# logrotate fragment for pda-lore audit JSONL trail (PDAT/pda-lore#67).
#
# Decision: Option B — delegate rotation to systemd + logrotate. The Go
# binary carries NO runtime rotation code beyond a SIGUSR1 reopen
# handler. logrotate renames the live audit.jsonl, then the postrotate
# script signals every running instance to reopen its log so new records
# land in a fresh file at the original path.
#
# Path matches deploy/pda-lore@.service:
#   Environment=LORE_AUDIT_LOG=/var/log/pda-lore/%i/audit.jsonl
# The single-instance unit (deploy/pda-lore.service) writes directly to
# /var/log/pda-lore/audit.jsonl when LORE_AUDIT_LOG is set there; the
# glob below covers only the per-instance subdirectories, so the
# top-level file is also matched by the second pattern.
#
# Installed to /etc/logrotate.d/pda-lore by deploy/postinstall.sh.

/var/log/pda-lore/*/audit.jsonl /var/log/pda-lore/audit.jsonl {
    daily
    rotate 90
    compress
    delaycompress
    missingok
    notifempty
    create 0600 pda-lore pda-lore
    sharedscripts
    postrotate
        # Reopen contract (#67, ref #48): SIGUSR1 makes each pda-lore
        # process open a fresh *os.File at LORE_AUDIT_LOG and swap it in
        # (AuditSink.Reopen), then close the renamed old file. Without
        # this the process keeps writing to the rotated (renamed) inode.
        # `systemctl kill` targets running units only; the || true keeps
        # rotation from failing when no instance is up.
        systemctl kill --signal=SIGUSR1 'pda-lore@*.service' 2>/dev/null || true
        systemctl kill --signal=SIGUSR1 'pda-lore.service' 2>/dev/null || true
    endscript
}
