers are dropped except `Referer` and `User-Agent`, which is what keeps the Pangolin resource access token out of a file that is retained and copied, and query strings are logged in full, so treat an extract as sensitive. +**On the VPS the reviewable record is Traefik's access log**, at `/var/log/traefik/access.log`, one JSON object per line, one line per request, across every hostname the host serves. `RequestPath` carries the query string, so the legacy `/?p=` traffic is visible as itself. Request headers are dropped except `Referer`, `User-Agent`, and `X-Blog-Check`, which is what keeps the Pangolin resource access token out of a file that is retained and copied, and query strings are logged in full, so treat an extract as sensitive. That keep-list is the host's to hold and is the precondition the outward pass depends on: a header absent from it does not appear in the log at all, which is indistinguishable from a request that never sent one. **That log rotates and is eventually deleted, on a schedule the host sets and can change.** The window is long, and it is finite, so anything the inward pass depends on has to be copied off the host before the archive ages out. Read the current retention from the host rather than from this file, because a number written here is a number nothing checks. From 9620490e5c40c586e6bab198c2e9e782a86094be Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sun, 9 Aug 2026 10:48:58 -0700 Subject: [PATCH 2/3] Say the log omits headers rather than that headers are dropped "Request headers are dropped except" reads as Traefik stripping them from the request. That would mean the Pangolin access token never reaches the site, and the staging gate works, so a reader who took it that way would be left with two facts that cannot both hold. It now says the log records three and omits the rest from the record rather than from the request, which still arrives intact. Found by Copilot review on #84. Co-Authored-By: Claude Opus 5 (1M context) --- OPERATIONS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OPERATIONS.md b/OPERATIONS.md index 9daa83c..5cf0c24 100644 --- a/OPERATIONS.md +++ b/OPERATIONS.md @@ -299,7 +299,7 @@ Widen `== 404` to `>= 400` for the whole non-200 sweep the table above describes ### Retention Is the Prerequisite, and It Belongs to the Host -**On the VPS the reviewable record is Traefik's access log**, at `/var/log/traefik/access.log`, one JSON object per line, one line per request, across every hostname the host serves. `RequestPath` carries the query string, so the legacy `/?p=` traffic is visible as itself. Request headers are dropped except `Referer`, `User-Agent`, and `X-Blog-Check`, which is what keeps the Pangolin resource access token out of a file that is retained and copied, and query strings are logged in full, so treat an extract as sensitive. That keep-list is the host's to hold and is the precondition the outward pass depends on: a header absent from it does not appear in the log at all, which is indistinguishable from a request that never sent one. +**On the VPS the reviewable record is Traefik's access log**, at `/var/log/traefik/access.log`, one JSON object per line, one line per request, across every hostname the host serves. `RequestPath` carries the query string, so the legacy `/?p=` traffic is visible as itself. The log records only three request headers, `Referer`, `User-Agent`, and `X-Blog-Check`, and omits the rest from the record rather than stripping them from the request, which still arrives intact. That omission is what keeps the Pangolin resource access token out of a file that is retained and copied, and query strings are logged in full, so treat an extract as sensitive. That keep-list is the host's to hold and is the precondition the outward pass depends on: a header absent from it does not appear in the log at all, which is indistinguishable from a request that never sent one. **That log rotates and is eventually deleted, on a schedule the host sets and can change.** The window is long, and it is finite, so anything the inward pass depends on has to be copied off the host before the archive ages out. Read the current retention from the host rather than from this file, because a number written here is a number nothing checks. From 4c490585b33340e8fc44cfce867f57db64caf6f8 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sun, 9 Aug 2026 10:51:58 -0700 Subject: [PATCH 3/3] Name the log keys, since that is what a reader greps for The sentence named the headers where the rest of the section names the JSON keys, so it described the policy without giving the thing anyone parsing the file actually needs. The three now appear as request_Referer, request_User-Agent and request_X-Blog-Check, which is the form already used in the jq examples above and below it. Found by Copilot review on #84, as a suppressed comment. Co-Authored-By: Claude Opus 5 (1M context) --- OPERATIONS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OPERATIONS.md b/OPERATIONS.md index 5cf0c24..fe3d680 100644 --- a/OPERATIONS.md +++ b/OPERATIONS.md @@ -299,7 +299,7 @@ Widen `== 404` to `>= 400` for the whole non-200 sweep the table above describes ### Retention Is the Prerequisite, and It Belongs to the Host -**On the VPS the reviewable record is Traefik's access log**, at `/var/log/traefik/access.log`, one JSON object per line, one line per request, across every hostname the host serves. `RequestPath` carries the query string, so the legacy `/?p=` traffic is visible as itself. The log records only three request headers, `Referer`, `User-Agent`, and `X-Blog-Check`, and omits the rest from the record rather than stripping them from the request, which still arrives intact. That omission is what keeps the Pangolin resource access token out of a file that is retained and copied, and query strings are logged in full, so treat an extract as sensitive. That keep-list is the host's to hold and is the precondition the outward pass depends on: a header absent from it does not appear in the log at all, which is indistinguishable from a request that never sent one. +**On the VPS the reviewable record is Traefik's access log**, at `/var/log/traefik/access.log`, one JSON object per line, one line per request, across every hostname the host serves. `RequestPath` carries the query string, so the legacy `/?p=` traffic is visible as itself. The log records only three request headers, which appear as the keys `request_Referer`, `request_User-Agent`, and `request_X-Blog-Check`, and omits the rest from the record rather than stripping them from the request, which still arrives intact. That omission is what keeps the Pangolin resource access token out of a file that is retained and copied, and query strings are logged in full, so treat an extract as sensitive. That keep-list is the host's to hold and is the precondition the outward pass depends on: a header absent from it does not appear in the log at all, which is indistinguishable from a request that never sent one. **That log rotates and is eventually deleted, on a schedule the host sets and can change.** The window is long, and it is finite, so anything the inward pass depends on has to be copied off the host before the archive ages out. Read the current retention from the host rather than from this file, because a number written here is a number nothing checks.