Adding rsyslog tls

serving/audit-collector/Dockerfile

@@ -6,12 +6,15 @@
 
 FROM harbor.bitasylum.org/dockerhub/library/alpine:3.20
 
-RUN apk add --no-cache rsyslog tzdata \
+# rsyslog-tls ships lmnsd_gtls.so (gnutls netstream driver) for the :6514 TLS
+# listener (verified present in Alpine 3.20's rsyslog-tls subpackage).
+RUN apk add --no-cache rsyslog rsyslog-tls tzdata \
     && mkdir -p /var/log/remote /var/spool/rsyslog
 
 COPY rsyslog.conf /etc/rsyslog.conf
 
-EXPOSE 514/tcp
+# 6514 = syslog-over-TLS (primary), 514 = legacy plaintext (migration only).
+EXPOSE 6514/tcp 514/tcp
 # Foreground (-n), our config only (-f). rsyslog logs its own startup to stderr,
 # captured by `docker compose logs audit`.
 ENTRYPOINT ["rsyslogd", "-n", "-f", "/etc/rsyslog.conf"]