# /etc/cron.d/hitechcloud: crontab entries for the HiTechCloudPanel server
#
#
# This file is used by HiTechCloudPanel to schedule cronjobs
#
# It should NOT be edited manually,
# instead edit from HiTechAdmin > Advanced > System CronJobs
#
# To add crons, use the crontab as root user.
#
# Important Note!  This cronjob will NOT be executed if you are
# running systemd as your init system.  If you are running systemd,
# the cronjob.timer function takes precedence over this cronjob.  For
# more details, see the systemd.timer manpage.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# STATISTICS
0 * * * * root /usr/local/bin/hitechcloudcli docker-collect_stats --all && echo "$(date) Resource usage data updated" >> /var/log/hitechcloud/admin/cron.log
*/5 * * * * root /usr/local/bin/hitechcloudcli user-quota && echo "$(date) Collected disk and inodes usage for all users" >> /var/log/hitechcloud/admin/cron.log
30 2 * * * root /usr/local/bin/hitechcloudcli domains-stats && echo "$(date) Domain statistics collected" >> /var/log/hitechcloud/admin/cron.log
0 4 * * * root /usr/local/bin/hitechcloudcli websites-pagespeed --all && echo "$(date) Google PageSpeed data collected for all domains" >> /var/log/hitechcloud/admin/cron.log
0 5 */2 * * root /usr/local/bin/hitechcloudcli websites-vulnerability --all && echo "$(date) WordPress websites scanned for known vulnerabilities" >> /var/log/hitechcloud/admin/cron.log
0 */4 * * * root /usr/local/bin/hitechcloudcli files-calculate_resellers_storage && echo "$(date) Calculated storage usage for all reseller accounts" >> /var/log/hitechcloud/admin/cron.log

# MAINTENANCE
15 0 * * * root /usr/local/bin/hitechcloudcli update && echo "$(date) System update executed" >> /var/log/hitechcloud/admin/cron.log
0 */8 * * * root /usr/local/bin/hitechcloudcli ftp-users && echo "$(date) FTP users file recreated" >> /var/log/hitechcloud/admin/cron.log
45 1 * * * root /usr/local/bin/hitechcloudcli email-server pflogsumm && echo "$(date) Generated email summary report for HiTechAdmin > Emails > Summary Reports" >> /var/log/hitechcloud/admin/cron.log
45 4 * * * root /usr/local/bin/hitechcloudcli files-purge_trash && echo "$(date) Executed purging Trash folder for all users" >> /var/log/hitechcloud/admin/cron.log
# Every five minutes, and not on any other interval: the outbound send counter
# keeps twelve five-minute buckets and calls their sum "the last hour". Run it
# less often and the hour is measured out of stale buckets; run it more often
# and the same five minutes is counted twice.
*/5 * * * * root /usr/local/bin/hitechcloudcli email-sendlimit enforce >> /var/log/hitechcloud/admin/cron.log 2>&1
# The plan's account-wide mailbox storage (plans.mail_storage_gb): measured, and
# every domain of an account at or over it refused by Postfix (452 4.2.2, which
# the sender retries), then accepted again once it is under. Writes the report
# the Usage page and the admin's Email Settings page show.
*/5 * * * * root /usr/local/bin/hitechcloudcli mailusage enforce >> /var/log/hitechcloud/admin/cron.log 2>&1
# No OWASP CRS update line: `hitechcloudcli waf-update` is not a command
# this CLI has (the line failed every month with nothing in the log, since
# its `&& echo` never ran), and the web firewall's rules and feeds are kept
# current by hitechcloud-waf-feeds.timer and hitechcloud-waf-bots.timer.
# The country in each account's login history is looked up in DB-IP's IP to
# Country Lite database (CC BY 4.0, https://db-ip.com), fetched through the
# pinned vendor.json entry - mirror first, checksum checked either way - and
# unpacked beside it. Monthly, because DB-IP publishes a new edition at the
# start of every month and its pin arrives with the panel's own update.
20 3 5 * * root /usr/local/bin/hitechcloudcli vendor fetch dbip-country-lite /var/lib/hitechcloud/geoip/dbip-country-lite.mmdb.gz && gunzip -c /var/lib/hitechcloud/geoip/dbip-country-lite.mmdb.gz > /var/lib/hitechcloud/geoip/dbip-country-lite.mmdb.part && mv -f /var/lib/hitechcloud/geoip/dbip-country-lite.mmdb.part /var/lib/hitechcloud/geoip/dbip-country-lite.mmdb && echo "$(date) Country database for the login history refreshed" >> /var/log/hitechcloud/admin/cron.log
0 1 * * 0 root /usr/local/bin/hitechcloudcli backup && echo "$(date) Executed system backup - view logs from: HiTechAdmin > Backups > System > Runs" >> /var/log/hitechcloud/admin/cron.log
# No arguments: every account is the default. `--all` is not an option of
# files-malware_scan, which refuses an option it does not know, so the line
# that passed it never scanned anything. `hitechcloudcli install` adds this
# line only on a server where hitechcloud-malwarescan.timer is not enabled.
0 0 * * 0 root /usr/local/bin/hitechcloudcli files-malware_scan && echo "$(date) Executed ClamAV scan for all users" >> /var/log/hitechcloud/admin/cron.log
# Every account's backup, in the task HiTechAdmin > Backups > User Backups >
# Run Now starts (one `hitechcloudcli user-backup --account` per account, a
# line each in its Runs log). 31 February is never: that page's Settings tab
# sets the schedule. It was `hitechcloudcli docker-backup`, which backs up
# nothing when the services run on the host; the update re-points that line.
59 23 31 2 * root /usr/local/bin/hitechcloudadmin-engine backup-users && echo "$(date) Executed Backup for all users" >> /var/log/hitechcloud/admin/cron.log

# MONITORING
*/5 * * * * root /usr/local/bin/hitechcloudcli sentinel && echo "$(date) Notifications script executed" >> /var/log/hitechcloud/admin/cron.log
45 11 * * * root /usr/local/bin/hitechcloudcli sentinel --report && echo "$(date) Daily Usage Report generated" >> /var/log/hitechcloud/admin/cron.log
@reboot root /usr/local/bin/hitechcloudcli sentinel --startup && echo "$(date) Notifications script executed at startup" >> /var/log/hitechcloud/admin/cron.log

# COMPLIANCE
# Every five minutes: one uptime observation per service, which is what the
# public status page shows and what the SLA credit is computed from. The
# status page calls an observation stale after fifteen minutes, so three
# missed runs is the point at which it stops presenting the last one as
# current - run this less often and the page reads "unknown" most of the time.
*/5 * * * * root /usr/local/bin/hitechcloudcli compliance-run -probe >> /var/log/hitechcloud/admin/cron.log 2>&1
# Hourly: copy new lines from the panel's login and activity logs into the
# tamper-evident audit chain. Hourly rather than daily because the panel trims
# a user's activity.log once it passes its size limit, and anything trimmed
# before this has run is gone.
7 * * * * root /usr/local/bin/hitechcloudcli compliance-run -ingest >> /var/log/hitechcloud/admin/cron.log 2>&1
# Just after midnight UTC: seal yesterday, once, and report any rotation rule
# that would discard a log before Nghị định 53/2022/NĐ-CP allows. The seal
# anchor is in this job's output - copy it somewhere off this server, because
# a seal that never leaves the machine protects against nothing an operator
# with root cannot undo.
20 0 * * * root /usr/local/bin/hitechcloudcli compliance-run -seal -check >> /var/log/hitechcloud/admin/cron.log 2>&1
