# dozzle_n8n_logging

n8n-driven Docker log alerting for the Coolify host at `twala.rahamafresh.com`. Critical errors fan out to **ntfy** (self-hosted) and **WhatsApp** (via Evolution API); lower-severity events go to ntfy only.

Dozzle stays as the human-facing log viewer. This project does **not** integrate with Dozzle — it reads Docker logs independently via a small read-only proxy.

## Layout

```
log-proxy/    FastAPI app, only thing with docker.sock access. /services + /logs/<group> + /healthz.
coolify/      Coolify Docker Compose file for log-proxy.
ntfy/         Deploy notes for self-hosted ntfy.
n8n/          Exported workflow JSON (poll-<group>.json + notify.json).
```

## Architecture

```
Docker Engine     log-proxy (RO sock)     n8n queue-mode
   socket  ────►  HTTP /logs/<group> ────►  poll → match → threshold → notify
                                                                  │
                                              ┌───────────────────┴───────────────────┐
                                              ▼                                       ▼
                                         ntfy.rahamafresh.com           Evolution API (WhatsApp)
```

Service groups are auto-derived from each container's `COOLIFY_RESOURCE_UUID`. The allow-list (and friendly names) live in `log-proxy/groups.yml`.

Severity defaults:

| Severity | Threshold | Cooldown | Channels |
| --- | --- | --- | --- |
| critical | 1 match (immediate) | 30 min | ntfy + WhatsApp |
| error    | 10 / 5 min          | 15 min | ntfy |
| warn     | 50 / 15 min         | 30 min | ntfy (low prio) |

See `260517_docker_n8n_logging.md` for the full design rationale.

## Adding a new service group

1. Append a line to `log-proxy/groups.yml`: `<coolify-uuid>: <friendly-name>`
2. Restart the `log-proxy` Coolify service
3. In n8n: duplicate `poll-tracksolid` workflow, retarget its `group` Variable, tune severity patterns/thresholds, activate

## Operating

- Tune thresholds: edit the `severity` Variables block at the top of each `poll-<group>` workflow.
- Silence during maintenance: deactivate the workflow in n8n (or set a global `silenced=true` flag in the Notify workflow's Variables).
- Rotate ntfy publisher credential: update the credential in n8n; restart workflows.

## Status

Bootstrap (2026-05-17): log-proxy code complete; n8n workflows, ntfy deploy, and Coolify deploy still pending.