# syntax=docker/dockerfile:1
#
# rsyslog as a remote log/audit collector (RECEIVE side only) for the diskless
# fleet serving stack. Booted hosts forward auditd + syslog here; records land
# under /var/log/remote/<sender-ip>/. See rsyslog.conf + README.md.

FROM harbor.bitasylum.org/dockerhub/library/alpine:3.20

RUN apk add --no-cache rsyslog tzdata \
    && mkdir -p /var/log/remote /var/spool/rsyslog

COPY rsyslog.conf /etc/rsyslog.conf

EXPOSE 514/tcp
# Foreground (-n), our config only (-f). rsyslog logs its own startup to stderr,
# captured by `docker compose logs audit`.
ENTRYPOINT ["rsyslogd", "-n", "-f", "/etc/rsyslog.conf"]
