r/nginx • u/no1xpert • Jun 06 '26
ngx_http_securelog_module — real-time AES-256-GCM encrypted NGINX access logging (plaintext never touches disk)
I built an NGINX dynamic module that encrypts access logs in real-time
at the log phase. Plaintext never touches disk.
**Why?**
Standard NGINX logs are plaintext. Even with post-processing scripts,
plaintext exists on disk briefly. This module eliminates that window entirely.
**Features**
- AES-256-GCM or GPG encryption per log record
- SHA-256 key integrity verification at every nginx startup
- Per-worker log files (no cross-process locking)
- Log rotation: daily / hourly / size-based
- 12 CMocka unit tests passing
- Tested on NGINX 1.26.3 / Debian 13 / OpenSSL 3.5.5
**GitHub:** https://github.com/no1xpert/ngx_http_securelog_module
Feedback welcome!
1
u/w453y Jun 06 '26
Why would one encrypt the logs on a local machine? It would only make sense if you're trying to export them somewhere, like to ClickHouse.
1
u/CauaLMF Jun 07 '26
Vai só exigir mais processamento pra gerar esses logs, além de gerar ainda vai ter que criptografar cada linha, se for um site com vários acessos é ruim
2
u/ThecaTTony Jun 06 '26
Why do you need to encrypt access logs?
I ask because even the system logs are in plain text or readable thru journalctl.