Add configurable logging for mtls-bridge proxy

monitoring/mtls-bridge/app.py

@@ -1,5 +1,6 @@
 import logging
 import os
+import time
 
 import requests
 from flask import Flask, Response, request
@@ -19,6 +20,16 @@ CLIENT_KEY = os.environ.get("CLIENT_KEY", "/certs/client.key")
 CA_CERT = os.environ.get("CA_CERT", "/certs/ca.crt")
 TIMEOUT = int(os.environ.get("TIMEOUT", "5"))
 
+logger.info(
+    "mtls-bridge starting target_url=%s timeout=%ss cert=%s key=%s ca=%s log_level=%s",
+    TARGET_URL,
+    TIMEOUT,
+    CLIENT_CERT,
+    CLIENT_KEY,
+    CA_CERT,
+    os.environ.get("LOG_LEVEL", "INFO"),
+)
+
 
 @app.route("/health", methods=["GET"])
 def health():
@@ -28,28 +39,48 @@ def health():
 @app.route("/", defaults={"path": ""}, methods=["GET", "POST", "PUT", "DELETE", "PATCH"])
 @app.route("/<path:path>", methods=["GET", "POST", "PUT", "DELETE", "PATCH"])
 def proxy(path):
-    logger.info("request method=%s path=/%s", request.method, path)
+    request_path = f"/{path}" if path else "/"
+    request_size = len(request.get_data(cache=True))
+    logger.info(
+        "incoming request method=%s path=%s query=%s remote=%s bytes=%s",
+        request.method,
+        request_path,
+        request.query_string.decode("utf-8", "ignore"),
+        request.remote_addr,
+        request_size,
+    )
 
     if not TARGET_URL:
+        logger.error("TARGET_URL is not set; cannot proxy request")
         return Response("TARGET_URL is not set", status=500)
 
     try:
         url = f"{TARGET_URL.rstrip('/')}/{path}".rstrip("/")
+        start_time = time.time()
         headers = {k: v for k, v in request.headers if k.lower() != "host"}
         headers["X-Forwarded-By"] = "mtls-bridge"
 
+        logger.debug("forwarding request to upstream url=%s headers=%s", url, headers)
+
         resp = requests.request(
             method=request.method,
             url=url,
             headers=headers,
-            data=request.get_data(),
+            data=request.get_data(cache=True),
             cookies=request.cookies,
             cert=(CLIENT_CERT, CLIENT_KEY),
             verify=CA_CERT,
             timeout=TIMEOUT,
         )
 
-        logger.info("upstream status=%s url=%s", resp.status_code, url)
+        elapsed_ms = int((time.time() - start_time) * 1000)
+        logger.info(
+            "upstream response status=%s url=%s elapsed_ms=%s response_bytes=%s",
+            resp.status_code,
+            url,
+            elapsed_ms,
+            len(resp.content),
+        )
 
         excluded_headers = ["content-encoding", "content-length", "transfer-encoding", "connection"]
         response_headers = [

monitoring/mtls-bridge/docker-compose.yml

@@ -11,6 +11,7 @@ services:
       - CLIENT_KEY=/certs/clients/office-pc/office-pc.key
       - CA_CERT=/certs/ca/clents-ca.crt
       - TIMEOUT=5
+      - LOG_LEVEL=${MTLS_BRIDGE_LOG_LEVEL:-INFO}
     volumes:
       - ${PROJECT_ROOT}/core/traefik/certs:/certs:ro
     healthcheck: