nixos/udp514-journal: add module

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -38,6 +38,8 @@
 
 - [Moonlight Qt](https://moonlight-stream.org/), a client for playing your PC games on almost any device. Available as [programs.moonlight-qt](#opt-programs.moonlight-qt.enable).
 
+- [udp514-journal](https://github.com/eworm-de/udp514-journal), a service to forward remote syslog messages to systemd-journal. Available as [services.udp514-journal](#opt-services.udp514-journal.enable).
+
 - [RomM](https://romm.app/), a self-hosted ROM manager and player. Available as [services.romm](#opt-services.romm.enable).
 
 - [scx_loader](https://github.com/sched-ext/scx-loader), a system daemon and DBus-based loader for sched_ext schedulers. `scxctl` is the command-line client for interacting with the loader, allowing users to switch schedulers, modes, and arguments dynamically. Available as [services.scx-loader](#opt-services.scx-loader.enable)

nixos/modules/module-list.nix

@@ -781,6 +781,7 @@
   ./services/logging/syslog-ng.nix
   ./services/logging/syslogd.nix
   ./services/logging/SystemdJournal2Gelf.nix
+  ./services/logging/udp514-journal.nix
   ./services/logging/ulogd.nix
   ./services/logging/vector.nix
   ./services/mail/automx2.nix

nixos/modules/services/logging/udp514-journal.nix

@@ -0,0 +1,95 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.udp514-journal;
+  description = "Forward syslog from network (udp/514) to journal";
+in
+{
+  options = {
+    services.udp514-journal = {
+      enable = lib.mkEnableOption "the udp514-journal systemd socket/service";
+
+      openFirewall = lib.mkEnableOption "" // {
+        description = "Whether to open the port in the firewall.";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 514;
+        description = "Port to listen on";
+      };
+
+      package = lib.mkPackageOption pkgs "udp514-journal" { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.sockets.udp514-journal = {
+      enable = true;
+      name = "udp514-journal.socket";
+      inherit description;
+      listenDatagrams = [ (builtins.toString cfg.port) ];
+      wantedBy = [ "sockets.target" ];
+    };
+
+    systemd.services.udp514-journal = {
+      enable = true;
+      name = "udp514-journal.service";
+      inherit description;
+      requires = [
+        "systemd-journald.socket"
+        "udp514-journal.socket"
+      ];
+      serviceConfig = {
+        Type = "notify";
+        Restart = "always";
+        ExecStart = "${cfg.package}/bin/udp514-journal";
+        DynamicUser = "on";
+        CapabilityBoundingSet = "";
+        AmbientCapabilities = "";
+        ProtectSystem = "strict";
+        ProtectHome = "on";
+        PrivateDevices = "on";
+        PrivateTmp = true;
+        PrivateUsers = "self";
+        PrivateNetwork = "on";
+        RestrictAddressFamilies = [ "AF_UNIX" ];
+        RestrictNamespaces = true;
+        RestrictSUIDSGID = true;
+        RestrictRealtime = true;
+        LockPersonality = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = "on";
+        ProtectControlGroups = "strict";
+        ProtectProc = "noaccess";
+        ProcSubset = "pid";
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        MemoryMax = "5M";
+        UMask = "0077";
+      };
+      confinement = {
+        enable = true;
+        binSh = null;
+      };
+    };
+
+    networking.firewall.allowedUDPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ usovalx ];
+}

nixos/tests/all-tests.nix

@@ -1822,6 +1822,7 @@ in
   ucarp = runTest ./ucarp.nix;
   udisks2 = runTest ./udisks2.nix;
   udp-over-tcp = runTest ./udp-over-tcp.nix;
+  udp514-journal = runTest ./udp514-journal.nix;
   ulogd = runTest ./ulogd/ulogd.nix;
   umami = runTest ./web-apps/umami.nix;
   umurmur = runTest ./umurmur.nix;

nixos/tests/udp514-journal.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  name = "udp514-journal";
+  meta.maintainers = with lib.maintainers; [ usovalx ];
+
+  containers.machine = {
+    services.udp514-journal.enable = true;
+    environment.systemPackages = [ pkgs.netcat ];
+  };
+
+  testScript = ''
+    import datetime
+    start_all()
+
+    machine.wait_for_unit("udp514-journal.socket");
+
+    # send a test log entry via UDP, RFC 5424 format
+    machine.execute('echo "<34>1 2026-08-01T00:24:15.123+01:00 router01 - testing" | nc -w1 -u localhost 514')
+
+    machine.wait_until_succeeds('journalctl -u udp514-journal --grep "router01 - testing"', timeout = datetime.timedelta(seconds=60))
+  '';
+}

pkgs/by-name/ud/udp514-journal/package.nix

@@ -4,7 +4,8 @@
   fetchFromGitHub,
   systemdLibs,
   pkg-config,
-  discount
+  discount,
+  nixosTests,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -40,6 +41,8 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
   __structuredAttrs = true;
 
+  passthru.tests.nixos = nixosTests.udp514-journal;
+
   meta = with lib; {
     description = "Forward syslog from network (udp/514) to journal";
     homepage = "https://github.com/eworm-de/udp514-journal";