Privacy-friendly access log format option

[sylvesterdamgaard]

Motivation

The default nginx combined log format includes the full request URI — which means query strings end up on disk and in any log shipper downstream. Plenty of apps put PII in query strings (search terms, magic-link tokens, OAuth code=... callbacks), so this becomes a GDPR/data-handling concern.

Common patterns we want to support out of the box:

• combined_no_query: same as combined but logs path only, query stripped. Privacy-conscious sites default to this.
• json: structured logging for log shippers (Loki, Datadog, ELK). Avoids brittle regex parsing.
• combined: keep as opt-in default for users who haven't thought about it.

Proposal

Add NGINX_LOG_FORMAT env var with three built-in choices:

NGINX_LOG_FORMAT=combined            # (default — back-compat)
NGINX_LOG_FORMAT=combined_no_query   # privacy
NGINX_LOG_FORMAT=json                # structured

The template renders the corresponding log_format definition + access_log directive. Custom formats remain possible via volume-mounted config.

Acceptance criteria

• Three formats selectable via env var
• Default unchanged (combined) — no breaking change
• Documented with example log lines per format
• JSON format includes at minimum: timestamp, method, path, status, request_time, upstream_response_time, ua, remote_addr