From d08f4e4221df047027b809ef18efd63f8da03f3d Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Tue, 24 Feb 2026 08:56:32 -0400
Subject: [PATCH] v1.2.28 - Add debug_level config setting: live update every
 60s without restart, default 0

---
 ...ey fail auth again, we ban for another 24 hours |  0
 src/config.c                                       | 14 ++++++++++++++
 src/default_config_event.h                         |  4 ++++
 src/main.h                                         |  4 ++--
 src/websockets.c                                   |  8 ++++++++
 5 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100644 After 24 hours, if they fail auth again, we ban for another 24 hours

diff --git a/After 24 hours, if they fail auth again, we ban for another 24 hours b/After 24 hours, if they fail auth again, we ban for another 24 hours
new file mode 100644
index 0000000..e69de29
diff --git a/src/config.c b/src/config.c
index 1ca8170..e90b7f4 100644
--- a/src/config.c
+++ b/src/config.c
@@ -952,6 +952,20 @@ static int validate_config_field(const char* key, const char* value, char* error
         return 0;
     }
 
+    // Debug level (0-5)
+    if (strcmp(key, "debug_level") == 0) {
+        if (!is_valid_positive_integer(value) && strcmp(value, "0") != 0) {
+            snprintf(error_msg, error_size, "invalid debug_level '%s' (must be 0-5)", value);
+            return -1;
+        }
+        int val = atoi(value);
+        if (val < 0 || val > 5) {
+            snprintf(error_msg, error_size, "debug_level '%s' out of range (0-5)", value);
+            return -1;
+        }
+        return 0;
+    }
+
     // IP auth failure ban settings
     if (strcmp(key, "auth_fail_ban_enabled") == 0) {
         if (!is_valid_boolean(value)) {
diff --git a/src/default_config_event.h b/src/default_config_event.h
index 0f5c373..4d3d244 100644
--- a/src/default_config_event.h
+++ b/src/default_config_event.h
@@ -83,6 +83,10 @@ static const struct {
     // IP-based rate limiting or access control (which would require firewall protection anyway)
     {"trust_proxy_headers", "true"},
 
+    // Debug Level (0=none, 1=errors, 2=warnings, 3=info, 4=debug, 5=trace)
+    // Can be changed at runtime without restart via config_set admin command
+    {"debug_level", "0"},
+
     // IP Auth Failure Ban Settings
     // Ban IPs that repeatedly fail NIP-42 authentication
     {"auth_fail_ban_enabled", "true"},
diff --git a/src/main.h b/src/main.h
index 5f109c0..d0ee904 100644
--- a/src/main.h
+++ b/src/main.h
@@ -13,8 +13,8 @@
 // Using CRELAY_ prefix to avoid conflicts with nostr_core_lib VERSION macros
 #define CRELAY_VERSION_MAJOR 1
 #define CRELAY_VERSION_MINOR 2
-#define CRELAY_VERSION_PATCH 27
-#define CRELAY_VERSION "v1.2.27"
+#define CRELAY_VERSION_PATCH 28
+#define CRELAY_VERSION "v1.2.28"
 
 // Relay metadata (authoritative source for NIP-11 information)
 #define RELAY_NAME "C-Relay"
diff --git a/src/websockets.c b/src/websockets.c
index 9944ce6..91ee92e 100644
--- a/src/websockets.c
+++ b/src/websockets.c
@@ -2497,6 +2497,14 @@ int start_websocket_relay(int port_override, int strict_port) {
         int max_connection_seconds = get_config_int("max_connection_seconds", 86400);
         if (current_time - last_connection_age_check >= 60) {
             last_connection_age_check = current_time;
+
+            // Live debug level update: read from config table so it can be changed
+            // without restarting the relay (via config_set admin command or direct SQL)
+            int config_debug_level = get_config_int("debug_level", -1);
+            if (config_debug_level >= 0 && config_debug_level != g_debug_level) {
+                DEBUG_WARN("Debug level changed: %d -> %d", g_debug_level, config_debug_level);
+                g_debug_level = config_debug_level;
+            }
             if (max_connection_seconds > 0) {
                 check_connection_age(max_connection_seconds);
             } else {