From 7487f907f4ec7e0c387b5312d0ec51265cfea0c1 Mon Sep 17 00:00:00 2001
From: ScottW514 <s.e.wiederhold@gmail.com>
Date: Sat, 15 Aug 2026 15:27:24 -0400
Subject: [PATCH] logging: default rules come from the init script, not a
 trailing fallback rule

rsyslog flagged the fallback action after the include as unreachable (the rendered rules end in stop). The forgefirm-logging init script now writes a default rules file when the render leaves none, and the shipped rsyslog.conf carries only the include.
---
 .../rsyslog/rsyslog/rsyslog.conf              | 12 ++++--------
 .../files/forgefirm-logging.init              | 19 +++++++++++++++++--
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/meta-forgefirm/recipes-extended/rsyslog/rsyslog/rsyslog.conf b/meta-forgefirm/recipes-extended/rsyslog/rsyslog/rsyslog.conf
index 2e2c8f7..fd421b2 100644
--- a/meta-forgefirm/recipes-extended/rsyslog/rsyslog/rsyslog.conf
+++ b/meta-forgefirm/recipes-extended/rsyslog/rsyslog/rsyslog.conf
@@ -35,12 +35,8 @@ template(name="ff_line" type="list") {
 }
 
 # The rendered per-logger rules (levels, remote target). Every message
-# is consumed there (each block ends in stop).
+# is consumed there (each block ends in stop). The forgefirm-logging
+# init script guarantees the file exists before this daemon starts: it
+# writes a default rules file (everything to system/, info and above)
+# if the render fails.
 include(file="/data/forgefirm/rsyslog-forgefirm.conf" mode="optional")
-
-# Reached only if the rules file is missing (a boot where the render
-# failed): keep everything, on disk, at info and above.
-if $syslogseverity <= 6 then action(type="omfile"
-    file="/data/log/forgefirm/system/system.log" template="ff_line"
-    asyncWriting="on" flushOnTXEnd="off" flushInterval="1"
-    fileCreateMode="0640" dirCreateMode="0755" createDirs="on")
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-logging/files/forgefirm-logging.init b/meta-forgefirm/recipes-forgefirm/forgefirm-logging/files/forgefirm-logging.init
index 2f6feb4..056c035 100644
--- a/meta-forgefirm/recipes-forgefirm/forgefirm-logging/files/forgefirm-logging.init
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-logging/files/forgefirm-logging.init
@@ -22,10 +22,25 @@ CONF=/etc/logrotate.conf
 PIDFILE=/var/run/forgefirm-logging.pid
 LEGACY=/data/forgefirm/legacy-logs
 
+RULES=/data/forgefirm/rsyslog-forgefirm.conf
+
 render() {
-    [ -x "$FORGECTRL" ] || return 0
     # syslog is not up yet at this point: report to the console
-    "$FORGECTRL" --render-syslog || echo "forgefirm-logging: render-syslog failed"
+    if [ -x "$FORGECTRL" ]; then
+        "$FORGECTRL" --render-syslog || echo "forgefirm-logging: render-syslog failed"
+    fi
+    [ -s "$RULES" ] && return 0
+    # No rules (render failed, or a first boot without the daemon):
+    # keep everything on disk under system/, info and above, so the
+    # boot is not lost. Replaced by the real render at the next boot.
+    echo "forgefirm-logging: writing default rules to $RULES"
+    mkdir -p /data/forgefirm /data/log/forgefirm/system
+    cat > "$RULES" <<'EOF'
+# DEFAULT rules - forgectrl --render-syslog did not run; everything to
+# system/ at info and above. Rewritten at the next boot.
+if $syslogseverity <= 6 then action(type="omfile" file="/data/log/forgefirm/system/system.log" template="ff_line" asyncWriting="on" flushOnTXEnd="off" flushInterval="1" fileCreateMode="0640" dirCreateMode="0755" createDirs="on")
+stop
+EOF
 }
 
 # Files written by ForgeFIRM before it logged through syslog. Moved, not