add file control for main log files

.vscode/settings.json

@@ -0,0 +1,9 @@
+{
+    "cSpell.words": [
+        "endscript",
+        "maillog",
+        "missingok",
+        "postrotate",
+        "sharedscripts"
+    ]
+}

manifests/main/files.pp

@@ -23,4 +23,32 @@ class alloy_cd::main::files (
     content  => template('alloy_cd/config.alloy.erb'),
     notify   => Service[$ay_service],
   }
+
+  # manage logrotate for rsyslog to allow adm group membership
+  file { '/etc/logrotate.d/rsyslog':
+    ensure   => file,
+    owner    => 'root',
+    group    => 'root',
+    mode     => '0644',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => etc_t,
+    seluser  => system_u,
+    content  => template('alloy_cd/logrotate.rsyslog.erb'),
+  }
+
+  # manage log file group permissions
+  file { '/var/log/messages':
+    ensure => file,
+    owner  => 'root',
+    group  => 'adm',
+    mode   => '0640',
+  }
+
+  file { '/var/log/secure':
+    ensure => file,
+    owner  => 'root',
+    group  => 'adm',
+    mode   => '0640',
+  }
 }

manifests/main/service.pp

@@ -7,7 +7,6 @@ class alloy_cd::main::service (
 
 ) inherits alloy_cd::params {
   require alloy_cd::main::files
-  require alloy_cd::main::user
 
   service { $ay_service:
     ensure     => running,

manifests/main/user.pp

@@ -1,24 +0,0 @@
-## alloy_cd::main::user.pp
-# Module name: alloy_cd
-# Author: Arne Teuke (arne_teuke@confdroid.com)
-# @summary Class manages the alloy user
-###############################################################################
-class alloy_cd::main::user (
-
-) inherits alloy_cd::params {
-  if $ay_manage_user == true {
-    user { $ay_user:
-      ensure     => present,
-      name       => $ay_user,
-      allowdupe  => false,
-      groups     => $ay_groups,
-      managehome => false,
-      shell      => $ay_user_shell,
-    }
-
-    group { $ay_user:
-      ensure    => present,
-      allowdupe => false,
-    }
-  }
-}

manifests/params.pp

@@ -35,7 +35,7 @@ class alloy_cd::params (
 # user
   Boolean $ay_manage_user     = true,
   String $ay_user             = 'alloy',
-  Array $ay_groups            = ['wheel','adm'],
+  Array $ay_groups            = ['systemd-journal','adm'],
   String $ay_user_shell       = '/sbin/nologin',
 
 ) {

templates/logrotate.rsyslog.erb

@@ -0,0 +1,13 @@
+/var/log/cron
+/var/log/maillog
+/var/log/messages
+/var/log/secure
+/var/log/spooler
+{
+    create 0640 root adm
+    missingok
+    sharedscripts
+    postrotate
+        /usr/bin/systemctl -s HUP kill rsyslog.service >/dev/null 2>&1 || true
+    endscript
+}