ipsec: T8912: Fix log level not respected in system journal

When setting 'vpn ipsec logging log-level 0', DPD informational
messages (log level 1) were still appearing in the system journal.

The root cause is that charon-systemd reads both `charon-systemd.conf`
and `charon-logging.conf` and applies the higher of the two log levels
to the journal. The VyOS only managed `charon-systemd.conf`, leaving
`charon-logging.conf` at its default level of 1, which silently overrode
the user-configured level.

Fix this by rendering `charon-logging.conf` on every commit with
syslog backend set to -1 (silent), making `charon-systemd.conf`
the sole authoritative source for journal log verbosity.

This also eliminates duplicate log entries in the journal that occurred
when both backends were active and writing to the same destination.

3 files changed, 30 insertions, 2 deletions

diff --git a/data/templates/ipsec/charon_logging.conf.j2 b/data/templates/ipsec/charon_logging.conf.j2
new file mode 100644
index 000000000..e8edee817
--- /dev/null
+++ b/data/templates/ipsec/charon_logging.conf.j2
@@ -0,0 +1,18 @@
+# Generated by ${vyos_conf_scripts_dir}/vpn_ipsec.py
+
+charon {
+    syslog {
+        # prefix for each log message
+        identifier = charon
+        # use default settings to log to the LOG_DAEMON facility
+        daemon {
+{% if log.level is vyos_defined %}
+            # Disabled - logging handled exclusively by charon-systemd.conf
+            default = -1
+{% else %}
+            default = 1
+{% endif %}
+            ike_name = yes
+        }
+    }
+}
diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
index 403031131..ee8340a74 100644
--- a/interface-definitions/vpn_ipsec.xml.in
+++ b/interface-definitions/vpn_ipsec.xml.in
@@ -627,7 +627,7 @@
                     <validator name="numeric" argument="--range 0-2"/>
                   </constraint>
                 </properties>
-                <defaultValue>0</defaultValue>
+                <defaultValue>1</defaultValue>
               </leafNode>
               <leafNode name="subsystem">
                 <properties>
diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index 35b00dada..f268f0861 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -66,6 +66,7 @@ charon_conf        = '/etc/strongswan.d/charon.conf'
 charon_dhcp_conf   = '/etc/strongswan.d/charon/dhcp.conf'
 charon_radius_conf = '/etc/strongswan.d/charon/eap-radius.conf'
 charon_systemd_conf = '/etc/strongswan.d/charon-systemd.conf'
+charon_logging_conf = '/etc/strongswan.d/charon-logging.conf'
 interface_conf     = '/etc/strongswan.d/interfaces_use.conf'
 swanctl_conf       = f'{swanctl_dir}/swanctl.conf'
 
@@ -783,7 +784,15 @@ def generate(ipsec):
     cleanup_pki_files()
 
     if not ipsec or 'deleted' in ipsec:
-        for config_file in [charon_dhcp_conf, charon_radius_conf, interface_conf, swanctl_conf]:
+        delete_files = (
+            charon_dhcp_conf,
+            charon_radius_conf,
+            charon_systemd_conf,
+            charon_logging_conf,
+            interface_conf,
+            swanctl_conf,
+        )
+        for config_file in delete_files:
             if os.path.isfile(config_file):
                 os.unlink(config_file)
         render(charon_conf, 'ipsec/charon.j2', {'install_routes': default_install_routes})
@@ -882,6 +891,7 @@ def generate(ipsec):
     render(charon_dhcp_conf, 'ipsec/charon/dhcp.conf.j2', ipsec)
     render(charon_radius_conf, 'ipsec/charon/eap-radius.conf.j2', ipsec)
     render(charon_systemd_conf, 'ipsec/charon_systemd.conf.j2', ipsec)
+    render(charon_logging_conf, 'ipsec/charon_logging.conf.j2', ipsec)
     render(interface_conf, 'ipsec/interfaces_use.conf.j2', ipsec)
     render(swanctl_conf, 'ipsec/swanctl.conf.j2', ipsec)