logs: standardise log filenames to xamxam-{service}-{date}.log

deploy/xamxam-backup.cron

@@ -2,7 +2,7 @@
 # Installed to /etc/cron.d/xamxam-backup (system cron format: minute hour dom month dow user command)
 #
 # Hourly snapshot — kept 30 days
-0  *  *  *  *  www-data  /usr/local/bin/backup-sqlite.sh >> /var/log/sqlite-backup.log 2>&1
+0  *  *  *  *  www-data  /usr/local/bin/backup-sqlite.sh >> /var/log/xamxam-backup-$(date +\%Y-\%m-\%d).log 2>&1
 
 # Daily snapshot at 2am — kept 90 days
-0  2  *  *  *  www-data  RETENTION_DAYS=90 /usr/local/bin/backup-sqlite.sh >> /var/log/sqlite-backup.log 2>&1
+0  2  *  *  *  www-data  RETENTION_DAYS=90 /usr/local/bin/backup-sqlite.sh >> /var/log/xamxam-backup-$(date +\%Y-\%m-\%d).log 2>&1

deploy/xamxam-cleanup.cron

@@ -1,7 +1,8 @@
 # XAMXAM — orphaned draft cleanup cron job
 # Installed to /etc/cron.d/xamxam-cleanup (system cron format: minute hour dom month dow user command)
 #
-# Deletes draft theses older than 24h that have no attached files.
-# Runs every 4 hours — drafts only become eligible after 24h, so this is ample.
+# Deletes draft theses older than 7 days (168h) that have no attached files.
+# Runs every 2 days — drafts only become eligible after 7 days, so this is ample.
 # The script is a dry-run unless --no-dry-run is passed.
-0  */4  *  *  *  www-data  php /var/www/xamxam/scripts/cleanup-drafts.php --no-dry-run >> /var/log/xamxam-cleanup.log 2>&1
+# Eligibility age is configurable via OLDER_THAN_HOURS (default 168).
+0  0  */2  *  *  www-data  php /tmp/cleanup-drafts.php --no-dry-run >> /var/log/xamxam-cleanup-$(date +\%Y-\%m-\%d).log 2>&1

deploy/xamxam-logrotate

@@ -0,0 +1,53 @@
+# XAMXAM — log rotation for application, nginx, and cron logs.
+# Installed to /etc/logrotate.d/xamxam (run via `just deploy-logrotate`).
+#
+# Covers three roots:
+#   /var/log/xamxam/              app channels (xamxam-app/admin/error/audit-*.log)
+#   /var/log/nginx/xamxam-nginx-* nginx access + error logs
+#   /var/log/xamxam-backup-*.log  SQLite backup cron
+#   /var/log/xamxam-cleanup-*.log draft cleanup cron
+#
+# The app channels additionally self-rotate via Monolog (RotatingFileHandler,
+# 30 days) — logrotate here mainly compresses/prunes the nginx and cron files
+# and any stragglers. Retention is aligned with the app's 30-day default.
+
+/var/log/xamxam/*.log {
+    daily
+    rotate 30
+    compress
+    delaycompress
+    missingok
+    notifempty
+    create 664 www-data xamxam
+    su www-data xamxam
+}
+
+/var/log/nginx/xamxam-nginx-access.log /var/log/nginx/xamxam-nginx-error.log {
+    daily
+    rotate 52
+    compress
+    delaycompress
+    missingok
+    notifempty
+    create 640 root adm
+    su root adm
+    sharedscripts
+    postrotate
+        if command -v systemctl >/dev/null 2>&1 && systemctl is-active nginx >/dev/null 2>&1; then
+            systemctl reload nginx >/dev/null 2>&1 || true
+        elif [ -x /usr/sbin/nginx ]; then
+            /usr/sbin/nginx -s reopen 2>/dev/null || true
+        fi
+    endscript
+}
+
+/var/log/xamxam-backup-*.log /var/log/xamxam-cleanup-*.log {
+    daily
+    rotate 30
+    compress
+    delaycompress
+    missingok
+    notifempty
+    create 644 www-data www-data
+    su www-data www-data
+}