Add audit log sending

diskless.pkr.hcl

@@ -142,6 +142,12 @@ variable "debug_shell" {
   default     = true
 }
 
+variable "audit_host" {
+  type        = string
+  description = "Remote rsyslog/audit collector the image forwards auditd (via audisp-syslog) + the journal (rsyslog imjournal) to. Host-generic DNS name resolved per-environment by the serving dnsmasq to the collector (serving/audit-collector); matches serving/.env AUDIT_HOST. The diskless root is a RAM-only overlay, so local logs die on reboot — this ships them off-box. Empty = local-only (no remote offload)."
+  default     = "audit.fleet.lab"
+}
+
 variable "sb_key" {
   type        = string
   description = "Secure Boot signing key (PEM) for the UKI. Empty = unsigned lab build. Production: CI/HSM-held; never enters the build VM."
@@ -586,6 +592,35 @@ build {
     ]
   }
 
+  # --- 2f. Remote log / audit offload (sender) -----------------------------
+  # Forward auditd (via the audisp-syslog plugin, on LOCAL6) AND the journal
+  # (rsyslog's stock imjournal) to the remote collector (serving/audit-collector).
+  # The diskless root is a RAM-only overlay so local logs vanish on reboot; this
+  # ships them off-box (and gives remote visibility into boot/login failures).
+  # Host-generic: targets ${audit_host} (DNS, resolved per environment). Empty
+  # audit_host => local-only. Implements the remote-offload half of TODO #2 /
+  # docs/stig-deviations.md #6. Disk-assisted queue so a network blip won't drop
+  # records (action.resumeRetryCount=-1 retries forever).
+  provisioner "shell" {
+    environment_vars = ["AUDIT_HOST=${var.audit_host}"]
+    inline = [
+      "set -eux",
+      "if [ -z \"$AUDIT_HOST\" ]; then echo 'audit_host empty -> local-only logging, no remote offload.'; exit 0; fi",
+      "dnf install -y rsyslog",
+      # auditd -> syslog on LOCAL6 (the collector routes LOCAL6 to a per-host
+      # audit.log; see serving/audit-collector/rsyslog.conf).
+      "if [ -f /etc/audit/plugins.d/syslog.conf ]; then sed -i -e 's/^active.*/active = yes/' -e 's/^args.*/args = LOG_INFO LOG_LOCAL6/' /etc/audit/plugins.d/syslog.conf; fi",
+      # rsyslog -> collector over TCP, disk-assisted queue.
+      "cat > /etc/rsyslog.d/60-fleet-remote.conf <<EOF",
+      "*.* action(type=\"omfwd\" target=\"$AUDIT_HOST\" port=\"514\" protocol=\"tcp\" queue.type=\"LinkedList\" queue.fileName=\"fleetfwdq\" queue.maxDiskSpace=\"256m\" queue.saveOnShutdown=\"on\" action.resumeRetryCount=\"-1\")",
+      "EOF",
+      "chmod 0644 /etc/rsyslog.d/60-fleet-remote.conf",
+      "rsyslogd -N1",
+      "systemctl enable rsyslog.service",
+      "restorecon /etc/rsyslog.d/60-fleet-remote.conf /etc/audit/plugins.d/syslog.conf 2>/dev/null || true",
+    ]
+  }
+
   # --- 2d. Final image hygiene: strip caches/logs after the LAST dnf step --
   # MUST be the last provisioner. The `dnf clean all` in step 2 runs BEFORE the
   # kiosk (2b) and admin (2c) provisioners, and 2b enables EPEL + installs