[TakGN]

Follows #16. ProbeLab's weekly counts of distinct peers and agent versions have been empty since early October, after the bootstrap.libp2p.io identities moved to these boxes (26c2ffb, 2026-09-29).

Why

ProbeLab's query counts distinct peer and distinct agent from rows with a ts. Info logging from #16 can't supply that. An 8.5-minute sample from lith-1 at info (2026-11-02) had:

• 28,123 lines, 90% of them relay lines, about 0.86 GiB a day uncompressed for that one instance.
• Peer IDs only for some peers: those using the relay service, identify failures, and a hardcoded 1% sample of connections.
• No agent versions at all.

kubo's peerlog plugin is built into the image and logs what's needed. It's off by default.

Line	Fields
connected	ts, peer
identified	ts, peer, agent

Tested with the image we pin (kubo v0.43.1, by digest), in a local container on the public network for 75 seconds, with GOLOG_LOG_LEVEL=error:

• 548 connected and 648 identified lines, from 466 distinct peers and 98 distinct agent versions.
• No IP addresses in any peerlog line.
• The plugin sets its own logger to info, so the lines appear at error.

That node was mostly dialling out, so this has not been tested under a bootstrapper's inbound load.

Change

• roles/bootstrap/files/kubo-config.json: enable peerlog under Plugins.Plugins.
• k8s/bootstrap/deployment.yaml.j2: GOLOG_LOG_LEVEL back to error, which removes the relay lines, and correct the comment from Log kubo at info, in JSON, on the bootstrappers #16, which wrongly said info logs have no peer IDs. GOLOG_LOG_FMT=json stays. The time= lines in the sample were info lines that bypassed the JSON setting, and they go away with error.

This also drops the identify warnings and the 1% connection sample that #16 added.

Checked

• kubo-config.json parses, and bootstrap.yml passes --syntax-check.
• scripts/render-manifests.yml renders, and every overlay builds with kubectl kustomize.
• Rendered bootstrap diff against main: only the log level value. bootstrap-wss unchanged. The kubo config is built by the role, so it isn't in that diff.
• Not run locally: yamllint and ansible-lint (not installed here). CI runs them.
• Not run: bootstrap.yml --check against a box.

Rolling out

bootstrap.yml is applied by hand, so merging changes nothing on the boxes. Applying it restarts each bootstrapper. Start with one box:

ansible-playbook bootstrap.yml --check --diff -l lith-1
ansible-playbook bootstrap.yml -l lith-1

On that box, peerlog lines should appear and dropped events should stay at 0. The plugin drops events when its 64k queue fills. Then run it for the other boxes.

Watch the log volume in Loki after the first box. The estimate is about 0.8 GiB a day uncompressed per instance, from the 1% connection sample (about 22 inbound connections a second on lith-1) and the test's 204-byte average line. That's about the same as #16's level, so far above the level before it.

Worth knowing

• The source calls the plugin "internal, unsupported, and may break at any point". Check it still works when kubo is upgraded.
• agent is free text sent by remote peers. Keep it in the log line and don't make it a Loki label.
• This only puts the data in Loki, which can't do weekly distinct counts over this volume. Getting it to ProbeLab's ClickHouse is separate and not decided. It would share peer IDs and agent versions with them, but no IPs, so it needs a team OK.

🤖 Generated with Claude Code