refactor: strip DECNET tokens from container-visible surface

Rename the container-side logging module decnet_logging → syslog_bridge
(canonical at templates/syslog_bridge.py, synced into each template by
the deployer). Drop the stale per-template copies; setuptools find was
picking them up anyway. Swap useradd/USER/chown "decnet" for "logrelay"
so no obvious token appears in the rendered container image.

Apply the same cloaking pattern to the telnet template that SSH got:
syslog pipe moves to /run/systemd/journal/syslog-relay and the relay
is cat'd via exec -a "systemd-journal-fwd". rsyslog.d conf rename
99-decnet.conf → 50-journal-forward.conf. SSH capture script:
/var/decnet/captured → /var/lib/systemd/coredump (real systemd path),
logger tag decnet-capture → systemd-journal. Compose volume updated
to match the new in-container quarantine path.

SD element ID shifts decnet@55555 → relay@55555; synced across
collector, parser, sniffer, prober, formatter, tests, and docs so the
host-side pipeline still matches what containers emit.

decnet/collector/worker.py

@@ -114,7 +114,7 @@ _RFC5424_RE = re.compile(
     r"(\S+) "       # 4: MSGID (event_type)
     r"(.+)$",       # 5: SD element + optional MSG
 )
-_SD_BLOCK_RE = re.compile(r'\[decnet@55555\s+(.*?)\]', re.DOTALL)
+_SD_BLOCK_RE = re.compile(r'\[relay@55555\s+(.*?)\]', re.DOTALL)
 _PARAM_RE = re.compile(r'(\w+)="((?:[^"\\]|\\.)*)"')
 _IP_FIELDS = ("src_ip", "src", "client_ip", "remote_ip", "remote_addr", "target_ip", "ip")
 

decnet/correlation/parser.py

@@ -6,7 +6,7 @@ the fields needed for cross-decky correlation: attacker IP, decky name,
 service, event type, and timestamp.
 
 Log format (produced by decnet.logging.syslog_formatter):
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME - MSGID [decnet@55555 k1="v1" k2="v2"] [MSG]
+  <PRI>1 TIMESTAMP HOSTNAME APP-NAME - MSGID [relay@55555 k1="v1" k2="v2"] [MSG]
 
 The attacker IP may appear under several field names depending on service:
   src_ip  — ftp, smtp, http, most services
@@ -31,8 +31,8 @@ _RFC5424_RE = re.compile(
     r"(.+)$",       # 5: SD element + optional MSG
 )
 
-# Structured data block: [decnet@55555 k="v" ...]
+# Structured data block: [relay@55555 k="v" ...]
-_SD_BLOCK_RE = re.compile(r'\[decnet@55555\s+(.*?)\]', re.DOTALL)
+_SD_BLOCK_RE = re.compile(r'\[relay@55555\s+(.*?)\]', re.DOTALL)
 
 # Individual param: key="value" (with escaped chars inside value)
 _PARAM_RE = re.compile(r'(\w+)="((?:[^"\\]|\\.)*)"')

decnet/engine/deployer.py

@@ -31,11 +31,11 @@ from decnet.network import (
 log = get_logger("engine")
 console = Console()
 COMPOSE_FILE = Path("decnet-compose.yml")
-_CANONICAL_LOGGING = Path(__file__).parent.parent.parent / "templates" / "decnet_logging.py"
+_CANONICAL_LOGGING = Path(__file__).parent.parent.parent / "templates" / "syslog_bridge.py"
 
 
 def _sync_logging_helper(config: DecnetConfig) -> None:
-    """Copy the canonical decnet_logging.py into every active template build context."""
+    """Copy the canonical syslog_bridge.py into every active template build context."""
     from decnet.services.registry import get_service
     seen: set[Path] = set()
     for decky in config.deckies:
@@ -47,7 +47,7 @@ def _sync_logging_helper(config: DecnetConfig) -> None:
             if ctx is None or ctx in seen:
                 continue
             seen.add(ctx)
-            dest = ctx / "decnet_logging.py"
+            dest = ctx / "syslog_bridge.py"
             if not dest.exists() or dest.read_bytes() != _CANONICAL_LOGGING.read_bytes():
                 shutil.copy2(_CANONICAL_LOGGING, dest)
 

decnet/logging/syslog_formatter.py

@@ -5,7 +5,7 @@ Produces fully-compliant syslog messages:
   <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
 
 Facility: local0 (16)
-PEN for structured data: decnet@55555
+PEN for structured data: relay@55555
 """
 
 from __future__ import annotations
@@ -16,7 +16,7 @@ from typing import Any
 
 FACILITY_LOCAL0 = 16
 NILVALUE = "-"
-_SD_ID = "decnet@55555"
+_SD_ID = "relay@55555"
 
 SEVERITY_INFO    = 6
 SEVERITY_WARNING = 4

decnet/prober/worker.py

@@ -51,7 +51,7 @@ DEFAULT_TCPFP_PORTS: list[int] = [22, 80, 443, 8080, 8443, 445, 3389]
 # ─── RFC 5424 formatting (inline, mirrors templates/*/decnet_logging.py) ─────
 
 _FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
+_SD_ID = "relay@55555"
 _SEVERITY_INFO = 6
 _SEVERITY_WARNING = 4
 
@@ -98,7 +98,7 @@ _RFC5424_RE = re.compile(
     r"(\S+) "       # 4: MSGID (event_type)
     r"(.+)$",       # 5: SD + MSG
 )
-_SD_BLOCK_RE = re.compile(r'\[decnet@55555\s+(.*?)\]', re.DOTALL)
+_SD_BLOCK_RE = re.compile(r'\[relay@55555\s+(.*?)\]', re.DOTALL)
 _PARAM_RE = re.compile(r'(\w+)="((?:[^"\\]|\\.)*)"')
 _IP_FIELDS = ("src_ip", "src", "client_ip", "remote_ip", "ip", "target_ip")
 

decnet/services/ssh.py

@@ -38,7 +38,8 @@ class SSHService(BaseService):
 
         # File-catcher quarantine: bind-mount a per-decky host dir so attacker
         # drops (scp/sftp/wget) are mirrored out-of-band for forensic analysis.
-        # The container path is internal-only; attackers never see this mount.
+        # The in-container path masquerades as systemd-coredump so `mount`/`df`
+        # from inside the container looks benign.
         quarantine_host = f"/var/lib/decnet/artifacts/{decky_name}/ssh"
         return {
             "build": {"context": str(TEMPLATES_DIR)},
@@ -46,7 +47,7 @@ class SSHService(BaseService):
             "restart": "unless-stopped",
             "cap_add": ["NET_BIND_SERVICE"],
             "environment": env,
-            "volumes": [f"{quarantine_host}:/var/decnet/captured:rw"],
+            "volumes": [f"{quarantine_host}:/var/lib/systemd/coredump:rw"],
         }
 
     def dockerfile_context(self) -> Path:

decnet/sniffer/syslog.py

@@ -16,7 +16,7 @@ from decnet.telemetry import traced as _traced
 # ─── Constants (must match templates/sniffer/decnet_logging.py) ──────────────
 
 _FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
+_SD_ID = "relay@55555"
 _NILVALUE = "-"
 
 SEVERITY_INFO = 6

development/docs/services/COLLECTOR.md

@@ -31,7 +31,7 @@ The main asynchronous entry point.
 
 DECNET services emit logs using a standardized RFC 5424 format with structured data. The `parse_rfc5424` function is the primary tool for extracting this information.
 
-- **Structured Data**: Extracts parameters from the `decnet@55555` SD-ELEMENT.
+- **Structured Data**: Extracts parameters from the `relay@55555` SD-ELEMENT.
 - **Field Mapping**: Identifies the `attacker_ip` by scanning common source IP fields (`src_ip`, `client_ip`, etc.).
 - **Consistency**: Formats timestamps into a human-readable `%Y-%m-%d %H:%M:%S` format for the analytical stream.
 

pyproject.toml

@@ -103,9 +103,5 @@ include = ["decnet*"]
 
 [tool.bandit]
 exclude_dirs = [
-    "templates/http/decnet_logging.py",
+    "templates/syslog_bridge.py",
-    "templates/imap/decnet_logging.py",
-    "templates/pop3/decnet_logging.py",
-    "templates/real_ssh/decnet_logging.py",
-    "templates/smtp/decnet_logging.py",
 ]

templates/conpot/Dockerfile

@@ -11,16 +11,16 @@ RUN find /opt /usr /etc /home -name "*.xml" -exec sed -i 's/port="5020"/port="50
 RUN (apt-get update && apt-get install -y --no-install-recommends libcap2-bin 2>/dev/null) || (apk add --no-cache libcap 2>/dev/null) || true
 RUN find /home/conpot/.local/bin /usr /opt -type f -name 'python*' -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true
 
-# Bridge conpot's own logger into DECNET's RFC 5424 syslog pipeline.
+# Bridge conpot's own logger into syslog-relay's RFC 5424 syslog pipeline.
 # entrypoint.py is self-contained (inlines the formatter) because the
 # conpot base image runs Python 3.6, which cannot import the shared
-# decnet_logging.py (that file uses 3.9+ / 3.10+ type syntax).
+# syslog_bridge.py (that file uses 3.9+ / 3.10+ type syntax).
 COPY entrypoint.py /home/conpot/entrypoint.py
 RUN chown conpot:conpot /home/conpot/entrypoint.py \
     && chmod +x /home/conpot/entrypoint.py
 
 # The upstream image already runs as non-root 'conpot'.
-# We do NOT switch to a 'decnet' user — doing so breaks pkg_resources
+# We do NOT switch to a 'logrelay' user — doing so breaks pkg_resources
 # because conpot's eggs live under /home/conpot/.local and are only on
 # the Python path for that user.
 USER conpot

templates/conpot/entrypoint.py

@@ -3,7 +3,7 @@
 Entrypoint wrapper for the Conpot ICS/SCADA honeypot.
 
 Launches conpot as a child process and bridges its log output into the
-DECNET structured syslog pipeline.  Each line from conpot stdout/stderr
+syslog-relay structured syslog pipeline.  Each line from conpot stdout/stderr
 is classified and emitted as an RFC 5424 syslog line so the host-side
 collector can ingest it alongside every other service.
 
@@ -21,7 +21,7 @@ from datetime import datetime, timezone
 # ── RFC 5424 inline formatter (Python 3.6-compatible) ─────────────────────────
 
 _FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
+_SD_ID = "relay@55555"
 _NILVALUE = "-"
 
 SEVERITY_INFO    = 6

templates/cowrie/Dockerfile

@@ -7,7 +7,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     git authbind \
     && rm -rf /var/lib/apt/lists/*
 
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -18,5 +18,5 @@ RUN chmod +x /entrypoint.sh
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/cowrie/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/docker_api/Dockerfile

@@ -8,13 +8,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 ENV PIP_BREAK_SYSTEM_PACKAGES=1
 RUN pip3 install --no-cache-dir flask
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 2375 2376
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -22,5 +22,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/docker_api/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/docker_api/server.py

@@ -10,7 +10,7 @@ import json
 import os
 
 from flask import Flask, request
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "docker-host")
 SERVICE_NAME   = "docker_api"

templates/elasticsearch/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 9200
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/elasticsearch/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/elasticsearch/server.py

@@ -8,7 +8,7 @@ as JSON. Designed to attract automated scanners and credential stuffers.
 import json
 import os
 from http.server import BaseHTTPRequestHandler, HTTPServer
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "esserver")
 SERVICE_NAME   = "elasticsearch"

templates/ftp/Dockerfile

@@ -8,13 +8,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 ENV PIP_BREAK_SYSTEM_PACKAGES=1
 RUN pip3 install --no-cache-dir twisted jinja2
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 21
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -22,5 +22,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/ftp/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/ftp/server.py

@@ -12,7 +12,7 @@ from twisted.internet import defer, reactor
 from twisted.protocols.ftp import FTP, FTPFactory, FTPAnonymousShell
 from twisted.python.filepath import FilePath
 from twisted.python import log as twisted_log
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "ftpserver")
 SERVICE_NAME   = "ftp"

templates/http/Dockerfile

@@ -8,13 +8,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 ENV PIP_BREAK_SYSTEM_PACKAGES=1
 RUN pip3 install --no-cache-dir flask jinja2
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 80 443
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -22,5 +22,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/http/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/http/server.py

@@ -12,7 +12,7 @@ from pathlib import Path
 
 from flask import Flask, request, send_from_directory
 from werkzeug.serving import make_server, WSGIRequestHandler
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 logging.getLogger("werkzeug").setLevel(logging.ERROR)
 

templates/https/Dockerfile

@@ -8,7 +8,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 ENV PIP_BREAK_SYSTEM_PACKAGES=1
 RUN pip3 install --no-cache-dir flask jinja2
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
@@ -16,8 +16,8 @@ RUN chmod +x /entrypoint.sh
 RUN mkdir -p /opt/tls
 
 EXPOSE 443
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
- && chown -R decnet:decnet /opt/tls \
+ && chown -R logrelay:logrelay /opt/tls \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -25,5 +25,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/https/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/https/server.py

@@ -14,7 +14,7 @@ from pathlib import Path
 
 from flask import Flask, request, send_from_directory
 from werkzeug.serving import make_server, WSGIRequestHandler
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 logging.getLogger("werkzeug").setLevel(logging.ERROR)
 

templates/imap/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 143 993
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/imap/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/imap/server.py

@@ -12,7 +12,7 @@ Banner advertises Dovecot so nmap fingerprints correctly.
 
 import asyncio
 import os
-from decnet_logging import SEVERITY_WARNING, syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import SEVERITY_WARNING, syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME   = os.environ.get("NODE_NAME", "mailserver")
 SERVICE_NAME = "imap"

templates/k8s/Dockerfile

@@ -8,13 +8,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 ENV PIP_BREAK_SYSTEM_PACKAGES=1
 RUN pip3 install --no-cache-dir flask
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 6443 8080
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -22,5 +22,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/k8s/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/k8s/server.py

@@ -10,7 +10,7 @@ import json
 import os
 
 from flask import Flask, request
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "k8s-master")
 SERVICE_NAME   = "k8s"

templates/ldap/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 389 636
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/ldap/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/ldap/server.py

@@ -7,7 +7,7 @@ invalidCredentials error. Logs all interactions as JSON.
 
 import asyncio
 import os
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "ldapserver")
 SERVICE_NAME   = "ldap"

templates/llmnr/Dockerfile

@@ -5,14 +5,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 5355/udp
 EXPOSE 5353/udp
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -20,5 +20,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/llmnr/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/llmnr/server.py

@@ -9,7 +9,7 @@ Logs every packet with source IP and decoded query name where possible.
 import asyncio
 import os
 import struct
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "lan-host")
 SERVICE_NAME   = "llmnr"

templates/mongodb/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 27017
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/mongodb/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/mongodb/server.py

@@ -9,7 +9,7 @@ received messages as JSON.
 import asyncio
 import os
 import struct
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "mongodb")
 SERVICE_NAME   = "mongodb"

templates/mqtt/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 1883
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/mqtt/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/mqtt/server.py

@@ -12,7 +12,7 @@ import json
 import os
 import random
 import struct
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "mqtt-broker")
 SERVICE_NAME   = "mqtt"

templates/mssql/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 1433
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/mssql/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/mssql/server.py

@@ -8,7 +8,7 @@ a login failed error. Logs auth attempts as JSON.
 import asyncio
 import os
 import struct
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "dbserver")
 SERVICE_NAME   = "mssql"

templates/mysql/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 3306
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/mysql/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/mysql/server.py

@@ -9,7 +9,7 @@ attempts as JSON.
 import asyncio
 import os
 import struct
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME     = os.environ.get("NODE_NAME", "dbserver")
 SERVICE_NAME   = "mysql"

templates/pop3/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 110 995
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/pop3/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/pop3/server.py

@@ -11,7 +11,7 @@ Credentials via IMAP_USERS env var (shared with IMAP service).
 
 import asyncio
 import os
-from decnet_logging import SEVERITY_WARNING, syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import SEVERITY_WARNING, syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME    = os.environ.get("NODE_NAME", "mailserver")
 SERVICE_NAME  = "pop3"

templates/postgres/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 5432
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/postgres/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/postgres/server.py

@@ -9,7 +9,7 @@ returns an error. Logs all interactions as JSON.
 import asyncio
 import os
 import struct
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "pgserver")
 SERVICE_NAME   = "postgres"

templates/rdp/Dockerfile

@@ -8,13 +8,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 ENV PIP_BREAK_SYSTEM_PACKAGES=1
 RUN pip3 install --no-cache-dir twisted jinja2
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 3389
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -22,5 +22,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/rdp/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/rdp/server.py

@@ -10,7 +10,7 @@ import os
 
 from twisted.internet import protocol, reactor
 from twisted.python import log as twisted_log
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "WORKSTATION")
 SERVICE_NAME   = "rdp"

templates/redis/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 6379
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/redis/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/redis/server.py

@@ -7,7 +7,7 @@ KEYS, and arbitrary commands. Logs every command and argument as JSON.
 
 import asyncio
 import os
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME    = os.environ.get("NODE_NAME", "cache-server")
 SERVICE_NAME   = "redis"

templates/sip/Dockerfile

@@ -5,14 +5,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 5060/udp
 EXPOSE 5060/tcp
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -20,5 +20,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/sip/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/sip/server.py

@@ -8,7 +8,7 @@ Authorization header and call metadata, then responds with 401 Unauthorized.
 import asyncio
 import os
 import re
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "pbx")
 SERVICE_NAME   = "sip"

templates/smb/Dockerfile

@@ -8,13 +8,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 ENV PIP_BREAK_SYSTEM_PACKAGES=1
 RUN pip3 install --no-cache-dir impacket jinja2
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 445 139
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -22,5 +22,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/smb/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/smb/server.py

@@ -7,7 +7,7 @@ Logs all connection attempts, optionally forwarding them as JSON to LOG_TARGET.
 import os
 
 from impacket import smbserver
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "WORKSTATION")
 SERVICE_NAME   = "smb"

templates/smtp/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 25 587
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/smtp/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/smtp/server.py

@@ -23,7 +23,7 @@ import base64
 import os
 import random
 import string
-from decnet_logging import SEVERITY_WARNING, syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import SEVERITY_WARNING, syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME   = os.environ.get("NODE_NAME", "mailserver")
 SERVICE_NAME = "smtp"

templates/sniffer/Dockerfile

@@ -7,6 +7,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 RUN pip3 install --no-cache-dir --break-system-packages "scapy==2.6.1"
 
-COPY decnet_logging.py server.py /opt/
+COPY syslog_bridge.py server.py /opt/
 
 ENTRYPOINT ["python3", "/opt/server.py"]

templates/sniffer/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/sniffer/server.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-DECNET passive TLS sniffer.
+syslog-relay passive TLS sniffer.
 
 Captures TLS handshakes on the MACVLAN interface (shared network namespace
 with the decky base container). Extracts fingerprints and connection
@@ -32,7 +32,7 @@ from typing import Any
 from scapy.layers.inet import IP, TCP
 from scapy.sendrecv import sniff
 
-from decnet_logging import SEVERITY_INFO, SEVERITY_WARNING, syslog_line, write_syslog_file
+from syslog_bridge import SEVERITY_INFO, SEVERITY_WARNING, syslog_line, write_syslog_file
 
 # ─── Configuration ────────────────────────────────────────────────────────────
 

templates/snmp/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 161/udp
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/snmp/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/snmp/server.py

@@ -9,7 +9,7 @@ Logs all requests as JSON.
 import asyncio
 import os
 import struct
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "switch")
 SERVICE_NAME   = "snmp"

templates/ssh/Dockerfile

@@ -19,8 +19,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     jq \
     && rm -rf /var/lib/apt/lists/*
 
-RUN mkdir -p /var/run/sshd /root/.ssh /var/log/decnet /var/decnet/captured \
+RUN mkdir -p /var/run/sshd /root/.ssh /var/log/journal /var/lib/systemd/coredump \
-    && chmod 700 /var/decnet /var/decnet/captured
+    && chmod 700 /var/lib/systemd/coredump
 
 # sshd_config: allow root + password auth; VERBOSE so session lines carry
 # client IP + session PID (needed for file-capture attribution).
@@ -34,11 +34,11 @@ RUN sed -i \
 # rsyslog: forward auth.* and user.* to named pipe in RFC 5424 format.
 # The entrypoint relays the pipe to stdout for Docker log capture.
 RUN printf '%s\n' \
-    '# DECNET log bridge — auth + user events → named pipe as RFC 5424' \
+    '# syslog-relay log bridge — auth + user events → named pipe as RFC 5424' \
     '$template RFC5424fmt,"<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"' \
     'auth,authpriv.*  |/run/systemd/journal/syslog-relay;RFC5424fmt' \
     'user.*           |/run/systemd/journal/syslog-relay;RFC5424fmt' \
-    > /etc/rsyslog.d/99-decnet.conf
+    > /etc/rsyslog.d/50-journal-forward.conf
 
 # Silence default catch-all rules so we own auth/user routing exclusively
 RUN sed -i \

templates/ssh/capture.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# DECNET SSH honeypot file-catcher.
+# SSH honeypot file-catcher.
 #
 # Watches attacker-writable paths with inotifywait. On close_write/moved_to,
 # copies the file to the host-mounted quarantine dir, writes a .meta.json
@@ -13,7 +13,7 @@
 
 set -u
 
-CAPTURE_DIR="${CAPTURE_DIR:-/var/decnet/captured}"
+CAPTURE_DIR="${CAPTURE_DIR:-/var/lib/systemd/coredump}"
 CAPTURE_MAX_BYTES="${CAPTURE_MAX_BYTES:-52428800}"  # 50 MiB
 CAPTURE_WATCH_PATHS="${CAPTURE_WATCH_PATHS:-/root /tmp /var/tmp /home /var/www /opt /dev/shm}"
 # Invoke inotifywait through a plausible-looking symlink so ps output doesn't
@@ -29,7 +29,7 @@ _is_ignored_path() {
     local p="$1"
     case "$p" in
         "$CAPTURE_DIR"/*) return 0 ;;
-        /var/decnet/*)    return 0 ;;
+        /var/lib/systemd/*) return 0 ;;
         */.bash_history)  return 0 ;;
         */.viminfo)       return 0 ;;
         */ssh_host_*_key*) return 0 ;;
@@ -116,7 +116,7 @@ _capture_one() {
     size="$(stat -c '%s' "$src" 2>/dev/null)"
     [ -z "$size" ] && return 0
     if [ "$size" -gt "$CAPTURE_MAX_BYTES" ]; then
-        logger -p user.info -t decnet-capture "file_skipped size=$size path=$src reason=oversize"
+        logger -p user.info -t systemd-journal "file_skipped size=$size path=$src reason=oversize"
         return 0
     fi
 
@@ -242,7 +242,7 @@ _capture_one() {
             ss_snapshot: $ss_snapshot
         }' > "$CAPTURE_DIR/$stored_as.meta.json"
 
-    logger -p user.info -t decnet-capture \
+    logger -p user.info -t systemd-journal \
         "file_captured orig_path=$src sha256=$sha size=$size stored_as=$stored_as src_ip=${src_ip:-unknown} ssh_user=${ssh_user:-unknown} attribution=$attribution"
 }
 

templates/ssh/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/ssh/entrypoint.sh

@@ -39,13 +39,13 @@ mkfifo /run/systemd/journal/syslog-relay
 
 bash -c 'exec -a "systemd-journal-fwd" cat /run/systemd/journal/syslog-relay' &
 
-# Start rsyslog (reads /etc/rsyslog.d/99-decnet.conf, writes to the pipe above)
+# Start rsyslog (reads /etc/rsyslog.d/50-journal-forward.conf, writes to the pipe above)
 rsyslogd
 
 # File-catcher: mirror attacker drops into host-mounted quarantine with attribution.
 # Script lives at /usr/libexec/udev/journal-relay so `ps aux` shows a
 # plausible udev helper. See Dockerfile for the rename rationale.
-CAPTURE_DIR=/var/decnet/captured /usr/libexec/udev/journal-relay &
+CAPTURE_DIR=/var/lib/systemd/coredump /usr/libexec/udev/journal-relay &
 
 # sshd logs via syslog — no -e flag, so auth events flow through rsyslog → pipe → stdout
 exec /usr/sbin/sshd -D

templates/syslog_bridge.py

@@ -1,15 +1,15 @@
 #!/usr/bin/env python3
 """
-Shared RFC 5424 syslog helper for DECNET service templates.
+Shared RFC 5424 syslog helper used by service containers.
 
 Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
+write_syslog_file() to emit it to stdout — the container runtime
-host-side collector streams it into the log file.
+captures it, and the host-side collector streams it into the log file.
 
 RFC 5424 structure:
   <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
 
-Facility: local0 (16), PEN for SD element ID: decnet@55555
+Facility: local0 (16). SD element ID uses PEN 55555.
 """
 
 from datetime import datetime, timezone
@@ -18,7 +18,7 @@ from typing import Any
 # ─── Constants ────────────────────────────────────────────────────────────────
 
 _FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
+_SD_ID = "relay@55555"
 _NILVALUE = "-"
 
 SEVERITY_EMERG   = 0
@@ -62,7 +62,7 @@ def syslog_line(
 
     Args:
         service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
+        hostname:   HOSTNAME (node name)
         event_type: MSGID    (e.g. "request", "login_attempt")
         severity:   Syslog severity integer (default: INFO=6)
         timestamp:  UTC datetime; defaults to now
@@ -80,10 +80,10 @@ def syslog_line(
 
 
 def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
+    """Emit a syslog line to stdout for container log capture."""
     print(line, flush=True)
 
 
 def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
+    """No-op stub. TCP forwarding is handled by rsyslog, not by service containers."""
     pass

templates/telnet/Dockerfile

@@ -10,11 +10,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 # rsyslog: forward auth.* and user.* to named pipe in RFC 5424 format
 RUN printf '%s\n' \
-    '# DECNET log bridge — auth + user events → named pipe as RFC 5424' \
+    '# syslog-relay log bridge — auth + user events → named pipe as RFC 5424' \
     '$template RFC5424fmt,"<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"' \
-    'auth,authpriv.*  |/var/run/decnet-logs;RFC5424fmt' \
+    'auth,authpriv.*  |/run/systemd/journal/syslog-relay;RFC5424fmt' \
-    'user.*           |/var/run/decnet-logs;RFC5424fmt' \
+    'user.*           |/run/systemd/journal/syslog-relay;RFC5424fmt' \
-    > /etc/rsyslog.d/99-decnet.conf
+    > /etc/rsyslog.d/50-journal-forward.conf
 
 # Disable imklog — containers can't read /proc/kmsg
 RUN sed -i 's/^\(module(load="imklog"\)/# \1/' /etc/rsyslog.conf

templates/telnet/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/telnet/entrypoint.sh

@@ -27,12 +27,14 @@ cat /root/.env
 HIST
 fi
 
-# Logging pipeline: named pipe → rsyslogd (RFC 5424) → stdout
+# Logging pipeline: named pipe → rsyslogd (RFC 5424) → stdout.
-rm -f /var/run/decnet-logs
+# Cloak the pipe path and the relay `cat` so `ps aux` / `ls /run` don't
-mkfifo /var/run/decnet-logs
+# betray the honeypot — see ssh/entrypoint.sh for the same pattern.
+mkdir -p /run/systemd/journal
+rm -f /run/systemd/journal/syslog-relay
+mkfifo /run/systemd/journal/syslog-relay
 
-# Relay pipe to stdout so Docker captures all syslog events
+bash -c 'exec -a "systemd-journal-fwd" cat /run/systemd/journal/syslog-relay' &
-cat /var/run/decnet-logs &
 
 # Start rsyslog
 rsyslogd

templates/tftp/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 69/udp
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/tftp/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/tftp/server.py

@@ -8,7 +8,7 @@ then responds with an error packet. Logs all requests as JSON.
 import asyncio
 import os
 import struct
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "tftpserver")
 SERVICE_NAME   = "tftp"

templates/vnc/Dockerfile

@@ -5,13 +5,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY decnet_logging.py /opt/decnet_logging.py
+COPY syslog_bridge.py /opt/syslog_bridge.py
 COPY server.py /opt/server.py
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 5900
-RUN useradd -r -s /bin/false -d /opt decnet \
+RUN useradd -r -s /bin/false -d /opt logrelay \
  && apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
  && rm -rf /var/lib/apt/lists/* \
  && (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
@@ -19,5 +19,5 @@ RUN useradd -r -s /bin/false -d /opt decnet \
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD kill -0 1 || exit 1
 
-USER decnet
+USER logrelay
 ENTRYPOINT ["/entrypoint.sh"]

templates/vnc/decnet_logging.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-"""
-Shared RFC 5424 syslog helper for DECNET service templates.
-
-Services call syslog_line() to format an RFC 5424 message, then
-write_syslog_file() to emit it to stdout — Docker captures it, and the
-host-side collector streams it into the log file.
-
-RFC 5424 structure:
-  <PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
-
-Facility: local0 (16), PEN for SD element ID: decnet@55555
-"""
-
-from datetime import datetime, timezone
-from typing import Any
-
-# ─── Constants ────────────────────────────────────────────────────────────────
-
-_FACILITY_LOCAL0 = 16
-_SD_ID = "decnet@55555"
-_NILVALUE = "-"
-
-SEVERITY_EMERG   = 0
-SEVERITY_ALERT   = 1
-SEVERITY_CRIT    = 2
-SEVERITY_ERROR   = 3
-SEVERITY_WARNING = 4
-SEVERITY_NOTICE  = 5
-SEVERITY_INFO    = 6
-SEVERITY_DEBUG   = 7
-
-_MAX_HOSTNAME = 255
-_MAX_APPNAME  = 48
-_MAX_MSGID    = 32
-
-# ─── Formatter ────────────────────────────────────────────────────────────────
-
-def _sd_escape(value: str) -> str:
-    """Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
-
-
-def _sd_element(fields: dict[str, Any]) -> str:
-    if not fields:
-        return _NILVALUE
-    params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
-    return f"[{_SD_ID} {params}]"
-
-
-def syslog_line(
-    service: str,
-    hostname: str,
-    event_type: str,
-    severity: int = SEVERITY_INFO,
-    timestamp: datetime | None = None,
-    msg: str | None = None,
-    **fields: Any,
-) -> str:
-    """
-    Return a single RFC 5424-compliant syslog line (no trailing newline).
-
-    Args:
-        service:    APP-NAME (e.g. "http", "mysql")
-        hostname:   HOSTNAME (decky node name)
-        event_type: MSGID    (e.g. "request", "login_attempt")
-        severity:   Syslog severity integer (default: INFO=6)
-        timestamp:  UTC datetime; defaults to now
-        msg:        Optional free-text MSG
-        **fields:   Encoded as structured data params
-    """
-    pri     = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
-    ts      = (timestamp or datetime.now(timezone.utc)).isoformat()
-    host    = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
-    appname = (service  or _NILVALUE)[:_MAX_APPNAME]
-    msgid   = (event_type or _NILVALUE)[:_MAX_MSGID]
-    sd      = _sd_element(fields)
-    message = f" {msg}" if msg else ""
-    return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
-
-
-def write_syslog_file(line: str) -> None:
-    """Emit a syslog line to stdout for Docker log capture."""
-    print(line, flush=True)
-
-
-def forward_syslog(line: str, log_target: str) -> None:
-    """No-op stub. TCP forwarding is now handled by rsyslog, not by service containers."""
-    pass

templates/vnc/server.py

@@ -8,7 +8,7 @@ failed". Logs the raw response for offline cracking.
 
 import asyncio
 import os
-from decnet_logging import syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME = os.environ.get("NODE_NAME", "desktop")
 SERVICE_NAME   = "vnc"

tests/live/test_service_isolation_live.py

@@ -172,7 +172,7 @@ class TestCollectorLiveIsolation:
 
     def test_rfc5424_parser_handles_real_formats(self):
         """Parser works on real log lines, not just test fixtures."""
-        valid = '<134>1 2026-04-14T12:00:00Z decky-01 ssh - login_attempt [decnet@55555 src_ip="10.0.0.1" username="root" password="toor"] Failed login'
+        valid = '<134>1 2026-04-14T12:00:00Z decky-01 ssh - login_attempt [relay@55555 src_ip="10.0.0.1" username="root" password="toor"] Failed login'
         result = parse_rfc5424(valid)
         assert result is not None
         assert result["decky"] == "decky-01"
@@ -236,7 +236,7 @@ class TestIngesterLiveIsolation:
             "attacker_ip": "10.99.99.1",
             "fields": {"username": "root", "password": "toor"},
             "msg": "Failed login",
-            "raw_line": '<134>1 2026-04-14T12:00:00Z decky-live-01 ssh - login_attempt [decnet@55555 src_ip="10.99.99.1"] Failed login',
+            "raw_line": '<134>1 2026-04-14T12:00:00Z decky-live-01 ssh - login_attempt [relay@55555 src_ip="10.99.99.1"] Failed login',
         }
         json_file.write_text(json.dumps(record) + "\n")
 
@@ -333,7 +333,7 @@ class TestAttackerWorkerLiveIsolation:
                 "attacker_ip": "10.77.77.1",
                 "fields": {"username": "admin"},
                 "msg": "",
-                "raw_line": f'<134>1 2026-04-14T14:0{i}:00Z decky-live-03 {"ssh" if i < 2 else "http"} - login_attempt [decnet@55555 src_ip="10.77.77.1" username="admin"]',
+                "raw_line": f'<134>1 2026-04-14T14:0{i}:00Z decky-live-03 {"ssh" if i < 2 else "http"} - login_attempt [relay@55555 src_ip="10.77.77.1" username="admin"]',
             })
 
         state = _WorkerState()

tests/service_testing/conftest.py

@@ -18,8 +18,8 @@ _FUZZ_SETTINGS = dict(
 )
 
 
-def make_fake_decnet_logging() -> ModuleType:
+def make_fake_syslog_bridge() -> ModuleType:
-    mod = ModuleType("decnet_logging")
+    mod = ModuleType("syslog_bridge")
     mod.syslog_line = MagicMock(return_value="")
     mod.write_syslog_file = MagicMock()
     mod.forward_syslog = MagicMock()

tests/service_testing/test_imap.py

@@ -17,8 +17,8 @@ import pytest
 
 # ── Helpers ───────────────────────────────────────────────────────────────────
 
-def _make_fake_decnet_logging() -> ModuleType:
+def _make_fake_syslog_bridge() -> ModuleType:
-    mod = ModuleType("decnet_logging")
+    mod = ModuleType("syslog_bridge")
     mod.syslog_line = MagicMock(return_value="")
     mod.write_syslog_file = MagicMock()
     mod.forward_syslog = MagicMock()
@@ -28,17 +28,17 @@ def _make_fake_decnet_logging() -> ModuleType:
 
 
 def _load_imap():
-    """Import imap server module, injecting a stub decnet_logging."""
+    """Import imap server module, injecting a stub syslog_bridge."""
     env = {
         "NODE_NAME": "testhost",
         "IMAP_USERS": "admin:admin123,root:toor",
         "IMAP_BANNER": "* OK [testhost] Dovecot ready.",
     }
     for key in list(sys.modules):
-        if key in ("imap_server", "decnet_logging"):
+        if key in ("imap_server", "syslog_bridge"):
             del sys.modules[key]
 
-    sys.modules["decnet_logging"] = _make_fake_decnet_logging()
+    sys.modules["syslog_bridge"] = _make_fake_syslog_bridge()
 
     spec = importlib.util.spec_from_file_location(
         "imap_server", "templates/imap/server.py"

tests/service_testing/test_mongodb.py

@@ -14,16 +14,16 @@ import pytest
 from hypothesis import given, settings
 from hypothesis import strategies as st
 
-from .conftest import _FUZZ_SETTINGS, make_fake_decnet_logging, run_with_timeout
+from .conftest import _FUZZ_SETTINGS, make_fake_syslog_bridge, run_with_timeout
 
 
 # ── Helpers ───────────────────────────────────────────────────────────────────
 
 def _load_mongodb():
     for key in list(sys.modules):
-        if key in ("mongodb_server", "decnet_logging"):
+        if key in ("mongodb_server", "syslog_bridge"):
             del sys.modules[key]
-    sys.modules["decnet_logging"] = make_fake_decnet_logging()
+    sys.modules["syslog_bridge"] = make_fake_syslog_bridge()
     spec = importlib.util.spec_from_file_location("mongodb_server", "templates/mongodb/server.py")
     mod = importlib.util.module_from_spec(spec)
     spec.loader.exec_module(mod)

tests/service_testing/test_mqtt.py

@@ -16,8 +16,8 @@ import pytest
 
 # ── Helpers ───────────────────────────────────────────────────────────────────
 
-def _make_fake_decnet_logging() -> ModuleType:
+def _make_fake_syslog_bridge() -> ModuleType:
-    mod = ModuleType("decnet_logging")
+    mod = ModuleType("syslog_bridge")
     mod.syslog_line = MagicMock(return_value="")
     mod.write_syslog_file = MagicMock()
     mod.forward_syslog = MagicMock()
@@ -34,10 +34,10 @@ def _load_mqtt(accept_all: bool = True, custom_topics: str = "", persona: str =
         "MQTT_CUSTOM_TOPICS": custom_topics,
     }
     for key in list(sys.modules):
-        if key in ("mqtt_server", "decnet_logging"):
+        if key in ("mqtt_server", "syslog_bridge"):
             del sys.modules[key]
 
-    sys.modules["decnet_logging"] = _make_fake_decnet_logging()
+    sys.modules["syslog_bridge"] = _make_fake_syslog_bridge()
 
     spec = importlib.util.spec_from_file_location("mqtt_server", "templates/mqtt/server.py")
     mod = importlib.util.module_from_spec(spec)

tests/service_testing/test_mqtt_fuzz.py

@@ -15,16 +15,16 @@ import pytest
 from hypothesis import given, settings
 from hypothesis import strategies as st
 
-from .conftest import _FUZZ_SETTINGS, make_fake_decnet_logging, run_with_timeout
+from .conftest import _FUZZ_SETTINGS, make_fake_syslog_bridge, run_with_timeout
 
 
 # ── Helpers ───────────────────────────────────────────────────────────────────
 
 def _load_mqtt():
     for key in list(sys.modules):
-        if key in ("mqtt_server", "decnet_logging"):
+        if key in ("mqtt_server", "syslog_bridge"):
             del sys.modules[key]
-    sys.modules["decnet_logging"] = make_fake_decnet_logging()
+    sys.modules["syslog_bridge"] = make_fake_syslog_bridge()
     spec = importlib.util.spec_from_file_location("mqtt_server", "templates/mqtt/server.py")
     mod = importlib.util.module_from_spec(spec)
     with patch.dict("os.environ", {"MQTT_ACCEPT_ALL": "1", "MQTT_PERSONA": "water_plant"}, clear=False):