Default log.level to "warn"

Make the [log] section and its level field optional, falling back to
"warn" when omitted. Update the sample TOML, Nix module and README to
reflect the new default.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -136,7 +136,7 @@ modules = [
     enable = true;
     database.path = "/var/lib/oott.db";
     # networking.interface = "eth0"; # Optional: auto-detected if not set
-    log.level = "info";
+    log.level = "warn";
     arp_scanner.wait_between_scans = "30m";
     arp_scanner.sender_timeout = "1m";
     arp_scanner.scan_duration = "10m";
@@ -159,7 +159,7 @@ Options marked **Required** have no built-in default and must be set in your con
 |------|-------------|-----------|
 |`database.path`|**Required**|Location of the system database. Must be `/db/oott.db` when using the Docker image.|
 |`networking.interface`|auto-detected|Network interface to use for scans. Optional — if not set, the first non-loopback connected interface is used automatically.|
-|`log.level`|**Required**|Log level to use (trace, debug, info, warn, error)|
+|`log.level`|`warn`|Log level to use (off, error, warn, info, debug, trace)|
 |`web_server.ip_address`|**Required**|Address the API and web UI bind to. Use `0.0.0.0` to bind all interfaces.|
 |`web_server.port`|**Required**|Port the API and web UI listen on.|
 |`web_server.api_key`|**Required**|API key the app must present to use the backend.|

backend/src/settings.rs

@@ -10,6 +10,10 @@ fn default_true() -> bool {
     true
 }
 
+fn default_log_level() -> String {
+    "warn".to_string()
+}
+
 #[derive(Debug, Deserialize, Clone)]
 pub struct Database {
     pub path: String,
@@ -22,9 +26,18 @@ pub struct Networking {
 
 #[derive(Debug, Deserialize, Clone)]
 pub struct Log {
+    #[serde(default = "default_log_level")]
     pub level: String,
 }
 
+impl Default for Log {
+    fn default() -> Self {
+        Log {
+            level: default_log_level(),
+        }
+    }
+}
+
 #[derive(Debug, Deserialize, Clone)]
 pub struct ArpScanner {
     #[serde(default = "default_true")]
@@ -165,6 +178,7 @@ impl Default for DeviceEvents {
 pub struct Settings {
     pub database: Database,
     pub networking: Networking,
+    #[serde(default)]
     pub log: Log,
     #[serde(default)]
     pub arp_scanner: ArpScanner,
@@ -321,6 +335,36 @@ mod tests {
         );
     }
 
+    #[test]
+    fn log_level_defaults_to_warn_when_section_omitted() {
+        // A config without a `[log]` section falls back to the code default.
+        const NO_LOG_CONFIG: &str = r#"
+            [database]
+            path = "./oott.db"
+            [networking]
+            [notifications]
+            method = "none"
+            notify_when_not_seen_for = "1w"
+            [notifications.pushover]
+            token = ""
+            user_key = ""
+            [web_server]
+            ip_address = "0.0.0.0"
+            port = 3000
+            api_key = "test"
+        "#;
+        let settings = parse(NO_LOG_CONFIG);
+        assert_eq!(settings.log.level, "warn");
+    }
+
+    #[test]
+    fn log_level_defaults_to_warn_when_field_omitted() {
+        // Keep the `[log]` section but drop the `level` field; it should fall back to the default.
+        let toml = BASE_CONFIG.replace("[log]\n        level = \"info\"", "[log]");
+        let settings = parse(&toml);
+        assert_eq!(settings.log.level, "warn");
+    }
+
     #[test]
     fn device_events_dedup_window_defaults_when_section_omitted() {
         let settings = parse(BASE_CONFIG);

examples/sample_oott.toml

@@ -5,7 +5,7 @@ path = "/db/oott.db" # Database path. For the Docker image this must be "/db/oot
 # interface = "eno1" # Optional: network interface to use for scans. If not set, the first non-loopback connected interface is used.
 
 [log]
-level = "info" # off, error, warn, info, debug, trace
+level = "warn" # off, error, warn, info, debug, trace. Defaults to "warn" if omitted
 
 [arp_scanner] # Optional: omit this whole section to use the defaults shown below
 enabled=true # Set to false to disable the ARP scanner

nix/modules/oott-service.nix

@@ -29,7 +29,7 @@ in {
     log.level = mkOption {
       type = types.str;
       description = "Log level for the oott service";
-      default = "info";
+      default = "warn";
     };
     arp_scanner.enabled = mkOption {
       type = types.bool;