Question: AKHQ behind reverse proxy

[gquintana]

• Which HTTP endpoint should be used for the health check? /ui/login ?

• The AKHQ Access Logger doesn't report the client IP in the X-Forwarded-For header, is there a configuration? What is the rationale behind AKHQ Access Logger vs Micronaut Access Logger

[tchiotludo]

• you should use the monitoring endpoint & here, by default on the port 8081 and responding 200 on /health path
• No there is no configuration for this, I need to move to micronaut one, I previous release of micronaut, there is no access logger, so I create 1 myself, but I think now, we can safely replace by the micronaut one, PR are welcome 😄

[gquintana]

Thanks for you answer:

• About Health endpoint attacker by the reverse proxy: The health endpoint opens another port which must be secured. When running in Docker it's pretty easy, the port is not visible from outside of the container and you're done. Without Docker, this endpoint must be secured (stupid HTTPS requirement in my case). So I think I'll stick with login endpoint.
• About Access Logs contained real client IP: The Micronaut Access Logger can be configured to do the job (see below), sadly it doesn't report user properly (from the doc %l - Remote logical username from identd (always returns '-') and later %u - Remote user that was authenticated. Not implemented. Prints '-'.). AKHQ Access Logger does this part properly.

Micronaut Access Log configuration:

micronaut:
    netty:
      access-logger:
        enabled: true
        log-format: '%{X-Forwarded-For}i %l %u %t "%r" %s %b'

 <appender name="ACCESSLOG" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>${log.dir}/akhq-access.log</file>
        <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
            <fileNamePattern>${log.dir}/akhq-access.%d{yyyy-MM-dd}-%i.log</fileNamePattern>
            <maxFileSize>10MB</maxFileSize>
            <maxHistory>5</maxHistory>
            <totalSizeCap>50MB</totalSizeCap>
        </rollingPolicy>
        <encoder>
            <pattern>%date{ISO8601} %-5level [%thread] %logger - %msg%n</pattern>
        </encoder>
    </appender>
    <logger name="HTTP_ACCESS_LOGGER" additivity="false">
        <appender-ref ref="ACCESSLOG"/>
    </logger>