Add app

serving/README.md

@@ -58,7 +58,8 @@ docker compose ps
 # HTTP: UKI is served
 curl -sI http://${SERVER_IP}/fleet-${IMAGE_VERSION}.efi | head -1   # 200 OK
 
-# HTTP: kiosk test page is served (what the diskless kiosk loads by default)
+# HTTP: kiosk SPA is served (reverse-proxied to the kiosk-app container —
+# the spaceship terminal the diskless kiosk loads by default)
 curl -sI http://${SERVER_IP}/kiosk/ | head -1                       # 200 OK
 
 # NTP: lab time server answers (diskless hosts get it via DHCP option 42)
@@ -71,6 +72,11 @@ sudo nvme discover -t tcp -a ${SERVER_IP} -s 4420                   # lists the
 # DNS: discovery name resolves to the serving host
 dig +short @${SERVER_IP} nvme.fleet.lab                             # -> ${SERVER_IP}
 
+# Audit collector: rsyslog receiver is listening on :514 (booted hosts offload
+# auditd here; records land in audit-collector/logs/<sender-ip>/)
+ss -lntp | grep ':514'
+logger -n ${SERVER_IP} -P 514 -T -t audispd "collector smoke test"  # -> logs/<ip>/audit.log
+
 # DHCP/boot: watch leases + bootfile handout
 docker compose logs -f dnsmasq
 ```