adam/syslog-server
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/syslog-server.git synced 2026-09-30 11:13:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
syslog-server/README.md

83 lines
4 KiB
Markdown
Raw Normal View History

feat: syslog-server under IaC (INFRA-12) CDK stack for the EC2 syslog collector (rsyslog 514 -> CloudWatch agent -> unifi-syslog), mirroring the file-share/forgejo pattern. Recreated from the captured console config; EIP 184.72.154.32 imported + re-associated so the UniFi forwarding target is unchanged. Deployed + verified 2026-06-09. Note: deploy role can assume cdk-hnb659fds-* (account-admin via CDK bootstrap) — same exposure as every org CDK deploy role; per-app qualifier is a known org-wide follow-up.
2026-06-09 13:51:17 -04:00
# syslog-server
feat(infra): migrate syslog-server to HCP Terraform (PLAT-78) (#38) * feat(infra): migrate syslog-server to HCP Terraform Replace the mgmt CDK stack with a seahaven-prod HCP workspace so the collector is owned by Terraform before UniFi cutover. * fix(infra): keep no-logs alarm quiet until UniFi cutover The new prod unifi-syslog group is empty until devices are re-pointed, so treat_missing_data=breaching would page site-alerts on first apply. * fix(infra): allow scoped apply to modify SG rules in place Authorize/Revoke plus description updates are not enough for aws_vpc_security_group_*_rule in-place changes after the bootstrap window.
2026-09-16 21:29:43 +00:00
![Terraform](https://img.shields.io/badge/Terraform-844FBA?logo=terraform&logoColor=white)
![AWS](https://img.shields.io/badge/AWS-FF9900?logo=amazonaws&logoColor=white)
Repo hygiene: PR labeler + README badges (INFRA-56/57) (#3) - Add Labeler workflow calling org reusable callable-labeler.yaml - Add README status badges (TypeScript, AWS CDK, CI) Part of INFRA-47 (INFRA-56, INFRA-57).
2026-06-11 14:13:59 -04:00
![CI](https://github.com/Sea-Haven-Industries/syslog-server/actions/workflows/ci.yaml/badge.svg)
feat(infra): migrate syslog-server to HCP Terraform (PLAT-78) (#38) * feat(infra): migrate syslog-server to HCP Terraform Replace the mgmt CDK stack with a seahaven-prod HCP workspace so the collector is owned by Terraform before UniFi cutover. * fix(infra): keep no-logs alarm quiet until UniFi cutover The new prod unifi-syslog group is empty until devices are re-pointed, so treat_missing_data=breaching would page site-alerts on first apply. * fix(infra): allow scoped apply to modify SG rules in place Authorize/Revoke plus description updates are not enough for aws_vpc_security_group_*_rule in-place changes after the bootstrap window.
2026-09-16 21:29:43 +00:00
EC2 collector that receives remote syslog (UDP/TCP 514) from the office UniFi
fleet over an Elastic IP and ships it to the `unifi-syslog` CloudWatch Logs
group via the CloudWatch agent.
feat: syslog-server under IaC (INFRA-12) CDK stack for the EC2 syslog collector (rsyslog 514 -> CloudWatch agent -> unifi-syslog), mirroring the file-share/forgejo pattern. Recreated from the captured console config; EIP 184.72.154.32 imported + re-associated so the UniFi forwarding target is unchanged. Deployed + verified 2026-06-09. Note: deploy role can assume cdk-hnb659fds-* (account-admin via CDK bootstrap) — same exposure as every org CDK deploy role; per-app qualifier is a known org-wide follow-up.
2026-06-09 13:51:17 -04:00
feat(infra): migrate syslog-server to HCP Terraform (PLAT-78) (#38) * feat(infra): migrate syslog-server to HCP Terraform Replace the mgmt CDK stack with a seahaven-prod HCP workspace so the collector is owned by Terraform before UniFi cutover. * fix(infra): keep no-logs alarm quiet until UniFi cutover The new prod unifi-syslog group is empty until devices are re-pointed, so treat_missing_data=breaching would page site-alerts on first apply. * fix(infra): allow scoped apply to modify SG rules in place Authorize/Revoke plus description updates are not enough for aws_vpc_security_group_*_rule in-place changes after the bootstrap window.
2026-09-16 21:29:43 +00:00
Deploy path (PLAT-78): HCP Terraform in seahaven-prod (`011934824531`),
workspace `syslog-server-prod`. CDK CD in mgmt is retired.
feat: syslog-server under IaC (INFRA-12) CDK stack for the EC2 syslog collector (rsyslog 514 -> CloudWatch agent -> unifi-syslog), mirroring the file-share/forgejo pattern. Recreated from the captured console config; EIP 184.72.154.32 imported + re-associated so the UniFi forwarding target is unchanged. Deployed + verified 2026-06-09. Note: deploy role can assume cdk-hnb659fds-* (account-admin via CDK bootstrap) — same exposure as every org CDK deploy role; per-app qualifier is a known org-wide follow-up.
2026-06-09 13:51:17 -04:00
## Architecture
```
feat(infra): migrate syslog-server to HCP Terraform (PLAT-78) (#38) * feat(infra): migrate syslog-server to HCP Terraform Replace the mgmt CDK stack with a seahaven-prod HCP workspace so the collector is owned by Terraform before UniFi cutover. * fix(infra): keep no-logs alarm quiet until UniFi cutover The new prod unifi-syslog group is empty until devices are re-pointed, so treat_missing_data=breaching would page site-alerts on first apply. * fix(infra): allow scoped apply to modify SG rules in place Authorize/Revoke plus description updates are not enough for aws_vpc_security_group_*_rule in-place changes after the bootstrap window.
2026-09-16 21:29:43 +00:00
office UniFi devices ──syslog/514──▶ EIP (prod) ──▶ EC2 (rsyslog)
│
/var/log/remote/<host>/*.log
│
CloudWatch agent ──▶ unifi-syslog (90d)
│
Syslog-NoIncomingLogs alarm ──▶ site-alerts
feat: syslog-server under IaC (INFRA-12) CDK stack for the EC2 syslog collector (rsyslog 514 -> CloudWatch agent -> unifi-syslog), mirroring the file-share/forgejo pattern. Recreated from the captured console config; EIP 184.72.154.32 imported + re-associated so the UniFi forwarding target is unchanged. Deployed + verified 2026-06-09. Note: deploy role can assume cdk-hnb659fds-* (account-admin via CDK bootstrap) — same exposure as every org CDK deploy role; per-app qualifier is a known org-wide follow-up.
2026-06-09 13:51:17 -04:00
```
| Resource | Value |
|---|---|
feat(infra): migrate syslog-server to HCP Terraform (PLAT-78) (#38) * feat(infra): migrate syslog-server to HCP Terraform Replace the mgmt CDK stack with a seahaven-prod HCP workspace so the collector is owned by Terraform before UniFi cutover. * fix(infra): keep no-logs alarm quiet until UniFi cutover The new prod unifi-syslog group is empty until devices are re-pointed, so treat_missing_data=breaching would page site-alerts on first apply. * fix(infra): allow scoped apply to modify SG rules in place Authorize/Revoke plus description updates are not enough for aws_vpc_security_group_*_rule in-place changes after the bootstrap window.
2026-09-16 21:29:43 +00:00
| Account / region | seahaven-prod `011934824531` / us-east-1 |
| HCP workspace | `syslog-server-prod` (project `seahaven-prod`; VCS `main`; working dir `terraform`; trigger `terraform/**`) |
| HCP plan/apply roles | `hcptf-syslog-server-plan` / `hcptf-syslog-server` |
feat: syslog-server under IaC (INFRA-12) CDK stack for the EC2 syslog collector (rsyslog 514 -> CloudWatch agent -> unifi-syslog), mirroring the file-share/forgejo pattern. Recreated from the captured console config; EIP 184.72.154.32 imported + re-associated so the UniFi forwarding target is unchanged. Deployed + verified 2026-06-09. Note: deploy role can assume cdk-hnb659fds-* (account-admin via CDK bootstrap) — same exposure as every org CDK deploy role; per-app qualifier is a known org-wide follow-up.
2026-06-09 13:51:17 -04:00
| Instance | `syslog-server`, t4g.nano, Amazon Linux 2023 (arm64), 30 GiB encrypted gp3 |
feat(infra): migrate syslog-server to HCP Terraform (PLAT-78) (#38) * feat(infra): migrate syslog-server to HCP Terraform Replace the mgmt CDK stack with a seahaven-prod HCP workspace so the collector is owned by Terraform before UniFi cutover. * fix(infra): keep no-logs alarm quiet until UniFi cutover The new prod unifi-syslog group is empty until devices are re-pointed, so treat_missing_data=breaching would page site-alerts on first apply. * fix(infra): allow scoped apply to modify SG rules in place Authorize/Revoke plus description updates are not enough for aws_vpc_security_group_*_rule in-place changes after the bootstrap window.
2026-09-16 21:29:43 +00:00
| VPC | dedicated `10.40.0.0/16`, public subnet `10.40.10.0/24` |
| Elastic IP | Terraform-managed (see HCP output `public_ip`) |
| Security group | `syslog-server` — 514 tcp/udp + 22 from office IPs + VPC/VPN CIDRs; 2055/2056 udp from office |
| Instance IAM | `/tf-managed/syslog-server-role` with `syslog-server-instance-boundary`; `AmazonSSMManagedInstanceCore` + `CloudWatchAgentServerPolicy` |
| Log group | `unifi-syslog` (90-day retention) |
| Alarms | `Syslog-NoIncomingLogs`, `EC2-StatusCheck-syslog-server`, `EC2-StatusCheckSystem-syslog-server-recover` → `site-alerts` |
docs: link Confluence AWS Architecture Map (INFRA-53) (#5)
2026-07-06 17:44:28 -04:00
feat: syslog-server under IaC (INFRA-12) CDK stack for the EC2 syslog collector (rsyslog 514 -> CloudWatch agent -> unifi-syslog), mirroring the file-share/forgejo pattern. Recreated from the captured console config; EIP 184.72.154.32 imported + re-associated so the UniFi forwarding target is unchanged. Deployed + verified 2026-06-09. Note: deploy role can assume cdk-hnb659fds-* (account-admin via CDK bootstrap) — same exposure as every org CDK deploy role; per-app qualifier is a known org-wide follow-up.
2026-06-09 13:51:17 -04:00
## Access
SSM Session Manager (no key pair). SSH 22 is open from office/VPC for
break-glass only.
feat(infra): migrate syslog-server to HCP Terraform (PLAT-78) (#38) * feat(infra): migrate syslog-server to HCP Terraform Replace the mgmt CDK stack with a seahaven-prod HCP workspace so the collector is owned by Terraform before UniFi cutover. * fix(infra): keep no-logs alarm quiet until UniFi cutover The new prod unifi-syslog group is empty until devices are re-pointed, so treat_missing_data=breaching would page site-alerts on first apply. * fix(infra): allow scoped apply to modify SG rules in place Authorize/Revoke plus description updates are not enough for aws_vpc_security_group_*_rule in-place changes after the bootstrap window.
2026-09-16 21:29:43 +00:00
## HCP first apply
First apply uses the hcptf-bootstrap window (exact `StringEquals` trust, never
`StringLike`):
1. Create the HCP workspace. Auto-apply off. No project-level variable set.
Working directory `terraform`. File trigger prefix `terraform/**` only.
Speculative plans on. VCS on `main`.
2. From `seahaven-org-baseline`:
`scripts/create-hcptf-bootstrap-roles.sh --account prod --allow-workspace syslog-server-prod`
3. Point workspace `TFC_AWS_APPLY_ROLE_ARN` / `TFC_AWS_PLAN_ROLE_ARN` at
`hcptf-bootstrap` / `hcptf-bootstrap-plan`. Set `TFC_AWS_PROVIDER_AUTH=true`.
Never `TFC_AWS_RUN_ROLE_ARN`.
4. One manual apply. This creates the scoped `hcptf-*` roles, the instance
boundary, VPC, instance, EIP, log group, and alarms.
5. Retarget `TFC_AWS_*` to `hcptf-syslog-server` / `hcptf-syslog-server-plan`.
Re-run the create script with no `--allow-workspace`.
6. Second manual apply as the scoped role. After live-path proof, seal
auto-apply on.
`Syslog-NoIncomingLogs` defaults `treat_missing_data` to `notBreaching` so the
empty prod log group does not page `site-alerts` before UniFi is re-pointed.
After devices deliver to the new EIP, set `no_logs_treat_missing_data=breaching`.
HCP outputs to copy: `public_ip`, `instance_id`, `hcptf_apply_role_arn`,
`hcptf_plan_role_arn`.
AMI is pinned in `var.ami_id`. An AMI change forces instance replacement.
User-data changes also replace the instance (the box is stateless; logs live
in CloudWatch; the EIP re-associates).
feat: syslog-server under IaC (INFRA-12) CDK stack for the EC2 syslog collector (rsyslog 514 -> CloudWatch agent -> unifi-syslog), mirroring the file-share/forgejo pattern. Recreated from the captured console config; EIP 184.72.154.32 imported + re-associated so the UniFi forwarding target is unchanged. Deployed + verified 2026-06-09. Note: deploy role can assume cdk-hnb659fds-* (account-admin via CDK bootstrap) — same exposure as every org CDK deploy role; per-app qualifier is a known org-wide follow-up.
2026-06-09 13:51:17 -04:00
feat(infra): migrate syslog-server to HCP Terraform (PLAT-78) (#38) * feat(infra): migrate syslog-server to HCP Terraform Replace the mgmt CDK stack with a seahaven-prod HCP workspace so the collector is owned by Terraform before UniFi cutover. * fix(infra): keep no-logs alarm quiet until UniFi cutover The new prod unifi-syslog group is empty until devices are re-pointed, so treat_missing_data=breaching would page site-alerts on first apply. * fix(infra): allow scoped apply to modify SG rules in place Authorize/Revoke plus description updates are not enough for aws_vpc_security_group_*_rule in-place changes after the bootstrap window.
2026-09-16 21:29:43 +00:00
## Documentation
feat: syslog-server under IaC (INFRA-12) CDK stack for the EC2 syslog collector (rsyslog 514 -> CloudWatch agent -> unifi-syslog), mirroring the file-share/forgejo pattern. Recreated from the captured console config; EIP 184.72.154.32 imported + re-associated so the UniFi forwarding target is unchanged. Deployed + verified 2026-06-09. Note: deploy role can assume cdk-hnb659fds-* (account-admin via CDK bootstrap) — same exposure as every org CDK deploy role; per-app qualifier is a known org-wide follow-up.
2026-06-09 13:51:17 -04:00
feat(infra): migrate syslog-server to HCP Terraform (PLAT-78) (#38) * feat(infra): migrate syslog-server to HCP Terraform Replace the mgmt CDK stack with a seahaven-prod HCP workspace so the collector is owned by Terraform before UniFi cutover. * fix(infra): keep no-logs alarm quiet until UniFi cutover The new prod unifi-syslog group is empty until devices are re-pointed, so treat_missing_data=breaching would page site-alerts on first apply. * fix(infra): allow scoped apply to modify SG rules in place Authorize/Revoke plus description updates are not enough for aws_vpc_security_group_*_rule in-place changes after the bootstrap window.
2026-09-16 21:29:43 +00:00
The canonical map of Sea Haven's AWS infrastructure lives in Confluence.
feat: syslog-server under IaC (INFRA-12) CDK stack for the EC2 syslog collector (rsyslog 514 -> CloudWatch agent -> unifi-syslog), mirroring the file-share/forgejo pattern. Recreated from the captured console config; EIP 184.72.154.32 imported + re-associated so the UniFi forwarding target is unchanged. Deployed + verified 2026-06-09. Note: deploy role can assume cdk-hnb659fds-* (account-admin via CDK bootstrap) — same exposure as every org CDK deploy role; per-app qualifier is a known org-wide follow-up.
2026-06-09 13:51:17 -04:00
feat(infra): migrate syslog-server to HCP Terraform (PLAT-78) (#38) * feat(infra): migrate syslog-server to HCP Terraform Replace the mgmt CDK stack with a seahaven-prod HCP workspace so the collector is owned by Terraform before UniFi cutover. * fix(infra): keep no-logs alarm quiet until UniFi cutover The new prod unifi-syslog group is empty until devices are re-pointed, so treat_missing_data=breaching would page site-alerts on first apply. * fix(infra): allow scoped apply to modify SG rules in place Authorize/Revoke plus description updates are not enough for aws_vpc_security_group_*_rule in-place changes after the bootstrap window.
2026-09-16 21:29:43 +00:00
- **[AWS Architecture Map](https://seahaven.atlassian.net/wiki/spaces/IT/pages/1540098)** (Confluence, IT space, page 1540098)
feat: syslog-server under IaC (INFRA-12) CDK stack for the EC2 syslog collector (rsyslog 514 -> CloudWatch agent -> unifi-syslog), mirroring the file-share/forgejo pattern. Recreated from the captured console config; EIP 184.72.154.32 imported + re-associated so the UniFi forwarding target is unchanged. Deployed + verified 2026-06-09. Note: deploy role can assume cdk-hnb659fds-* (account-admin via CDK bootstrap) — same exposure as every org CDK deploy role; per-app qualifier is a known org-wide follow-up.
2026-06-09 13:51:17 -04:00
feat(infra): migrate syslog-server to HCP Terraform (PLAT-78) (#38) * feat(infra): migrate syslog-server to HCP Terraform Replace the mgmt CDK stack with a seahaven-prod HCP workspace so the collector is owned by Terraform before UniFi cutover. * fix(infra): keep no-logs alarm quiet until UniFi cutover The new prod unifi-syslog group is empty until devices are re-pointed, so treat_missing_data=breaching would page site-alerts on first apply. * fix(infra): allow scoped apply to modify SG rules in place Authorize/Revoke plus description updates are not enough for aws_vpc_security_group_*_rule in-place changes after the bootstrap window.
2026-09-16 21:29:43 +00:00
To widen device coverage of the forwarded syslog feed, see **INFRA-11**
(UniFi controller remote-logging config).
Reference in a new issue Copy permalink