v0.22.0 several enhancements and fixes for security, network, doc, test, packaging

deploy/README.md

@@ -0,0 +1,31 @@
+# deploy
+
+`lw-deploy.sh` writes a LogWisp configuration for one node and deploys it: in a
+docker or podman container, as a systemd or FreeBSD rc.d service (on the host
+or inside a jail), or as a configuration you run yourself. It is POSIX sh,
+written for FreeBSD's `/bin/sh` as much as for dash.
+
+```sh
+deploy/lw-deploy.sh                  # asks, with inline menus
+deploy/lw-deploy.sh -h               # every flag
+deploy/lw-deploy.sh --dry-run ...    # print the configuration and commands only
+deploy/lw-deploy.sh --yes ...        # no questions: defaults, or fail on a missing value
+```
+
+- Roles
+  - `edge`: tails log directories, forwards the entries to an aggregator
+  - `aggregator`: receives from edges; writes files, serves HTTP and TCP streams
+  - `standalone`: tails log directories; writes files, serves streams
+- Runtimes
+  - `docker`, `podman`: a hardened container of the `logwisp` image (Linux)
+  - `native`: systemd on Linux, rc.d on FreeBSD, `--jail NAME` for a jail
+  - `manual`: the configuration only, for `lw -c`
+- Every question has a flag. Before changing anything the script prints its
+  plan and the command line that repeats it without questions, ready for the
+  next node. It starts nothing that `lw --check` rejects.
+- The native runtimes install the service files of `deploy/package/`.
+- Not covered, and printed by the script: filters, rate limits, heartbeat,
+  several pipelines, proxy mode, ACLs, certificate creation. Edit the generated
+  `logwisp.toml` for those.
+
+Scenarios and what each runtime writes: [doc/deployment.md](../doc/deployment.md).

deploy/package/arch/PKGBUILD

@@ -0,0 +1,46 @@
+# Maintainer: <name> <email>
+# Skeleton: source and checksum wait for a tagged release; run namcap and
+# makepkg --printsrcinfo > .SRCINFO before publishing to the AUR.
+
+pkgname=logwisp
+pkgver=0.21.0
+pkgrel=1
+pkgdesc='Pipeline-based log transport with TLS and SCRAM authentication'
+arch=('x86_64' 'aarch64')
+url='https://github.com/lixenwraith/logwisp'
+license=('BSD-3-Clause')
+depends=('glibc')
+makedepends=('go')
+backup=('etc/logwisp/logwisp.toml')
+source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
+sha256sums=('SKIP')
+
+prepare() {
+  cd "$pkgname-$pkgver"
+  export GOPATH="$srcdir/gopath"
+  go mod download -modcacherw
+}
+
+# The Go package guidelines' flags; -linkmode=external goes through GO_LDFLAGS
+# because the Makefile's own -ldflags (the version) would override GOFLAGS'.
+build() {
+  cd "$pkgname-$pkgver"
+  export GOPATH="$srcdir/gopath"
+  export CGO_CPPFLAGS="$CPPFLAGS"
+  export CGO_CFLAGS="$CFLAGS"
+  export CGO_CXXFLAGS="$CXXFLAGS"
+  export CGO_LDFLAGS="$LDFLAGS"
+  export GOFLAGS='-buildmode=pie -trimpath -mod=readonly -modcacherw'
+  make build VERSION="$pkgver" GIT_COMMIT="v$pkgver" GO_LDFLAGS='-linkmode=external'
+}
+
+check() {
+  cd "$pkgname-$pkgver"
+  export GOPATH="$srcdir/gopath"
+  go test ./...
+}
+
+package() {
+  cd "$pkgname-$pkgver"
+  make install DESTDIR="$pkgdir" PREFIX=/usr SYSCONFDIR=/etc
+}

deploy/package/freebsd/Makefile

@@ -0,0 +1,44 @@
+# Skeleton for sysutils/logwisp. GO_MODULE fetches the module by its canonical
+# path, so it waits for the module rename to github.com/lixenwraith/logwisp
+# (the -X paths below follow it), a tagged release, a maintainer, and a
+# UIDs/GIDs entry for logwisp. files/logwisp.in links to ../logwisp.rc: cp -L.
+
+PORTNAME=	logwisp
+DISTVERSIONPREFIX=	v
+DISTVERSION=	0.21.0
+CATEGORIES=	sysutils
+
+MAINTAINER=	maintainer@example.org
+COMMENT=	Pipeline-based log transport with TLS and SCRAM authentication
+WWW=		https://github.com/lixenwraith/logwisp
+
+LICENSE=	BSD3CLAUSE
+LICENSE_FILE=	${WRKSRC}/LICENSE
+
+USES=		go:1.27,modules
+USE_RC_SUBR=	logwisp
+SUB_LIST=	BINDIR=${PREFIX}/bin
+
+GO_MODULE=	github.com/lixenwraith/logwisp
+GO_TARGET=	./cmd/lw
+GO_BUILDFLAGS=	-ldflags="-s -w \
+		-X logwisp/internal/version.Version=${DISTVERSION} \
+		-X logwisp/internal/version.GitCommit=${DISTVERSIONFULL}"
+
+USERS=		logwisp
+GROUPS=		logwisp
+
+OPTIONS_DEFINE=	DOCS
+PORTDOCS=	*
+
+post-install:
+	${INSTALL_MAN} ${WRKSRC}/doc/lw.1 ${STAGEDIR}${PREFIX}/share/man/man1
+	${MKDIR} ${STAGEDIR}${ETCDIR}
+	${INSTALL_DATA} ${WRKSRC}/config/logwisp.toml ${STAGEDIR}${ETCDIR}/logwisp.toml.sample
+
+post-install-DOCS-on:
+	${MKDIR} ${STAGEDIR}${DOCSDIR}/doc
+	${INSTALL_DATA} ${WRKSRC}/README.md ${STAGEDIR}${DOCSDIR}
+	${INSTALL_DATA} ${WRKSRC}/doc/*.md ${STAGEDIR}${DOCSDIR}/doc
+
+.include <bsd.port.mk>

deploy/package/freebsd/files/logwisp.in

@@ -0,0 +1 @@
+../../logwisp.rc

deploy/package/freebsd/pkg-descr

@@ -0,0 +1,5 @@
+LogWisp collects log entries from files, standard input or other LogWisp
+nodes; rate-limits, filters and formats them; and distributes them to files,
+the console, live HTTP (Server-Sent Events) and TCP streams, or downstream
+nodes. Every network source and sink supports TLS, mutual TLS and
+Argon2id-SCRAM password authentication, and reloads on SIGHUP.

deploy/package/freebsd/pkg-plist

@@ -0,0 +1,3 @@
+bin/lw
+@sample %%ETCDIR%%/logwisp.toml.sample
+share/man/man1/lw.1.gz

deploy/package/logwisp.rc

@@ -0,0 +1,47 @@
+#!/bin/sh
+
+# PROVIDE: logwisp
+# REQUIRE: LOGIN NETWORKING
+# KEYWORD: shutdown
+
+# Add to /etc/rc.conf (sysrc logwisp_enable=YES):
+#   logwisp_enable  "YES" starts LogWisp at boot (default "NO")
+#   logwisp_config  configuration file (default %%PREFIX%%/etc/logwisp/logwisp.toml)
+#   logwisp_user    account lw runs as (default "logwisp")
+#   logwisp_chdir   working directory (default /var/db/logwisp)
+#   logwisp_args    extra lw options, e.g. --logging.level=debug (default empty);
+#                   rc.subr hands logwisp_flags to daemon(8), not to lw
+
+. /etc/rc.subr
+
+name=logwisp
+rcvar=logwisp_enable
+desc="LogWisp log transport"
+
+load_rc_config $name
+
+: ${logwisp_enable:="NO"}
+: ${logwisp_config:="%%PREFIX%%/etc/logwisp/logwisp.toml"}
+: ${logwisp_user:="logwisp"}
+: ${logwisp_chdir:="/var/db/logwisp"}
+: ${logwisp_args:=""}
+
+# daemon(8) records the child's pid, so stop and reload (SIGHUP) signal lw
+# itself, and sends its output to syslog under the tag logwisp.
+pidfile="/var/run/${name}/${name}.pid"
+procname="%%BINDIR%%/lw"
+command="/usr/sbin/daemon"
+command_args="-f -S -T ${name} -p ${pidfile} ${procname} -c ${logwisp_config} ${logwisp_args}"
+required_files="${logwisp_config}"
+extra_commands="reload"
+start_precmd="${name}_prestart"
+
+# rc.subr starts daemon(8) as logwisp_user, which must own the pidfile directory.
+# An existing logwisp_chdir keeps its owner: it may be a shared directory.
+logwisp_prestart()
+{
+	install -d -o "${logwisp_user}" -m 0755 "/var/run/${name}"
+	[ -d "${logwisp_chdir}" ] || install -d -o "${logwisp_user}" -m 0750 "${logwisp_chdir}"
+}
+
+run_rc_command "$1"

deploy/package/logwisp.service

@@ -0,0 +1,54 @@
+[Unit]
+Description=LogWisp log transport
+Documentation=man:lw(1) https://github.com/lixenwraith/logwisp
+Wants=network-online.target
+After=network-online.target
+# A broken configuration stops after five tries instead of looping forever.
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+Type=exec
+User=logwisp
+Group=logwisp
+ExecStart=@BINDIR@/lw -c @SYSCONFDIR@/logwisp/logwisp.toml
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=5s
+TimeoutStopSec=15s
+
+# logwisp.tmpfiles creates both directories. A file sink elsewhere needs a
+# drop-in with ReadWritePaths=, a source under /home one with ProtectHome=read-only,
+# and a port below 1024 CapabilityBoundingSet= and AmbientCapabilities= both
+# set to CAP_NET_BIND_SERVICE.
+WorkingDirectory=/var/lib/logwisp
+ReadWritePaths=/var/lib/logwisp /var/log/logwisp
+UMask=0027
+
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+PrivateDevices=yes
+PrivateTmp=yes
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProcSubset=pid
+ProtectSystem=strict
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RemoveIPC=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+
+[Install]
+WantedBy=multi-user.target

deploy/package/logwisp.sysusers

@@ -0,0 +1,2 @@
+# Type Name    ID Description             Home             Shell
+u      logwisp -  "LogWisp log transport" /var/lib/logwisp -

deploy/package/logwisp.tmpfiles

@@ -0,0 +1,3 @@
+# Type Path             Mode User    Group   Age Argument
+d      /var/lib/logwisp 0750 logwisp logwisp -   -
+d      /var/log/logwisp 0750 logwisp logwisp -   -