adding secure rsyslog exceptions

docs/TODO.md

@@ -551,7 +551,29 @@ smoke test.
   trigger. Apply the same `-k 30 -l -1 -c 10` keep-alive/reconnect flags to the
   secure `nvme connect` as the test path has.
 - **Future hardening waived for now** (from the STIG register): FIPS, firewall,
-  remote audit offload, per-host/rotatable admin (SSH CA / config-agent).
+  per-host/rotatable admin (SSH CA / config-agent).
+- **TLS-encrypted audit/log offload (production).** The lab forwards logs to
+  `serving/audit-collector` in **plaintext**, and the STIG TLS-offload rules
+  (`rsyslog_encrypt_offload_defaultnetstreamdriver`,
+  `..._actionsendstreamdrivermode`, `..._actionsendstreamdriverauthmode`) are
+  **waived** in the tailoring because applying them forces `gtls` + x509 peer
+  auth + a CA file and breaks the plaintext `2f` forward. For production, do it
+  properly and DROP the waivers:
+  1. Stand up a CA (or reuse the boot-infra CA); issue the collector a server
+     cert (CN/SAN = `audit.fleet.lab`).
+  2. Configure the collector's rsyslog for TLS: `imtcp` with
+     `StreamDriver.Name="gtls"`, `StreamDriver.Mode="1"`, server cert/key + CA;
+     listen on the syslog-TLS port (6514) — add a TLS receiver to
+     `serving/audit-collector/rsyslog.conf` + compose.
+  3. Bundle the CA into the image (host-generic, no per-host state — same model
+     as the RADIUS CA) and point `$DefaultNetstreamDriverCAFile` at it.
+  4. Set the `2f` `omfwd` action to `StreamDriver="gtls" StreamDriverMode="1"
+     StreamDriverAuthMode="x509/name"` + the CA file, target port 6514.
+  5. Re-select the three `rsyslog_encrypt_offload_*` rules (remove from
+     `files/stig/diskless-tailoring.xml`) — they should then PASS, and update
+     `docs/stig-deviations.md` #6 to reflect encrypted offload.
+  (RELP+TLS via `omrelp`/`imrelp` is the alternative if guaranteed delivery is
+  wanted alongside encryption.)
 
 ## [ ] 9. (OPTIONAL / nice-to-have) Convert provisioning to Ansible where it pays off