Make web proxy request logging opt-in

crates-server/yaak-web/src/guard.rs

@@ -11,7 +11,7 @@
 //! resolves every hop.
 
 use async_trait::async_trait;
-use log::warn;
+use log::debug;
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 use std::sync::Arc;
 use tokio::sync::mpsc;
@@ -186,7 +186,7 @@ impl<S: HttpSender> HttpSender for GuardedSender<S> {
         event_tx: mpsc::Sender<HttpResponseEvent>,
     ) -> yaak_http::error::Result<HttpResponse> {
         if let Err(reason) = self.policy.check_url(&request.url) {
-            warn!("Refused {} {}: {reason}", request.method, request.url);
+            debug!("Refused {} {}: {reason}", request.method, request.url);
             return Err(yaak_http::error::Error::RequestError(reason));
         }
         self.inner.send(request, event_tx).await

crates-server/yaak-web/src/lib.rs

@@ -27,7 +27,7 @@ use axum::routing::{get, post};
 pub use config::Config;
 use guard::DestinationPolicy;
 use limits::RateLimiter;
-use log::{info, warn};
+use log::{debug, info, warn};
 use send::{Refusal, SendLimits};
 use serde_json::json;
 use std::net::{IpAddr, SocketAddr};
@@ -40,6 +40,9 @@ use tower_http::cors::{AllowOrigin, CorsLayer};
 use tower_http::services::{ServeDir, ServeFile};
 use wire::SendRequest;
 
+/// Minimal operational logging; request diagnostics require an explicit `RUST_LOG` setting.
+pub const DEFAULT_LOG_FILTER: &str = "warn,yaak_http=error";
+
 #[derive(Clone)]
 struct AppState {
     config: Arc<Config>,
@@ -181,7 +184,7 @@ async fn send_http(
 ) -> Response {
     let ip = client_ip(&state.config, &headers, peer);
     if let Err(wait) = state.rate_limiter.check(ip) {
-        warn!("Rate limited {ip}");
+        debug!("Rate limited {ip}");
         let mut res = error_response(
             StatusCode::TOO_MANY_REQUESTS,
             format!("Rate limit reached; try again in {}s", wait.as_secs().max(1)),
@@ -191,7 +194,7 @@ async fn send_http(
     }
 
     let Ok(permit) = state.in_flight.clone().try_acquire_owned() else {
-        warn!("At capacity; refusing {ip}");
+        debug!("At capacity; refusing {ip}");
         return error_response(StatusCode::SERVICE_UNAVAILABLE, "This server is at capacity");
     };
 
@@ -200,13 +203,13 @@ async fn send_http(
         Err(Refusal::Unsupported(m)) => return error_response(StatusCode::BAD_REQUEST, m),
         Err(Refusal::Invalid(m)) => return error_response(StatusCode::BAD_REQUEST, m),
         Err(Refusal::Destination(m)) => {
-            warn!("Refused send from {ip}: {m}");
+            debug!("Refused send from {ip}: {m}");
             return error_response(StatusCode::FORBIDDEN, m);
         }
     };
 
     let description = prepared.describe();
-    info!("{ip} -> {description}");
+    debug!("{ip} -> {description}");
     let started = Instant::now();
 
     let (tx, rx) = tokio::sync::mpsc::channel(send::FRAME_CHANNEL_CAPACITY);

crates-server/yaak-web/src/main.rs

@@ -7,7 +7,10 @@ use yaak_web::{Config, router};
 
 #[tokio::main]
 async fn main() {
-    env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("info")).init();
+    env_logger::Builder::from_env(
+        env_logger::Env::default().default_filter_or(yaak_web::DEFAULT_LOG_FILTER),
+    )
+    .init();
     let config = Config::parse();
     let bind = config.bind;
     let rate_limit_per_minute = config.rate_limit_per_minute;

crates-server/yaak-web/src/send.rs

@@ -9,7 +9,7 @@ use crate::guard::{DestinationPolicy, GuardedSender};
 use crate::wire::{Frame, SendRequest};
 use base64::Engine;
 use bytes::Bytes;
-use log::{info, warn};
+use log::{debug, warn};
 use std::convert::Infallible;
 use std::sync::Arc;
 use std::sync::atomic::{AtomicU64, Ordering};
@@ -344,7 +344,8 @@ async fn write_frame(frames: &FrameSender, frame: &Frame) -> Result<(), ()> {
     let mut line = match serde_json::to_vec(frame) {
         Ok(v) => v,
         Err(e) => {
-            warn!("Failed to serialize frame: {e}");
+            warn!("Failed to serialize response frame");
+            debug!("Frame serialization error: {e}");
             return Err(());
         }
     };
@@ -352,7 +353,7 @@ async fn write_frame(frames: &FrameSender, frame: &Frame) -> Result<(), ()> {
     frames.send(Ok(Bytes::from(line))).await.map_err(|_| ())
 }
 
-/// Log a finished send at info: destination, outcome, and how long, never the content.
+/// Request diagnostics are opt-in, including destinations and completion timing.
 pub fn log_outcome(description: &str, started: Instant, outcome: &str) {
-    info!("{description} -> {outcome} in {:?}", started.elapsed());
+    debug!("{description} -> {outcome} in {:?}", started.elapsed());
 }