# migadu_counters: pull the rspamd domains CDB from the agent host.
# Install as /etc/cron.d/migadu_counters-pull (system crontab fragment:
# five time/date fields OR an @ spec, then the user, then the command).
# The Ansible role templates the user and the script path.
#
# @15 reruns pull-domains.sh 15 seconds after the PREVIOUS run COMPLETES (a
# FreeBSD cron extension), not every 15s of wall clock — the same arrangement
# as rcptd's maps job:
#   - cron cannot overlap this job with itself, so no flock wrapper is needed;
#     the script's own .pull-lock still guards a manual or ansible-triggered
#     run racing the scheduled one.
#   - start times drift with run duration instead of landing on
#     :00/:15/:30/:45 simultaneously across the fleet, which is what bursts
#     ssh connections at the agent host (pf max-src-conn-rate, MaxStartups).
#
# timeout is what guarantees the schedule resumes: cron waits for completion
# before counting the 15s, so a hung run (ssh stall) would otherwise stall
# this job forever with nothing retrying. The budget only has to exceed the
# worst legitimate run, since overlap is no longer possible.
#
# pull-domains.sh appends to pull.log itself via tee -a, so only stderr is
# captured here; redirecting stdout to that same file would truncate it.
@15 migadu_counters /usr/bin/timeout -k 30 300 /usr/local/etc/migadu_counters/pull-domains.sh >/dev/null 2>>/var/log/migadu_counters/pull.log