feat(syslog): devices through Swarm's ingress told apart by name; the send-to address is a setting (#6096)

Through ingress every device arrives from Docker's own address, so a
source there is keyed by the hostname its lines carry (new column
sender, unique with address). The set-up help no longer guesses the
address from the web hostname: it shows the plugin's send_to setting,
covers ingress and host mode, ASUSTOR ADM, and both syslog formats.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/syslog/templates/syslog/index.html

@@ -34,36 +34,43 @@
   {% if listener.senders_full %}<p class="tone-warn" style="margin:0.4rem 0 0;">Steward knows {{ listener.max_senders }} senders, the most it keeps; a new one is counted, not offered{% if listener.unoffered %} ({{ "{:,}".format(listener.unoffered) }} line{{ "s" if listener.unoffered != 1 }} so far){% endif %}. Remove ones you don't need.</p>{% endif %}
 </section>
 
-{% set hidden_senders = (offered + sources)|selectattr("docker_address")|list %}
-{% if hidden_senders %}
-<p class="tone-warn" role="status">{{ hidden_senders|map(attribute="address")|unique|join(", ") }} {{ "is" if hidden_senders|map(attribute="address")|unique|list|length == 1 else "are" }} on Steward's own container network: Docker is most likely standing in for the real devices, so they all read as one sender. Publish the port in host mode, as <a href="#syslog-setup">Point a device here</a> shows.</p>
+{% set unnamed = (offered + sources)|selectattr("docker_address")|rejectattr("sender")|list %}
+{% if unnamed %}
+<p class="tone-warn" role="status">Lines from {{ unnamed|map(attribute="address")|unique|join(", ") }} come through Docker's own address and carry no device name, so the devices sending them can't be told apart. Have each device put its hostname in its lines, or publish the port in host mode, as <a href="#syslog-setup">Point a device here</a> shows.</p>
 {% endif %}
 
 <details class="card" id="syslog-setup"{% if not sources and not offered %} open{% endif %}>
   <summary class="section-title" style="cursor:pointer;">Point a device here</summary>
   {% set port = listener.port %}
   {% set proto = listener.protocols|join(" or ") or "UDP or TCP" %}
-  <p style="margin:0.75rem 0 0.5rem;">In the device's remote syslog settings, send to <span class="mono">{{ server }}</span>, port <span class="mono">{{ port }}</span>, {{ proto }}. If the device can't resolve that name, use the server's IP address. Choose the RFC 5424 (IETF) format where it is offered: its lines carry their zone. Once a device sends, it appears above as sending, and Add keeps its lines.</p>
+  {% set to = server or "ADDRESS" %}
+  <p style="margin:0.75rem 0 0.5rem;">In the device's remote syslog settings, send to {% if server %}<span class="mono">{{ server }}</span>{% else %}the IP address of a Docker host that publishes the port (<span class="mono">ADDRESS</span> below; set it under Settings → Plugins → Syslog, "Send to"){% endif %}, port <span class="mono">{{ port }}</span>, {{ proto }}. Either syslog format is read: the BSD one (RFC 3164) or the IETF one (RFC 5424), which is better where a device offers the choice, as its lines carry their zone. Once a device sends, it appears above as sending, and Add keeps its lines.</p>
   <table class="table" style="width:100%;font-size:0.82rem;">
     <thead><tr><th>Device</th><th>Where</th></tr></thead>
     <tbody>
-      <tr><td>Synology (DSM)</td><td>Log Center → Log Sending: send logs to a syslog server, with the server, port, protocol and the IETF format.</td></tr>
+      <tr><td>Synology (DSM)</td><td>Log Center → Log Sending: send logs to a syslog server, with the server, port and protocol. Choose the IETF format if it is offered.</td></tr>
+      <tr><td>ASUSTOR (ADM)</td><td>In ADM's system log settings, send logs to a syslog server, with the server, port and protocol. ADM offers no format choice; Steward reads the BSD format it sends.</td></tr>
       <tr><td>QNAP (QTS)</td><td>QuLog Center → Log Sender: add a destination with the server, port, protocol and RFC 5424.</td></tr>
-      <tr><td>TrueNAS</td><td>System → Advanced Settings → Syslog: the remote syslog server as <span class="mono">{{ server }}:{{ port }}</span>, and its transport.</td></tr>
+      <tr><td>TrueNAS</td><td>System → Advanced Settings → Syslog: the remote syslog server as <span class="mono">{{ to }}:{{ port }}</span>, and its transport.</td></tr>
       <tr><td>OpenWrt</td><td>System → System → Logging: the external system log server, its port and protocol.</td></tr>
       <tr><td>UniFi</td><td>Network settings, under remote logging (named Activity Logging or SIEM server in newer versions): the server and port.</td></tr>
-      <tr><td>Linux (rsyslog)</td><td><span class="mono">*.* @{{ server }}:{{ port }}</span> (UDP) or <span class="mono">*.* @@{{ server }}:{{ port }}</span> (TCP) in <span class="mono">/etc/rsyslog.d/90-steward.conf</span>, then restart rsyslog.</td></tr>
+      <tr><td>Linux (rsyslog)</td><td><span class="mono">*.* @{{ to }}:{{ port }}</span> (UDP) or <span class="mono">*.* @@{{ to }}:{{ port }}</span> (TCP) in <span class="mono">/etc/rsyslog.d/90-steward.conf</span>, then restart rsyslog.</td></tr>
     </tbody>
   </table>
   <h3 class="section-title" style="margin:1rem 0 0.4rem;font-size:0.9rem;">Nothing arriving?</h3>
   <ul class="field-hint" style="margin:0;padding-left:1.1rem;">
-    <li>Steward's container must publish port {{ port }}. In Docker Swarm publish it in <strong>host mode</strong>: through Swarm's default ingress every device reaches Steward from one internal address and can't be told apart.</li>
+    <li>Steward's service must publish port {{ port }}, for UDP and TCP both. In Docker Swarm, either way works:
+      <ul style="padding-left:1.1rem;">
+        <li><strong>Ingress</strong> (Swarm's default; Steward can move between nodes): send to any node's address, or an address shared over the nodes. Every line then arrives from Docker's own address, so Steward tells the devices apart by the hostname in their lines; a device must send one.</li>
+        <li><strong>Host mode</strong> (add <span class="mono">mode: host</span>): each device keeps its own address, but only the node running Steward answers, so send to that node.</li>
+      </ul>
+    </li>
     <li>A firewall on the server, or between the device's network and the server's, may drop it.</li>
     <li>Ports below 1024, such as syslog's usual 514, can't be opened by Steward. Map 514 to {{ port }} where the port is published, or point devices at {{ port }}.</li>
   </ul>
   <pre class="mono" style="margin:0.6rem 0 0;font-size:0.78rem;white-space:pre-wrap;">ports:
-  - { target: {{ port }}, published: {{ port }}, protocol: udp, mode: host }
-  - { target: {{ port }}, published: {{ port }}, protocol: tcp, mode: host }</pre>
+  - { target: {{ port }}, published: {{ port }}, protocol: udp }
+  - { target: {{ port }}, published: {{ port }}, protocol: tcp }</pre>
 </details>
 
 {% if offered %}
@@ -75,15 +82,15 @@
     <tbody>
     {% for s in offered %}
     <tr>
-      <td><span class="mono">{{ s.address }}</span>{% if s.hostname_seen %}<div class="field-hint">calls itself {{ s.hostname_seen }}</div>{% endif %}{% if s.docker_address %}<div class="tone-warn" style="font-size:0.78rem;">Docker's address, not the device's</div>{% endif %}</td>
+      <td>{% if s.sender %}<span class="mono">{{ s.sender }}</span><div class="field-hint">through Docker's ingress, {{ s.address }}</div>{% else %}<span class="mono">{{ s.address }}</span>{% if s.hostname_seen %}<div class="field-hint">calls itself {{ s.hostname_seen }}</div>{% endif %}{% if s.docker_address %}<div class="tone-warn" style="font-size:0.78rem;">Docker's address, not the device's</div>{% endif %}{% endif %}</td>
       <td>{{ "{:,}".format(s.lines_total) }}</td>
       <td>{{ s.last_seen_at|ago }}</td>
       <td class="mono" style="max-width:28rem;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;" title="{{ s.last_line }}"><span class="{{ tone(s.level) }}">{{ s.severity or "" }}</span> {{ s.last_line or "—" }}</td>
       {% if admin %}
       <td style="white-space:nowrap;">
         <form method="post" action="/plugins/syslog/sources/{{ s.id }}/add" style="display:inline-flex;gap:0.4rem;align-items:center;margin:0;">{{ csrf_field() }}
-          <input class="input" name="name" aria-label="Name for {{ s.address }}" maxlength="100" value="{{ s.hostname_seen or '' }}" placeholder="Name" style="width:9rem;">
-          <select class="input" name="host_id" aria-label="Host for {{ s.address }}" style="width:9rem;">
+          <input class="input" name="name" aria-label="Name for {{ s.sender or s.address }}" maxlength="100" value="{{ s.hostname_seen or '' }}" placeholder="Name" style="width:9rem;">
+          <select class="input" name="host_id" aria-label="Host for {{ s.sender or s.address }}" style="width:9rem;">
             <option value="">No host</option>
             {% for h in hosts %}<option value="{{ h.id }}"{% if s.suggested_host == h.id %} selected{% endif %}>{{ h.name }}</option>{% endfor %}
           </select>
@@ -114,7 +121,7 @@
     <tbody>
     {% for s in sources %}
     <tr>
-      <td><a href="/plugins/syslog/sources/{{ s.id }}">{{ s.name }}</a><div class="field-hint mono">{{ s.address }}</div>{% if s.docker_address %}<div class="tone-warn" style="font-size:0.78rem;">Docker's address, not the device's</div>{% endif %}</td>
+      <td><a href="/plugins/syslog/sources/{{ s.id }}">{{ s.name }}</a><div class="field-hint mono">{{ s.address }}</div>{% if s.sender %}<div class="field-hint">through Docker's ingress</div>{% elif s.docker_address %}<div class="tone-warn" style="font-size:0.78rem;">Docker's address, not the device's</div>{% endif %}</td>
       <td>{% if s.host %}<a href="/hosts/{{ s.host.id }}">{{ s.host.name }}</a>{% else %}—{% endif %}</td>
       <td class="num">{{ "{:,}".format(s.rate or 0) }}</td>
       <td>{{ s.last_seen_at|ago }}</td>
@@ -135,7 +142,7 @@
     <tbody>
     {% for s in ignored %}
     <tr>
-      <td><span class="mono">{{ s.address }}</span>{% if s.hostname_seen %}<div class="field-hint">calls itself {{ s.hostname_seen }}</div>{% endif %}</td>
+      <td><span class="mono">{{ s.sender or s.address }}</span>{% if s.sender %}<div class="field-hint">through Docker's ingress, {{ s.address }}</div>{% elif s.hostname_seen %}<div class="field-hint">calls itself {{ s.hostname_seen }}</div>{% endif %}</td>
       <td>{{ "{:,}".format(s.lines_total) }}</td>
       <td>{{ s.last_seen_at|ago }}</td>
       {% if admin %}<td><form method="post" action="/plugins/syslog/sources/{{ s.id }}/offer" style="margin:0;">{{ csrf_field() }}<button type="submit" class="btn btn-sm btn-ghost">Offer again</button></form></td>{% endif %}