# ClamAV — nightly scan of every target the operator marked "nightly".
#
# ⚠️ nice + ionice: clamscan reads every file under the target and loads ~1.2 GB of
# signatures; without them it competes with php-fpm and MariaDB for disk and memory
# on a small VPS at 03:40 and the site gets slow for no visible reason.
#
# ⚠️ flock -n: a scan of a big docroot can outlast the next tick. Two concurrent
# full scans is the antivirus becoming the outage.
#
# Signatures are kept fresh by the clamav-freshclam service (hourly), not here.
# Infected files are REPORTED and raised in the bell — quarantining is a human.
40 3 * * * www-data /usr/bin/flock -n /run/lock/alpha-clamav.lock /usr/bin/nice -n 15 /usr/bin/ionice -c3 /usr/bin/php /var/www/alpha/bin/clamav-run.php >/dev/null 2>&1
