add file control for main log files

manifests/main/files.pp

@@ -23,4 +23,32 @@ class alloy_cd::main::files (
     content  => template('alloy_cd/config.alloy.erb'),
     notify   => Service[$ay_service],
   }
+
+  # manage logrotate for rsyslog to allow adm group membership
+  file { '/etc/logrotate.d/rsyslog':
+    ensure   => file,
+    owner    => 'root',
+    group    => 'root',
+    mode     => '0644',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => etc_t,
+    seluser  => system_u,
+    content  => template('alloy_cd/logrotate.rsyslog.erb'),
+  }
+
+  # manage log file group permissions
+  file { '/var/log/messages':
+    ensure => file,
+    owner  => 'root',
+    group  => 'adm',
+    mode   => '0640',
+  }
+
+  file { '/var/log/secure':
+    ensure => file,
+    owner  => 'root',
+    group  => 'adm',
+    mode   => '0640',
+  }
 }