First commit Go counter service

contrib/migadu_counters-pull.cron

@@ -0,0 +1,23 @@
+# migadu_counters: pull the rspamd domains CDB from the agent host.
+# Install as /etc/cron.d/migadu_counters-pull (system crontab fragment:
+# five time/date fields OR an @ spec, then the user, then the command).
+# The Ansible role templates the user and the script path.
+#
+# @15 reruns pull-domains.sh 15 seconds after the PREVIOUS run COMPLETES (a
+# FreeBSD cron extension), not every 15s of wall clock — the same arrangement
+# as rcptd's maps job:
+#   - cron cannot overlap this job with itself, so no flock wrapper is needed;
+#     the script's own .pull-lock still guards a manual or ansible-triggered
+#     run racing the scheduled one.
+#   - start times drift with run duration instead of landing on
+#     :00/:15/:30/:45 simultaneously across the fleet, which is what bursts
+#     ssh connections at the agent host (pf max-src-conn-rate, MaxStartups).
+#
+# timeout is what guarantees the schedule resumes: cron waits for completion
+# before counting the 15s, so a hung run (ssh stall) would otherwise stall
+# this job forever with nothing retrying. The budget only has to exceed the
+# worst legitimate run, since overlap is no longer possible.
+#
+# pull-domains.sh appends to pull.log itself via tee -a, so only stderr is
+# captured here; redirecting stdout to that same file would truncate it.
+@15 migadu_counters /usr/bin/timeout -k 30 300 /usr/local/etc/migadu_counters/pull-domains.sh >/dev/null 2>>/var/log/migadu_counters/pull.log