fix(proxy): send bounded access records through namespace syslog

backend/tests/test_delivery.py

@@ -877,6 +877,18 @@ def test_proxy_is_separate_from_private_execution_control():
     assert "proxy_request_buffering off" in contents
     assert "$request_uri" not in contents and "$http_cookie" not in contents
     assert value["key_sha256"] not in contents
+    # systemd journal stdout is a socket, not a reopenable log file. Keep access
+    # records on the local namespace socket and restrict their fields to counters.
+    destination, format_name = re.findall(r"^\s+access_log (\S+) (\w+);$", contents, re.M)[0]
+    assert destination.startswith("syslog:server=unix:/")
+    assert format_name == "bounded" and "/dev/stdout" not in contents
+    log_fields = re.findall(r"^\s+log_format bounded '([^']+)';$", contents, re.M)[0]
+    assert log_fields.split() == [
+        "$request_method",
+        "$status",
+        "$body_bytes_sent",
+        "$request_time",
+    ]
 
 
 def test_all_enabled_nginx_temporary_paths_use_only_the_bounded_proxy_volume():

scripts/release/README.md

@@ -249,6 +249,10 @@ API launchers disable access logging so queries are not copied to logs.
 Development diagnostics remain separate. Verify real routing, privacy and capacity
 on the installed node.
 
+NGINX sends access records to the namespace's local syslog socket. Records contain
+only method, status, response byte count and request duration; request paths,
+queries, cookies and hostname are omitted.
+
 ## Readiness and maintenance
 
 `python3.13 -m scripts.release.node_health` checks admission preconditions in one
@@ -435,7 +439,8 @@ outside public API, Git and CI artifacts.
   [CLI](https://www.rabbitmq.com/docs/man/rabbitmqctl.8).
 - NGINX: [core](https://nginx.org/en/docs/http/ngx_http_core_module.html),
   [proxy module](https://nginx.org/en/docs/http/ngx_http_proxy_module.html),
-  [TLS module](https://nginx.org/en/docs/http/ngx_http_ssl_module.html).
+  [TLS module](https://nginx.org/en/docs/http/ngx_http_ssl_module.html),
+  [syslog](https://nginx.org/en/docs/syslog.html).
 - systemd: [credentials](https://systemd.io/CREDENTIALS/),
   [namespace interface](https://github.com/systemd/systemd/blob/v262/man/systemd.exec.xml),
   [journal configuration](https://github.com/systemd/systemd/blob/v262/man/journald.conf.xml).

scripts/release/proxy.py

@@ -87,7 +87,7 @@ http {
     }
     default_type application/octet-stream;
     log_format bounded '$request_method $status $body_bytes_sent $request_time';
-    access_log /dev/stdout bounded;
+    access_log syslog:server=unix:/dev/log,tag=kf-proxy,nohostname,severity=info bounded;
     server_tokens off;
     limit_conn_zone $binary_remote_addr zone=per_client:64k;
     limit_conn_zone $server_name zone=per_site:64k;