feature: the web service serves the last lines of the journal of the router's units and of the log files web.log_files lists, at /logs.

README.md

@@ -130,6 +130,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `web` | `status_content` | string | `basic` | What `/` and `/status` show: `basic`, `standard` or `full` (see Status web service) |
 | `web` | `shell` | boolean | `false` | `/shell` opens a login shell for a member of `admins` with console login (see The shell) |
 | `web` | `shell_idle_minutes` | integer | `15` | Minutes without a keystroke after which a shell is closed, 1 to 1440 |
+| `web` | `log_files` | list | | Absolute paths of the log files `/logs` shows, at most 32 (see The /logs API) |
 | `web` | `shell_auth_timeout` | integer | `15` | Minutes after the last use of a shell in which a new shell opens without signing in again, 0 (always sign in) to 1440 |
 | `ssh` | `ldap_login` | boolean | `false` | sshd accepts the directory password of the console accounts in the directory (see Console login and SSH) |
 | `https` | `enabled` | boolean | `true` | Caddy serves the status web service and the Router Manager over HTTPS for `wan.local_fqdn` |
@@ -940,6 +941,7 @@ curl http://10.0.0.4:17081/
 | `/groups` | The groups of users; needs a token |
 | `/site-to-site` | The site-to-site connections: list, add, change and remove; needs a token |
 | `/account` | The account of the signed-in user: its details, its password and its TOTP enrolment; needs a user's token |
+| `/logs` | The last lines of the journal of the router's units and of the files of `web.log_files`; needs a token |
 | `/.well-known/openid-configuration`, `/oidc/...` | The OpenID Provider, on `127.0.0.1` only, where Caddy passes the requests (see OpenID Provider) |
 
 The status holds the state of `vpn-router-setup`, `slapd` and each PostgreSQL cluster unit
@@ -963,7 +965,7 @@ curl http://10.0.0.4:7081/status
 
 ### Tokens and signing in
 
-`/config`, `/users`, `/service-accounts`, `/groups`, `/site-to-site`, `/backup`, `/remote-access`, `/ca`, `/shell` and `/account` need a JWT in an `Authorization: Bearer` header, signed with
+`/config`, `/users`, `/service-accounts`, `/groups`, `/site-to-site`, `/backup`, `/remote-access`, `/ca`, `/logs`, `/shell` and `/account` need a JWT in an `Authorization: Bearer` header, signed with
 HS256 by the key the web service makes on its first run, `/etc/vpn-router/web.key` (root only).
 The key never leaves the router; while it does not exist these paths and `/auth` are not served
 (404). A missing, expired or wrongly signed token, or one of another algorithm, gets 401 with
@@ -1078,6 +1080,27 @@ router:
 - **A cluster that is not online:** `databases` and `size` are `null`.
 - **Collection:** the web service reads it with `psql` as the `postgres` user at each request.
 
+### The /logs API
+
+`/logs`, with the same token as `/config`, shows the last lines of the journal and of log files,
+read at each request:
+
+| Request | Answer |
+| --- | --- |
+| `GET /logs` | `{"units", "files", "max_lines"}`: the units whose journal it shows, the files of `web.log_files` and the most lines one request answers, 1000 |
+| `GET /logs/journal?unit=<unit>&lines=<n>` | `{"lines": [...]}`: the last lines of the unit's journal, or of the whole journal without `unit`, with ISO times |
+| `GET /logs/file?path=<path>&lines=<n>` | `{"lines": [...]}`: the last lines of a file `web.log_files` lists |
+
+The units are the package's own (`vpn-router-setup`, `-web`, `-metrics`, `-pki`, `-backup`,
+`-caddy`), `vpn-router-manager`, `caddy`, `slapd`, `nslcd`, `postgresql`, `strongswan`,
+`wg-quick@wg0`, `openvpn-server@vpn-router` and `ssh`. `lines` is 1 to 1000, 200 without it. A
+file is read from at most its last MiB, so very long lines give fewer lines. A unit or a file not
+in the lists is 404, as is a listed file that does not exist.
+
+```sh
+vpn-config-edit set web.log_files /var/log/syslog,/var/log/auth.log
+```
+
 ### The /users API
 
 `/users` manages users with the same token as `/config`, with the module `vpn-router-user` uses