21 lines
887 B
Docker
21 lines
887 B
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# rsyslog as a remote log/audit collector (RECEIVE side only) for the diskless
|
|
# fleet serving stack. Booted hosts forward auditd + syslog here; records land
|
|
# under /var/log/remote/<sender-ip>/. See rsyslog.conf + README.md.
|
|
|
|
FROM harbor.bitasylum.org/dockerhub/library/alpine:3.20
|
|
|
|
# rsyslog-tls ships lmnsd_gtls.so (gnutls netstream driver) for the :6514 TLS
|
|
# listener (verified present in Alpine 3.20's rsyslog-tls subpackage).
|
|
RUN apk add --no-cache rsyslog rsyslog-tls tzdata \
|
|
&& mkdir -p /var/log/remote /var/spool/rsyslog
|
|
|
|
COPY rsyslog.conf /etc/rsyslog.conf
|
|
|
|
# 6514 = syslog-over-TLS (primary), 514 = legacy plaintext (migration only).
|
|
EXPOSE 6514/tcp 514/tcp
|
|
# Foreground (-n), our config only (-f). rsyslog logs its own startup to stderr,
|
|
# captured by `docker compose logs audit`.
|
|
ENTRYPOINT ["rsyslogd", "-n", "-f", "/etc/rsyslog.conf"]
|