up

ops/devops/airgap/README.md

@@ -10,5 +10,7 @@ Artifacts supporting `DEVOPS-AIRGAP-56-001`:
 - `build_bootstrap_pack.py` — Builds a Bootstrap Pack from images/charts/extras listed in a JSON config, writing `bootstrap-manifest.json` + `checksums.sha256` deterministically.
 - `build_bootstrap_pack.sh` — Wrapper for the bootstrap pack builder.
 - `build_mirror_bundle.py` — Generates mirror bundle manifest + checksums with dual-control approvals; optional cosign signing. Outputs `mirror-bundle-manifest.json`, `checksums.sha256`, and optional signature/cert.
+- `compose-syslog-smtp.yaml` — Local SMTP (MailHog) + syslog-ng stack for sealed environments.
+- `health_syslog_smtp.sh` — Brings up the syslog/SMTP stack via docker compose and performs health checks (MailHog API + syslog logger).
 
 See also `ops/devops/sealed-mode-ci/` for the full sealed-mode compose harness and `egress_probe.py`, which this verification script wraps.

ops/devops/airgap/compose-syslog-smtp.yaml

@@ -0,0 +1,31 @@
+version: "3.9"
+
+services:
+  smtp:
+    image: mailhog/mailhog:v1.0.1
+    container_name: mailhog
+    ports:
+      - "1025:1025"   # SMTP (plain)
+      - "8025:8025"   # Web UI
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:8025/api/v2/health"]
+      interval: 10s
+      timeout: 3s
+      retries: 5
+      start_period: 5s
+    restart: unless-stopped
+
+  syslog:
+    image: balabit/syslog-ng:4.7.1
+    container_name: syslog-ng
+    ports:
+      - "514:514/udp"
+      - "514:514/tcp"
+    command: ["/usr/sbin/syslog-ng", "-F", "-p", "/var/run/syslogd.pid"]
+    healthcheck:
+      test: ["CMD", "syslog-ng-ctl", "stats"]
+      interval: 10s
+      timeout: 3s
+      retries: 5
+      start_period: 5s
+    restart: unless-stopped

ops/devops/airgap/health_syslog_smtp.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Health check for compose-syslog-smtp.yaml (DEVOPS-AIRGAP-58-001)
+
+COMPOSE_FILE="$(cd "$(dirname "$0")" && pwd)/compose-syslog-smtp.yaml"
+
+echo "Starting syslog+smtp stack..."
+docker compose -f "$COMPOSE_FILE" up -d
+
+echo "Waiting for health checks..."
+docker compose -f "$COMPOSE_FILE" wait >/dev/null 2>&1 || true
+
+echo "Current health status:"
+docker compose -f "$COMPOSE_FILE" ps
+
+echo "Sending test syslog message (UDP)..."
+logger -n 127.0.0.1 -P 514 -d "test syslog message $(date -u +%s)"
+
+echo "SMTP health endpoint:"
+curl -sf http://127.0.0.1:8025/api/v2/health || exit 1
+
+echo "Done."