# File integrity scan — nightly full re-hash of every baselined watch.
#
# ⚠️ nice + ionice: this reads and SHA-256s tens of thousands of files. Without
# them a scan of /etc plus the panel tree competes with php-fpm for disk on a
# small VPS and the site gets slow at 04:17 every morning for no visible reason.
#
# ⚠️ flock -n: a full-tree hash can outlast the next tick after the box has been
# suspended. Two concurrent scans is the monitoring becoming the outage.
#
# It only ever CHECKS — re-baselining is always a human pressing Accept.
17 4 * * * www-data /usr/bin/flock -n /run/lock/alpha-integrity.lock /usr/bin/nice -n 15 /usr/bin/ionice -c3 /usr/bin/php /var/www/alpha/bin/integrity-run.php >/dev/null 2>&1
