From 9cef2751499923786b2b4cf9b16cf23ec65c331d Mon Sep 17 00:00:00 2001
From: Matthias Wright <matthias.s.wright@gmail.com>
Date: Thu, 9 Jul 2026 16:12:48 +0800
Subject: [PATCH] feat: add logrotate for OpenResty access/error logs

---
 deploy_gcp/seismic_deploy/ssh/deploy.py  |  7 +++++++
 deploy_gcp/seismic_deploy/templates.py   |  5 +++++
 deploy_gcp/templates/logrotate-openresty | 15 +++++++++++++++
 3 files changed, 27 insertions(+)
 create mode 100644 deploy_gcp/templates/logrotate-openresty

diff --git a/deploy_gcp/seismic_deploy/ssh/deploy.py b/deploy_gcp/seismic_deploy/ssh/deploy.py
index a37412e6..ede68f97 100644
--- a/deploy_gcp/seismic_deploy/ssh/deploy.py
+++ b/deploy_gcp/seismic_deploy/ssh/deploy.py
@@ -11,6 +11,7 @@
 from deploy_gcp.seismic_deploy.ssh.connection import SSHConnection
 from deploy_gcp.seismic_deploy.templates import (
     read_bash_aliases,
+    read_logrotate_conf,
     render_lua_scripts,
     render_nginx,
     render_supervisor,
@@ -44,6 +45,12 @@ def deploy_nginx(conn: SSHConnection, config: DeploymentConfig) -> None:
     click.echo("  Uploading nginx config...")
     conn.upload_content(content, "/tmp/nginx.conf")
     conn.exec("sudo mv /tmp/nginx.conf /usr/local/openresty/nginx/conf/nginx.conf")
+    click.echo("  Installing logrotate config...")
+    conn.upload_content(read_logrotate_conf(), "/tmp/logrotate-openresty")
+    conn.exec("sudo mv /tmp/logrotate-openresty /etc/logrotate.d/openresty")
+    conn.exec("sudo chown root:root /etc/logrotate.d/openresty")
+    conn.exec("sudo chmod 644 /etc/logrotate.d/openresty")
+
     click.echo("  Testing nginx config...")
     conn.exec("sudo openresty -t")
     click.echo("  Reloading OpenResty...")
diff --git a/deploy_gcp/seismic_deploy/templates.py b/deploy_gcp/seismic_deploy/templates.py
index b81afa0f..332f0990 100644
--- a/deploy_gcp/seismic_deploy/templates.py
+++ b/deploy_gcp/seismic_deploy/templates.py
@@ -56,6 +56,11 @@ def render_lua_scripts(
     return scripts
 
 
+def read_logrotate_conf() -> str:
+    """Read the OpenResty logrotate config as-is (no substitution needed)."""
+    return (TEMPLATES_DIR / "logrotate-openresty").read_text()
+
+
 def read_bash_aliases() -> str:
     """Read the bash_aliases template as-is (no substitution needed)."""
     return (TEMPLATES_DIR / "bash_aliases").read_text()
diff --git a/deploy_gcp/templates/logrotate-openresty b/deploy_gcp/templates/logrotate-openresty
new file mode 100644
index 00000000..8fc0e056
--- /dev/null
+++ b/deploy_gcp/templates/logrotate-openresty
@@ -0,0 +1,15 @@
+/usr/local/openresty/nginx/logs/*.log {
+    daily
+    maxsize 100M
+    rotate 14
+    missingok
+    notifempty
+    compress
+    delaycompress
+    sharedscripts
+    postrotate
+        if [ -f /usr/local/openresty/nginx/logs/nginx.pid ]; then
+            kill -USR1 "$(cat /usr/local/openresty/nginx/logs/nginx.pid)"
+        fi
+    endscript
+}