security(caddy-logs): would be great to add user-agent on the caddy logs

[mota-lhd]

I can add this if you authorise me to open a PR :)

[gregsadetsky]

hey - I remember having this thought some moons ago, but I wonder what would we gain from doing so? do you know if Coolify/Dokku/Kamal/other self hosting options do this? thanks

(also, it's probably better to discuss PRs before opening them, but - you are always free to fork the daemon and open a PR from your own cloned copy..!)

[mota-lhd]

as for kamal/dokku/etc. i don't know.

it is mainly for seeing devices used by our users.

[gregsadetsky]

oh, I apologize, I misread: I thought you wanted to add a "Disco" identifier to the Server response, rather than logging the incoming user-agent value. my wires got crossed because of the other PR/issue we were discussing! Sorry

I did think that the user-agent was being logged right now. Oh - I think that what's happening is that the caddy logs don't log them (because of the headers that get deleted), but apps do have access to the request headers (obviously) and can log those, if they choose to do so

Does that make sense? I agree that it might make sense to log more headers at the caddy level. I'll re-open this issue so that we can consider what could be our options here (ie log every header, no header, some headers, etc.) Thanks!

P.S. Have you deployed a Disco app and tried logging the user agent there?

[mota-lhd]

no, because i don't control all the images i deploy.
if i control the image, yes. definitely possible. if i deploy a self hosted service, then no. it is worth it to keep it on caddy level imho.

[gregsadetsky]

That's a good point re: images!