chore: initial import from KNEL/PFVCluster@041d311 [#769]

Split per O&M lane work order. Full history: KNEL/PFVCluster.
https://projects.knownelement.com/issues/769#note-4152

deploy-rsyslog.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+#
+# deploy-rsyslog.sh — rsyslog forwarding to Wazuh for PVE hosts [#335]
+# Run as root on the target host. Idempotent; safe to re-run.
+# Forwards everything via TCP/514 to tsys-wazuh.knel.net (Tailscale
+# overlay; manager allowlist = 100.64.0.0/10). journald stays the local SoR.
+#
+set -euo pipefail
+
+MGR="tsys-wazuh.knel.net"
+
+if ! dpkg -s rsyslog >/dev/null 2>&1; then
+  echo "installing rsyslog"
+  DEBIAN_FRONTEND=noninteractive apt-get install -y rsyslog
+fi
+
+F=/etc/rsyslog.d/90-forward-wazuh.conf
+if [ ! -f "$F" ]; then
+  printf '# Wazuh syslog forwarding (Tailscale overlay) [#335]\n*.* @@%s:514\n' "$MGR" > "$F"
+  echo "forward rule installed"
+else
+  echo "forward rule already present"
+fi
+
+systemctl enable --now rsyslog >/dev/null 2>&1 || true
+systemctl restart rsyslog
+sleep 2
+systemctl -q is-active rsyslog && echo "rsyslog ACTIVE"
+logger -p auth.warning "wazuh-trail-test host=$(hostname) stamp=$(date +%s)"
+echo "trail event sent from $(hostname)"