From 97a561c56bfa5cd2eddafb95d4256c973e1def46 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zolt=C3=A1n=20Papp?= <zoltan.pmail@gmail.com>
Date: Fri, 13 Feb 2026 12:42:00 +0100
Subject: [PATCH] Add structured logging for HTTP server errors

---
 proxy/log.go    | 21 +++++++++++++++++++++
 proxy/server.go | 11 +++++++----
 2 files changed, 28 insertions(+), 4 deletions(-)
 create mode 100644 proxy/log.go

diff --git a/proxy/log.go b/proxy/log.go
new file mode 100644
index 000000000..79562989e
--- /dev/null
+++ b/proxy/log.go
@@ -0,0 +1,21 @@
+package proxy
+
+import (
+	stdlog "log"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// HTTP server type identifiers for logging
+	logtagFieldHTTPServer = "http-server"
+	logtagValueHTTPS      = "https"
+	logtagValueACME       = "acme"
+	logtagValueDebug      = "debug"
+)
+
+// newHTTPServerLogger creates a standard library logger that writes to logrus
+// with the specified server type field.
+func newHTTPServerLogger(logger *log.Logger, serverType string) *stdlog.Logger {
+	return stdlog.New(logger.WithField(logtagFieldHTTPServer, serverType).WriterLevel(log.WarnLevel), "", 0)
+}
diff --git a/proxy/server.go b/proxy/server.go
index 096e1be5c..3de8bd24c 100644
--- a/proxy/server.go
+++ b/proxy/server.go
@@ -221,8 +221,9 @@ func (s *Server) ListenAndServe(ctx context.Context, addr string) (err error) {
 		// Only start HTTP server for HTTP-01 challenge type
 		if s.ACMEChallengeType == "http-01" {
 			s.http = &http.Server{
-				Addr:    s.ACMEChallengeAddress,
-				Handler: s.acme.HTTPHandler(nil),
+				Addr:     s.ACMEChallengeAddress,
+				Handler:  s.acme.HTTPHandler(nil),
+				ErrorLog: newHTTPServerLogger(s.Logger, logtagValueACME),
 			}
 			go func() {
 				if err := s.http.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
@@ -272,8 +273,9 @@ func (s *Server) ListenAndServe(ctx context.Context, addr string) (err error) {
 			debugHandler.SetCertStatus(s.acme)
 		}
 		s.debug = &http.Server{
-			Addr:    debugAddr,
-			Handler: debugHandler,
+			Addr:     debugAddr,
+			Handler:  debugHandler,
+			ErrorLog: newHTTPServerLogger(s.Logger, logtagValueDebug),
 		}
 		go func() {
 			s.Logger.Infof("starting debug endpoint on %s", debugAddr)
@@ -304,6 +306,7 @@ func (s *Server) ListenAndServe(ctx context.Context, addr string) (err error) {
 		Addr:      addr,
 		Handler:   s.meter.Middleware(accessLog.Middleware(web.AssetHandler(s.auth.Protect(s.proxy)))),
 		TLSConfig: tlsConfig,
+		ErrorLog:  newHTTPServerLogger(s.Logger, logtagValueHTTPS),
 	}
 
 	httpsErr := make(chan error, 1)