Weekly Maintenance

Scheduled housekeeping for each vinhedo host, plus a status channel that stays independent of Projects Monitor. See ADR-0002 for why this exists alongside Projects Monitor rather than being folded into it.

Files

File	Runs on	Purpose
deploy-weekly-maintenance.sh	laptop (Git Bash)	Installs the scripts and wires up the systemd timer/services on each host
weekly-maintenance	remote host, via systemd timer	Runs apt/log/cert housekeeping and reports to healthchecks.io
hostevent-ping	remote host, via systemd service	Pings healthchecks.io on boot (up) and shutdown (down)

Deploying

./deploy-weekly-maintenance.sh              # all four vinhedo hosts
./deploy-weekly-maintenance.sh vinhedo3     # a single host
TEST_RUN=1 ./deploy-weekly-maintenance.sh   # fire the maintenance job once immediately after install

For each host, the deploy script looks up a per-host healthchecks.io check UUID and a staggered run time (20 minutes apart per host, so the fleet doesn’t all hit apt at once), confirms SSH reachability, copies both scripts, then remotely:

• Installs weekly-maintenance and hostevent-ping to /usr/local/bin/
• Writes /etc/weekly-maintenance/config with the host’s HC_URL
• Installs and enables weekly-maintenance.service (oneshot) + weekly-maintenance.timer (OnCalendar=<staggered time>, RandomizedDelaySec=15m, Persistent=true so a missed run catches up after downtime)
• Installs weekly-maintenance-hostevent.service, wired to run hostevent-ping up on start and hostevent-ping down on stop, ordered around shutdown.target

What weekly-maintenance does

Pings the host’s healthchecks.io /start endpoint, then:

• apt-get update, autoremove --purge, autoclean
• Vacuums journald logs older than 14 days
• Reloads fail2ban if active
• Checks: upgradable package count, reboot-required flag + pending packages, failed systemd units, root disk usage (flags failure at ≥85%), and — if certbot is present — any certificate expiring within 20 days

Sends the final status to healthchecks.io: the plain URL if healthy, the /fail suffix if any check failed. Failures accumulate rather than stopping the script early — it’s best-effort, report everything.

What hostevent-ping does

On up, pings the plain healthchecks.io URL (“host online”). On down, inspects systemctl list-jobs to distinguish a reboot from a poweroff/halt/generic stop, and pings the /fail endpoint with a descriptive message — so an unexpected or in-progress shutdown shows red on the healthchecks.io dashboard until the host comes back up and the timer’s next run succeeds.