From 83b12e19776ce0233208b8c3505074592f19db41 Mon Sep 17 00:00:00 2001
From: Simon Bruder <simon@sbruder.de>
Date: Sat, 12 Oct 2024 12:32:37 +0200
Subject: [PATCH] nginx: Lower default error log severity

---
 modules/nginx.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/modules/nginx.nix b/modules/nginx.nix
index 03b2934..09c93a5 100644
--- a/modules/nginx.nix
+++ b/modules/nginx.nix
@@ -35,9 +35,12 @@ in
       '';
     })
     (lib.mkIf cfg.privacy.enable {
-      services.nginx.commonHttpConfig = ''
-        access_log off;
-      '';
+      services.nginx = {
+        logError = "stderr crit"; # error (the default severity) logs potential PII (IP addresses) on 404 errors
+        commonHttpConfig = ''
+          access_log off;
+        '';
+      };
     })
     (lib.mkIf cfg.recommended.enable {
       services.nginx = {