[thiras]

Closes #84.

What

grafana_alloy used to send every journald line to Grafana Cloud Loki unchanged. When a daemon error quoted the RPC URL, the provider API key ended up in Loki. sponsord does this today:

Error: read PaymentPool.usdc(): error sending request for url (https://<provider>/v2/<api-key>)

A new loki.process "redact_urls" stage now runs first on every unit's line:

loki.source.journal → redact_urls → daemon_level → journal_identity → loki.write

It is two stage.replace stages, matched on :// or JSON's :\/\/ (any scheme, any case):

• userinfo becomes <redacted>. The match runs to the last @ of the whitespace-free token, so a password with unencoded / ? # @ is covered too. The cost is that a URL with an @ in its path loses its host: https://h/users/@x/y comes out as https://<redacted>@x/<redacted>.
• path, query and fragment become /<redacted>, whichever separator it was.

So https://u:p@rpc.example.io/v2/KEY?x=y becomes https://<redacted>@rpc.example.io/<redacted>. The scheme and host stay, so you can still tell which provider it was. A URL with no userinfo and nothing after its host comes out unchanged, and so does a line with no URL.

The match ends at whitespace, " or \". It may swallow punctuation such as reqwest's closing ), which is better than leaking a key. JSON escapes are read as whole pairs (\u0026, \/, \\), so Go's encoding/json, PHP's json_encode and one level of JSON nested in a JSON string are covered, and the line stays valid JSON for the level stage. The stage has no knob.

Not covered: \u002f separators, fully percent-encoded URLs, deeper JSON nesting, a URL that journald splits across records (lines over 48K), a Debug-printed url::Url, and OTLP (#86).

decdn-node: does it leak too? (question from the issue)

No, by design. Upstream decdn/decdn #954/#958 (2026-06-19, included in the pinned 3ebf5f17) sends chain-RPC errors through decdn_common::redact::{sanitize_err_chain, sanitize_rpc_display}, which remove the whole URL. Tests cover it: crates/node/src/buyer_channel.rs::a_chain_read_warning_does_not_log_the_rpc_url and crates/cli/tests/setup_redacts_rpc_error.rs. sponsord has no equivalent, so it is the confirmed leak. This stage is defense in depth for both daemons and every other unit.

Tests

validate.sh (make lint-alloy) runs the rendered stage in the real pinned Alloy 1.19.2 against sample lines, and asserts the exact output for each:

• sponsord's reqwest error, decdn-node JSON with userinfo, a port, a path and a fragment, and a line with two URLs (wss://, HTTP:// with only a query);
• passwords with unencoded #, / or @, a fragment straight after the host, IPv6 with userinfo, userinfo with no path, and an @ in the path;
• JSON escaping: \/ separators, \u0026 in the query and in the userinfo, a URL quoted inside a JSON string, and one level of nested JSON. The escaped and nested samples sit in decdn-node's stream, so its level label proves the redacted JSON still parses;
• lines that must not change: no URL; @ # ? : without a URL; a URL with nothing after its host; plain decdn-node JSON;
• no SECRET-* marker may come through, in any of the four harness configurations;
• in every rendered config that ships the journal, every loki.source.* must feed the redactor, and each later hop (daemon_level, journal_identity, loki.write) must have exactly one feeder, so nothing can bypass it.

Each check was shown to fail when it should:

• the earlier expressions leak SECRET-*;
• a second log source wired past the redactor fails the wiring check;
• with the source pointed back at daemon_level, or the path stage removed, the tests fail.

Local runs: make lint, make lint-ansible, make lint-alloy, make test-scripts and molecule test -s grafana-cloud all pass.

Rollout

config.alloy changes on every host with Grafana Cloud logs on, so the next deploy restarts Alloy once. This is noted in the CHANGELOG.

Out of scope / follow-ups

• OTLP path (grafana_alloy: redact URL credentials on the OTLP path too (traces and OTLP logs) #86): spans and pushed OTLP logs go through otelcol.*, not loki.process. decdn-node already sanitizes at its tracing sites.
• sponsord upstream (sponsord logs the full RPC URL (and its API key) in chain errors sponsord#38): it should redact at the source, as decdn-node does (strip_urls-style). The Alloy stage only catches URL-shaped text.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

JSON-escaped URLs bypass the redactor and can still expose credentials to Loki.

Review effort: Balanced
Findings: 1

Open (1)

• Handle JSON-escaped URL separators during credential redaction · New

What changed in this PR

Adds journald URL-credential redaction to the Grafana Alloy logging pipeline.

Changes:

• Redacts URL userinfo, paths, queries, and fragments before Loki forwarding.
• Adds real-Alloy behavioral tests and Molecule wiring assertions.
• Documents behavior and rollout impact.

File	Description
AGENTS.md	Records the redaction invariant.
ansible/​galaxy/​CHANGELOG.md	Documents the security fix and restart.
ansible/​molecule/​grafana-cloud/​verify.yml	Verifies redactor wiring.
ansible/​roles/​grafana_alloy/​README.md	Documents redaction behavior.
ansible/​roles/​grafana_alloy/​templates/​config.alloy.j2	Adds the redaction stage.
ansible/​tests/​alloy-config/​validate.sh	Tests redaction with real Alloy.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.