# syntax=docker/dockerfile:1
#
# rsyslog as a remote log/audit collector (RECEIVE side only) for the diskless
# fleet serving stack. Booted hosts forward auditd + syslog here; records land
# under /var/log/remote/<sender-ip>/. See rsyslog.conf + README.md.

FROM harbor.bitasylum.org/dockerhub/library/alpine:3.20

# rsyslog-tls ships lmnsd_gtls.so (gnutls netstream driver) for the :6514 TLS
# listener (verified present in Alpine 3.20's rsyslog-tls subpackage).
RUN apk add --no-cache rsyslog rsyslog-tls tzdata \
    && mkdir -p /var/log/remote /var/spool/rsyslog

COPY rsyslog.conf /etc/rsyslog.conf

# 6514 = syslog-over-TLS (primary), 514 = legacy plaintext (migration only).
EXPOSE 6514/tcp 514/tcp
# Foreground (-n), our config only (-f). rsyslog logs its own startup to stderr,
# captured by `docker compose logs audit`.
ENTRYPOINT ["rsyslogd", "-n", "-f", "/etc/rsyslog.conf"]