How I made my server logs immutable with Polygon

Sellat is a tool that allows you to certify any file on the blockchain. Today, I’ll explain how I’ve applied it to my own server to make Nginx logs immutable.

The Problem: Vulnerable Logs

In the world of cybersecurity, it is often said that “if there are no logs, it didn’t happen.” But what happens when you can’t trust your own logs because someone with enough permissions could have edited them?

In any VPS, logs are plain text files. An administrator or an attacker can modify them to erase traces of access or change an IP address. Without an external reference, it is impossible to know if what you are reading today is what was actually written yesterday.

The Solution: Sellat + Blockchain

Sellat acts as an external verification layer that connects my server’s reality with the immutability of the Polygon network.

By creating chained cryptographic fingerprints (hashes) and publishing them to Polygon, any attempt to modify the server’s past leaves an indelible mark. It’s no longer just about storing data, but about giving it a layer of mathematical truth.

How the Workflow Works

1. Hourly Rotation: A Bash script on the VPS takes a “snapshot” of the Nginx log every hour, archives it, and clears the original. This converts a constant stream of data into static, manageable pieces.

2. External Hashing: The script calculates the SHA-256 hash of the log file and sends only this fingerprint to the Sellat API. The server never reads the original log, protecting privacy.

3. Chaining: Each time Sellat receives a hash, it links it with the hash of the previous seal, creating a chainHash. It’s like DNA connecting every hour of logs with the entire previous history. If you move one link, all subsequent ones break.

4. Anchor to Polygon: A worker processes the queue and records the chainHash on Polygon. This is the final word: a public and immutable proof that serves as a reference for any audit.

The Technical Stack

  • Backend: Node.js with API endpoints and SQLite for queue management
  • Infrastructure: Docker Compose for fast and isolated deployment
  • Security: Token-based authentication for client requests
  • Blockchain: Ethers.js to interact with Polygon

The Key: Verification

Many people think blockchain solves everything like magic. In the system I’ve built, blockchain is the final anchor, not a magic bullet.

If I want to verify a whole day of logs:

  1. I recalculate the hashes of each .log file locally
  2. I reconstruct the hash chain (chainHash)
  3. I compare the last value of my chain with the one registered on Polygon

If a single bit has changed in the last 24 hours, the chain breaks and the final hash will not match the one on the blockchain.

This is where the elegance of the system lies: I don’t need to verify each hour individually. By checking the last link, I automatically validate the entire previous chain. It’s scalable and very gas-cost efficient.

Project Status

I want to be transparent: the Sellat API is already fully operational. My server connects to it every hour, and blockchain sealing is a constant, automated reality.

The next step is the public verification interface. Although the hash chain is already on the blockchain, I am developing the tool that will allow any auditor to confirm that the chain has not been broken with a single click.

In short: the “notary” (the API) is already open and signing documents; now we are polishing the “magnifying glass” (the verifier) to be able to read them effortlessly.

Conclusions

With Sellat, I’ve gone from “trusting” my logs to being able to audit them mathematically.

I don’t prevent a malicious root user from deleting data, but I take away their power to lie about what happened. Any manipulation leaves a trail of inconsistency that I can now detect in seconds.

If you’re interested in trying Sellat for your own use cases, you can access it at sellat.app.