logging: default rules come from the init script, not a trailing fallback rule

rsyslog flagged the fallback action after the include as unreachable (the rendered rules end in stop). The forgefirm-logging init script now writes a default rules file when the render leaves none, and the shipped rsyslog.conf carries only the include.

meta-forgefirm/recipes-extended/rsyslog/rsyslog/rsyslog.conf

@@ -35,12 +35,8 @@ template(name="ff_line" type="list") {
 }
 
 # The rendered per-logger rules (levels, remote target). Every message
-# is consumed there (each block ends in stop).
+# is consumed there (each block ends in stop). The forgefirm-logging
+# init script guarantees the file exists before this daemon starts: it
+# writes a default rules file (everything to system/, info and above)
+# if the render fails.
 include(file="/data/forgefirm/rsyslog-forgefirm.conf" mode="optional")
-
-# Reached only if the rules file is missing (a boot where the render
-# failed): keep everything, on disk, at info and above.
-if $syslogseverity <= 6 then action(type="omfile"
-    file="/data/log/forgefirm/system/system.log" template="ff_line"
-    asyncWriting="on" flushOnTXEnd="off" flushInterval="1"
-    fileCreateMode="0640" dirCreateMode="0755" createDirs="on")

meta-forgefirm/recipes-forgefirm/forgefirm-logging/files/forgefirm-logging.init

@@ -22,10 +22,25 @@ CONF=/etc/logrotate.conf
 PIDFILE=/var/run/forgefirm-logging.pid
 LEGACY=/data/forgefirm/legacy-logs
 
+RULES=/data/forgefirm/rsyslog-forgefirm.conf
+
 render() {
-    [ -x "$FORGECTRL" ] || return 0
     # syslog is not up yet at this point: report to the console
+    if [ -x "$FORGECTRL" ]; then
         "$FORGECTRL" --render-syslog || echo "forgefirm-logging: render-syslog failed"
+    fi
+    [ -s "$RULES" ] && return 0
+    # No rules (render failed, or a first boot without the daemon):
+    # keep everything on disk under system/, info and above, so the
+    # boot is not lost. Replaced by the real render at the next boot.
+    echo "forgefirm-logging: writing default rules to $RULES"
+    mkdir -p /data/forgefirm /data/log/forgefirm/system
+    cat > "$RULES" <<'EOF'
+# DEFAULT rules - forgectrl --render-syslog did not run; everything to
+# system/ at info and above. Rewritten at the next boot.
+if $syslogseverity <= 6 then action(type="omfile" file="/data/log/forgefirm/system/system.log" template="ff_line" asyncWriting="on" flushOnTXEnd="off" flushInterval="1" fileCreateMode="0640" dirCreateMode="0755" createDirs="on")
+stop
+EOF
 }
 
 # Files written by ForgeFIRM before it logged through syslog. Moved, not