Recommended cron tasks for Olympus

0 3 * * * pg_dump olympus | gzip | aws s3 cp - s3://backups/olympus-$(date +%Y%m%d).sql.gz

30 3 * * * podman exec ciam-kratos kratos janitor --keep-last 168h

0 4 * * * podman exec ciam-hydra hydra janitor --tokens postgres://...

0 5 * * * /usr/local/bin/anonymize-audit.sh

0 5 * * * podman exec ciam-postgres vacuumdb -d olympus --analyze

0 6 * * 0 /usr/local/bin/test-restore-backup.sh

0 7 * * 0 curl https://raw.githubusercontent.com/disposable/.../domains.txt > /etc/olympus/disposable.txt && podman restart ciam-kratos

0 8 * * 0 psql -c "DELETE FROM invitations WHERE expires_at < NOW() - INTERVAL '30 days'"

0 9 * * 0 psql -c "DELETE FROM app_sessions WHERE last_activity < NOW() - INTERVAL '30 days'"

0 0 1 * * /usr/local/bin/notify-inactive-users.sh

0 1 1 * * /usr/local/bin/rotate-kratos-cookie.sh

0 2 1 * * /usr/local/bin/rotate-hydra-secret.sh

0 0 1 */3 * /usr/local/bin/check-cert-expiry.sh

0 1 1 */3 * /usr/local/bin/run-security-scans.sh

0 0 1 1 * psql -c "DELETE FROM security_audit WHERE created_at < NOW() - INTERVAL '2 years' AND event_type NOT IN ('admin_action_critical')"

# Document, don't automate

# Every minute
* * * * * curl -fsS https://ciam.your-domain.com/health/ready || alert "Olympus health failed"

# Every 5 min
*/5 * * * * /usr/local/bin/smoke-test-login.sh || alert "Login smoke test failed"

# After successful cron
curl https://uptime-kuma.your-domain.com/api/push/kratos-janitor

30 3 * * * podman exec ciam-kratos kratos janitor --keep-last 168h && curl -fsS https://hc-ping.com/UUID

30 3 * * * /usr/local/bin/cron-task.sh >> /var/log/olympus/cron.log 2>&1

# Off-peak: 03:00-05:00 UTC (most regions sleep)
0 3 * * * backup
30 3 * * * janitor
0 4 * * * vacuum

# Safe, only deletes already-expired
DELETE FROM table WHERE expires_at < NOW();

# Unsafe, counts wrong if run twice
UPDATE counter SET value = value + 1;