#!/usr/bin/env bash
set -euo pipefail
# install-cpanel-importer-quarantine-sweep.sh
# Runs once per release as part of update.sh.
#
# Wires a daily cron entry for whp-cpanel-importer-quarantine-sweep.sh.
# The sweeper script itself is a top-level /scripts/* file and gets
# rsynced into /root/whp/scripts/ as part of the normal release sync,
# so this installer only handles cron + host paths.

DEST=/root/whp/scripts/whp-cpanel-importer-quarantine-sweep.sh

mkdir -p /var/lib/whp/cpanel-importer-quarantine
chmod 0750 /var/lib/whp/cpanel-importer-quarantine
mkdir -p /var/log/whp

# 23:17 daily spreads load away from the credentials sweep (17:04).
# Timeout 600 = 10 min upper bound, generous for the size of even a
# heavily-used quarantine root. Per project convention, wrap in flock
# + timeout (feedback_cron_watchdog).
CRON_LINE="17 23 * * * /usr/bin/flock -n /run/whp-cpanel-importer-quarantine-sweep.lock /usr/bin/timeout 600 $DEST >> /var/log/whp/cpanel-importer-quarantine-sweep.log 2>&1"
CRONTAB="$(crontab -l 2>/dev/null || true)"
if echo "$CRONTAB" | grep -qF "$DEST"; then
    echo "[install-quarantine-sweep] cron already installed"
else
    (echo "$CRONTAB"; echo "$CRON_LINE") | crontab -
    echo "[install-quarantine-sweep] cron installed: $CRON_LINE"
fi
