#!/bin/bash
# Install the one-package ca-certificates refresh timer on the Makenotwork
# production host. Idempotent: safe to re-run.
#
# Why this exists at all: prod's Unattended-Upgrade::Allowed-Origins covers
# noble, noble-security and the two ESM security pockets, and deliberately
# leaves noble-updates out. ca-certificates is published to noble-updates and
# has reached noble-security too, but by Ubuntu's publishing habit rather than
# by any rule. This timer closes that one gap on a mechanism instead of a
# habit, and its blast radius is exactly ca-certificates plus openssl.
#
# What was ruled out, so it is not re-derived: Unattended-Upgrade::Package-
# Whitelist filters *within* the allowed origins and never adds one, confirmed
# by dry-run on this host. Strict mode is worse -- it pins every allowed origin
# to -1 and lifts only whitelisted names, silently ending security patching for
# everything else.
#
# Full policy, including what would have to be true to revisit it: wiki note
# `prod-patching-policy`.

set -euo pipefail

if [ "$(id -u)" -ne 0 ]; then
    echo "run as root on the production host" >&2
    exit 1
fi

cd "$(dirname "$0")"
install -m 0644 ca-certificates-refresh.service /etc/systemd/system/
install -m 0644 ca-certificates-refresh.timer /etc/systemd/system/
systemctl daemon-reload
systemctl enable --now ca-certificates-refresh.timer
systemctl list-timers ca-certificates-refresh.timer --no-pager