[jeremy]

kamal-proxy logs every request's raw path. The credentials Fizzy's routes filter with filter_path_parameters (#3210) still land in the proxy logs and in Loki, on the app hosts and again on the load balancers: join codes, QR code links, session transfers, access-token reveals, public board and collection keys, and email change tokens.

What changes:

• App hosts: saas/config/deploy.yml sets proxy.logging.filter_paths.
• Load balancers: the configure-lb-* scripts pass the same patterns as --log-filter-path, escaped for the remote shell that ssh hands the command to. I checked that a bash -c parse yields the exact patterns.

Matching: board keys are secure tokens, so they're one segment and the column paths after them stay readable. Everything else is filtered to the end of the path, since a signed id can hold a decoded %2F.

Check: I ran these patterns through basecamp/kamal-proxy#258's filter against app_kamal#116's path fixture. No token text survived.

Load balancers: they run basecamp/kamal-proxy:lb, which needs rebuilding with #258 before the scripts are rerun.

Blocked on upstream. Do not merge yet: basecamp/kamal-proxy#258 adds --log-filter-path, and basecamp/kamal#1973 exposes it as proxy: logging: filter_paths:. Until a kamal release with #1973 is in this app's bundle, Kamal rejects the key (proxy/logging: unknown key: filter_paths). Until the hosts' kamal-proxy has #258, the proxy rejects the flag. The kamal bump lands in this PR once the release is out, in Gemfile.lock and Gemfile.saas.lock.

Rollout:

1. Release kamal-proxy with Bump rails from 5520bd8 to 00cc4ff #258 and kamal with Fix lightbox transitionend listener leak #1973.
2. Bump kamal here.
3. Run kamal proxy reboot on each host, onto the new kamal-proxy.
4. Deploy. The deploy passes the filters.

Lines logged before step 4 keep their raw paths, so the Loki delete cutoff for proxy lines is the deploy that finishes step 4.

[Copilot]

🟡 Changes recommended

The bundled Kamal version rejects the new configuration key, so the compatible dependency upgrade remains a merge blocker.

1 open issue

• Upgrade Kamal to support proxy logging filter_paths · New

What changed in this PR

Extends credential-path redaction to kamal-proxy logs on SaaS app hosts and load balancers, complementing application-level filtering.

Changes:

• Adds credential-path patterns to app-host proxy logging.
• Passes matching, shell-escaped filters to staging, production, and beta load balancers.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
saas/​script/​configure-lb-staging.sh	Applies filters to staging load balancers.
saas/​script/​configure-lb-production.sh	Applies filters to production load balancers.
saas/​script/​configure-lb-beta.sh	Applies filters to the beta load balancer.
saas/​config/​deploy.yml	Configures app-host proxy path filtering.

_{Review effort: Balanced}