Fix mtls-bridge CA path and reduce healthcheck log noise

monitoring/mtls-bridge/app.py

@@ -1,8 +1,9 @@
 import logging
 import os
+import time
 
 import requests
-from flask import Flask, Response, request
+from flask import Flask, Response, g, request
 
 app = Flask(__name__)
 
@@ -11,6 +12,7 @@ logging.basicConfig(
     format="%(asctime)s %(levelname)s %(message)s",
 )
 logger = logging.getLogger("mtls-bridge")
+logging.getLogger("werkzeug").setLevel(logging.WARNING)
 
 # Config via env
 TARGET_URL = os.environ.get("TARGET_URL")
@@ -19,37 +21,87 @@ CLIENT_KEY = os.environ.get("CLIENT_KEY", "/certs/client.key")
 CA_CERT = os.environ.get("CA_CERT", "/certs/ca.crt")
 TIMEOUT = int(os.environ.get("TIMEOUT", "5"))
 
+logger.info(
+    "mtls-bridge starting target_url=%s timeout=%ss cert=%s key=%s ca=%s log_level=%s",
+    TARGET_URL,
+    TIMEOUT,
+    CLIENT_CERT,
+    CLIENT_KEY,
+    CA_CERT,
+    os.environ.get("LOG_LEVEL", "INFO"),
+)
+
 
 @app.route("/health", methods=["GET"])
 def health():
+    logger.debug("healthcheck request from %s", request.remote_addr)
     return "OK", 200
 
 
+@app.before_request
+def before_request():
+    g.request_start = time.time()
+
+
+@app.after_request
+def after_request(response):
+    elapsed_ms = int((time.time() - g.request_start) * 1000)
+    if request.path != "/health":
+        logger.info(
+            "request complete method=%s path=%s status=%s elapsed_ms=%s",
+            request.method,
+            request.path,
+            response.status_code,
+            elapsed_ms,
+        )
+    return response
+
+
 @app.route("/", defaults={"path": ""}, methods=["GET", "POST", "PUT", "DELETE", "PATCH"])
 @app.route("/<path:path>", methods=["GET", "POST", "PUT", "DELETE", "PATCH"])
 def proxy(path):
-    logger.info("request method=%s path=/%s", request.method, path)
+    request_path = f"/{path}" if path else "/"
+    request_size = len(request.get_data(cache=True))
+    logger.info(
+        "incoming request method=%s path=%s query=%s remote=%s bytes=%s",
+        request.method,
+        request_path,
+        request.query_string.decode("utf-8", "ignore"),
+        request.remote_addr,
+        request_size,
+    )
 
     if not TARGET_URL:
+        logger.error("TARGET_URL is not set; cannot proxy request")
         return Response("TARGET_URL is not set", status=500)
 
     try:
         url = f"{TARGET_URL.rstrip('/')}/{path}".rstrip("/")
+        start_time = time.time()
         headers = {k: v for k, v in request.headers if k.lower() != "host"}
         headers["X-Forwarded-By"] = "mtls-bridge"
 
+        logger.debug("forwarding request to upstream url=%s headers=%s", url, headers)
+
         resp = requests.request(
             method=request.method,
             url=url,
             headers=headers,
-            data=request.get_data(),
+            data=request.get_data(cache=True),
             cookies=request.cookies,
             cert=(CLIENT_CERT, CLIENT_KEY),
             verify=CA_CERT,
             timeout=TIMEOUT,
         )
 
-        logger.info("upstream status=%s url=%s", resp.status_code, url)
+        elapsed_ms = int((time.time() - start_time) * 1000)
+        logger.info(
+            "upstream response status=%s url=%s elapsed_ms=%s response_bytes=%s",
+            resp.status_code,
+            url,
+            elapsed_ms,
+            len(resp.content),
+        )
 
         excluded_headers = ["content-encoding", "content-length", "transfer-encoding", "connection"]
         response_headers = [

monitoring/mtls-bridge/docker-compose.yml

@@ -9,8 +9,9 @@ services:
       - TARGET_URL=https://node-red.lan.ddnsgeek.com/docker-update-lockouts/clear
       - CLIENT_CERT=/certs/clients/office-pc/office-pc.crt
       - CLIENT_KEY=/certs/clients/office-pc/office-pc.key
-      - CA_CERT=/certs/ca/clents-ca.crt
+      - CA_CERT=/certs/ca/clients-ca.crt
       - TIMEOUT=5
+      - LOG_LEVEL=${MTLS_BRIDGE_LOG_LEVEL:-INFO}
     volumes:
       - ${PROJECT_ROOT}/core/traefik/certs:/certs:ro
     healthcheck: