From 368cda2b76b7e0761163b859c2d4c7b6bf0b9b0f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Pedro=20Toledo?= <joao.goncalves@itguys.com.br>
Date: Fri, 6 Feb 2026 13:17:20 -0300
Subject: [PATCH] feat: split logs into human-readable (stdout) and json (file)
 for better observability

---
 fail2ban/data/jail.d/nginx-modsec.local | 2 +-
 nginx/nginx.conf                        | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/fail2ban/data/jail.d/nginx-modsec.local b/fail2ban/data/jail.d/nginx-modsec.local
index 59b8956..cb1816d 100644
--- a/fail2ban/data/jail.d/nginx-modsec.local
+++ b/fail2ban/data/jail.d/nginx-modsec.local
@@ -2,7 +2,7 @@
 enabled = true
 port = http,https
 filter = nginx-modsec
-logpath = /var/log/nginx/access.log
+logpath = /var/log/nginx/access_json.log
 maxretry = 3
 bantime = 3600
 findtime = 600
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index fcf8fa1..e350694 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -34,9 +34,12 @@ http {
     # Compression (Brotli + Gzip)
     include /etc/nginx/snippets/compression.conf;
 
-    # Logging JSON (Detailed)
+    # Logging JSON (Detailed) - For Fail2Ban / Analysis
     include /etc/nginx/snippets/log_formats.conf;
-    access_log /var/log/nginx/access.log detailed_proxy;
+    access_log /var/log/nginx/access_json.log detailed_proxy;
+    
+    # Logging Human Readable - For Docker Logs / User
+    access_log /dev/stdout combined;
 
     # SSL Settings (Global)
     ssl_session_cache shared:SSL:50m;