Adding rsyslog tls

serving/docker-compose.yml

@@ -245,19 +245,25 @@ services:
   # --- Remote audit / log collector (RECEIVE side) ---------------------------
   # rsyslog receiver: booted diskless hosts (whose RAM-only overlay root loses
   # local logs on reboot) forward auditd via audisp-syslog + syslog here over
-  # TCP/514. Records are written per-source-host under
+  # syslog-TLS/6514 (gtls; legacy plaintext :514 kept for pre-TLS images during
+  # migration). Records are written per-source-host under
   # ./audit-collector/logs/<sender-ip>/{audit,messages}.log. Host-networked so
   # hosts can reach it at ${AUDIT_HOST} (= this host) on the boot LAN.
-  # NOTE: this is the receiver only — the IMAGE must be configured to send
-  # (audisp-syslog + an rsyslog forward rule targeting ${AUDIT_HOST}); see
-  # audit-collector/README.md. Until then the collector simply waits, idle.
+  # BEFORE first start: issue the TLS server cert into ./audit-collector/tls/
+  # with audit-collector/issue-cert.sh (fleet step-ca; SAN = ${AUDIT_HOST} — the
+  # image's rsyslog verifies it x509/name against the baked fleet CA, so it MUST
+  # be the same CA as the build's var.fleet_ca).
+  # FIREWALL (host networking — same trap as chrony's 123/udp above): the
+  # serving host's own firewall governs 6514/tcp (+ legacy 514/tcp); scope them
+  # to the boot LAN: `ufw allow in on <boot-nic> to any port 6514 proto tcp`.
   audit:
     build: ./audit-collector
-    network_mode: host        # receive from booted hosts on the boot LAN (:514)
+    network_mode: host        # receive from booted hosts on the boot LAN (:6514)
     restart: unless-stopped
     volumes:
       - ./audit-collector/logs:/var/log/remote      # durable, inspectable on host
       - ./audit-collector/spool:/var/spool/rsyslog  # disk-assisted queue
+      - ./audit-collector/tls:/etc/rsyslog-tls:ro   # server cert/key + fleet CA (issue-cert.sh)
 
   # --- NVMe/TCP target (serves rootfs.erofs, read-only) ----------------------
   nvmeof: