Add app

serving/docker-compose.yml

@@ -63,6 +63,9 @@ services:
       # resolve the per-environment DNS name to this serving host.
       - --address=/${NVME_HOST}/${SERVER_IP}
       - --address=/${BOOT_HOST}/${SERVER_IP}
+      # Host-generic remote audit collector name (baked into the image config so
+      # every host offloads auditd here; resolved per-environment to this host).
+      - --address=/${AUDIT_HOST}/${SERVER_IP}
       # Kiosk is LOCAL-ONLY (loads boot.fleet.lab), so sinkhole Chromium's
       # call-home to 0.0.0.0 — telemetry can't leave the lab even if the browser
       # tries. Defense-in-depth behind the in-image Chromium policy/flags; in
@@ -94,6 +97,8 @@ services:
     image: nginx:stable
     network_mode: host        # listens on :80 -> http://${SERVER_IP}/fleet-<ver>.efi
     restart: unless-stopped
+    depends_on:
+      - kiosk                 # /kiosk/ is reverse-proxied to the kiosk SPA
     volumes:
       - type: image
         source: ${OCI_IMAGE}:${IMAGE_VERSION}
@@ -102,13 +107,23 @@ services:
           subpath: artifacts   # mount only /artifacts from the image
       # Fallback (Docker < 28 / offline): bind the local Packer output dir:
       # - ${ARTIFACT_SRC}:/usr/share/nginx/html:ro
-      # Serve the kiosk test page at /kiosk/ alongside the artifacts. Config
-      # adds the location; the page is lab content (NOT in the artifact image).
+      # Config adds the artifact root + the /kiosk/ reverse-proxy location. The
+      # kiosk SPA itself is the separate 'kiosk' service below (not bind-mounted).
       - ./http/default.conf:/etc/nginx/conf.d/default.conf:ro
-      - ./http/kiosk:/usr/share/nginx/kiosk:ro
     # For HTTPS boot (production), terminate TLS here with the boot-infra CA's
     # cert and switch the dhcp-boot URL above to https://. Left HTTP for the lab.
 
+  # --- Kiosk SPA (spaceship terminal shown by the diskless kiosk) ------------
+  # Svelte + Tailwind app built into a static bundle served by its own nginx.
+  # Bridge-networked (NOT host) so it doesn't fight :80; published on loopback
+  # only, where the host-network 'http' nginx reverse-proxies /kiosk/ to it.
+  # Build: docker compose build kiosk
+  kiosk:
+    build: ./kiosk-app
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:${KIOSK_APP_PORT:-8088}:80"   # loopback only; main nginx proxies here
+
   # --- NTP server (serves time to the boot LAN; handed out via DHCP opt 42) ---
   ntp:
     build: ./chrony
@@ -123,6 +138,23 @@ services:
     # lab time source. Drop SYS_TIME (and add `chronyd -x`) if the host already
     # runs its own NTP and you only want this to relay.
 
+  # --- Remote audit / log collector (RECEIVE side) ---------------------------
+  # rsyslog receiver: booted diskless hosts (whose RAM-only overlay root loses
+  # local logs on reboot) forward auditd via audisp-syslog + syslog here over
+  # TCP/514. Records are written per-source-host under
+  # ./audit-collector/logs/<sender-ip>/{audit,messages}.log. Host-networked so
+  # hosts can reach it at ${AUDIT_HOST} (= this host) on the boot LAN.
+  # NOTE: this is the receiver only — the IMAGE must be configured to send
+  # (audisp-syslog + an rsyslog forward rule targeting ${AUDIT_HOST}); see
+  # audit-collector/README.md. Until then the collector simply waits, idle.
+  audit:
+    build: ./audit-collector
+    network_mode: host        # receive from booted hosts on the boot LAN (:514)
+    restart: unless-stopped
+    volumes:
+      - ./audit-collector/logs:/var/log/remote      # durable, inspectable on host
+      - ./audit-collector/spool:/var/spool/rsyslog  # disk-assisted queue
+
   # --- NVMe/TCP target (serves rootfs.erofs, read-only) ----------------------
   nvmeof:
     # Prebuilt by CI (.gitea/workflows/spdk-image.yaml) and pulled here — no