From 06e84c662be19d7b03191a64819e5e9a84068e23 Mon Sep 17 00:00:00 2001
From: Arne Teuke <arne_teuke@confdroid.com>
Date: Mon, 10 Mar 2025 15:51:36 +0100
Subject: [PATCH] add file control for main log files

---
 .vscode/settings.json           |  9 +++++++++
 manifests/main/files.pp         | 28 ++++++++++++++++++++++++++++
 manifests/main/service.pp       |  1 -
 manifests/main/user.pp          | 24 ------------------------
 manifests/params.pp             |  2 +-
 templates/logrotate.rsyslog.erb | 13 +++++++++++++
 6 files changed, 51 insertions(+), 26 deletions(-)
 create mode 100644 .vscode/settings.json
 delete mode 100644 manifests/main/user.pp
 create mode 100644 templates/logrotate.rsyslog.erb

diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 0000000..de0607f
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,9 @@
+{
+    "cSpell.words": [
+        "endscript",
+        "maillog",
+        "missingok",
+        "postrotate",
+        "sharedscripts"
+    ]
+}
\ No newline at end of file
diff --git a/manifests/main/files.pp b/manifests/main/files.pp
index 8243dd3..a153ab4 100644
--- a/manifests/main/files.pp
+++ b/manifests/main/files.pp
@@ -23,4 +23,32 @@ class alloy_cd::main::files (
     content  => template('alloy_cd/config.alloy.erb'),
     notify   => Service[$ay_service],
   }
+
+  # manage logrotate for rsyslog to allow adm group membership
+  file { '/etc/logrotate.d/rsyslog':
+    ensure   => file,
+    owner    => 'root',
+    group    => 'root',
+    mode     => '0644',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => etc_t,
+    seluser  => system_u,
+    content  => template('alloy_cd/logrotate.rsyslog.erb'),
+  }
+
+  # manage log file group permissions
+  file { '/var/log/messages':
+    ensure => file,
+    owner  => 'root',
+    group  => 'adm',
+    mode   => '0640',
+  }
+
+  file { '/var/log/secure':
+    ensure => file,
+    owner  => 'root',
+    group  => 'adm',
+    mode   => '0640',
+  }
 }
diff --git a/manifests/main/service.pp b/manifests/main/service.pp
index bda2929..3ad9bdd 100644
--- a/manifests/main/service.pp
+++ b/manifests/main/service.pp
@@ -7,7 +7,6 @@ class alloy_cd::main::service (
 
 ) inherits alloy_cd::params {
   require alloy_cd::main::files
-  require alloy_cd::main::user
 
   service { $ay_service:
     ensure     => running,
diff --git a/manifests/main/user.pp b/manifests/main/user.pp
deleted file mode 100644
index 0a8091f..0000000
--- a/manifests/main/user.pp
+++ /dev/null
@@ -1,24 +0,0 @@
-## alloy_cd::main::user.pp
-# Module name: alloy_cd
-# Author: Arne Teuke (arne_teuke@confdroid.com)
-# @summary Class manages the alloy user
-###############################################################################
-class alloy_cd::main::user (
-
-) inherits alloy_cd::params {
-  if $ay_manage_user == true {
-    user { $ay_user:
-      ensure     => present,
-      name       => $ay_user,
-      allowdupe  => false,
-      groups     => $ay_groups,
-      managehome => false,
-      shell      => $ay_user_shell,
-    }
-
-    group { $ay_user:
-      ensure    => present,
-      allowdupe => false,
-    }
-  }
-}
diff --git a/manifests/params.pp b/manifests/params.pp
index a69ec2d..5acae8c 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -35,7 +35,7 @@ class alloy_cd::params (
 # user
   Boolean $ay_manage_user     = true,
   String $ay_user             = 'alloy',
-  Array $ay_groups            = ['wheel','adm'],
+  Array $ay_groups            = ['systemd-journal','adm'],
   String $ay_user_shell       = '/sbin/nologin',
 
 ) {
diff --git a/templates/logrotate.rsyslog.erb b/templates/logrotate.rsyslog.erb
new file mode 100644
index 0000000..13c74ee
--- /dev/null
+++ b/templates/logrotate.rsyslog.erb
@@ -0,0 +1,13 @@
+/var/log/cron
+/var/log/maillog
+/var/log/messages
+/var/log/secure
+/var/log/spooler
+{
+    create 0640 root adm
+    missingok
+    sharedscripts
+    postrotate
+        /usr/bin/systemctl -s HUP kill rsyslog.service >/dev/null 2>&1 || true
+    endscript
+}