pqkem: dedicated slog logger via NB_PQ_MLKEM_LOG_LEVEL

client/internal/engine.go

@@ -656,7 +656,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		if pqErr != nil {
 			log.Errorf("pqkem: transport bind failed, exchange disabled: %v", pqErr)
 		} else {
-			e.pqkemManager = pqkem.NewManager(pqkem.LocalID(publicKey.String()), pqCallbackHandler{wg: e.wgInterface}, nil)
+			e.pqkemManager = pqkem.NewManager(pqkem.LocalID(publicKey.String()), pqCallbackHandler{wg: e.wgInterface}, pqkem.NewLogger())
 			e.pqkemManager.Start(tr)
 			log.Infof("pqkem: enabled (udp port %d on overlay %s)", e.pqkemManager.LocalPort(), e.config.WgAddr.IP)
 		}

client/internal/pqkem/env.go

@@ -1,6 +1,7 @@
 package pqkem
 
 import (
+	"log/slog"
 	"os"
 	"strconv"
 	"strings"
@@ -32,3 +33,27 @@ func Enabled() bool {
 	}
 	return enabled
 }
+
+// EnvLogLevel overrides the ML-KEM manager's slog level (debug/info/warn/error).
+// Defaults to info.
+const EnvLogLevel = "NB_PQ_MLKEM_LOG_LEVEL"
+
+// NewLogger builds the slog logger for the ML-KEM manager: a text handler to stdout
+// at the level from EnvLogLevel. Mirrors the Rosenpass manager's logger setup so PQ
+// components log consistently.
+func NewLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: logLevel()}))
+}
+
+func logLevel() slog.Level {
+	switch strings.ToLower(strings.TrimSpace(os.Getenv(EnvLogLevel))) {
+	case "debug":
+		return slog.LevelDebug
+	case "warn":
+		return slog.LevelWarn
+	case "error":
+		return slog.LevelError
+	default:
+		return slog.LevelInfo
+	}
+}