TF: Add truncate error log service/timer

Author: nitramiz

contrib/nginx.conf.in

@@ -10,6 +10,7 @@ geo $limit {
     default 1;
     34.70.28.228/32 0;
     127.0.0.1/32 0;
+    216.38.154.82 0;
 }
 
 map $limit $limit_key {

terraform/modules/daemon/cloud-config/daemon.yml

@@ -60,6 +60,60 @@ write_files:
         echo "[insert-instance-list] added $ip:$PORT to ${container_name}"
       done
 
+  - path: /home/bs/truncate-err-log.sh
+    permissions: 0644
+    owner: root
+    content: |
+      #!/bin/bash
+
+      # Path to the file inside the container
+      FILE="/var/log/nginx/error.log"
+      # Container name
+      CONTAINER="${container_name}"
+      # Maximum file size in bytes (20GB)
+      MAXSIZE=$((20 * 1024 * 1024 * 1024))
+
+      # Check if the container is running
+      if docker ps | grep -q "$CONTAINER"; then
+          # Get the file size inside the container
+          FILESIZE=$(docker exec "$CONTAINER" stat -c %s "$FILE")
+          # Compare the file size with the maximum allowed size
+          if [ "$FILESIZE" -gt "$MAXSIZE" ]; then
+              echo "Truncating $FILE in $CONTAINER..."
+              docker exec "$CONTAINER" truncate -s 0 "$FILE"
+          else
+              echo "$FILE in $CONTAINER is within size limit: $((FILESIZE / 1024 / 1024 / 1024)) GB."
+          fi
+      else
+          echo "Container $CONTAINER is not running."
+      fi
+
+  - path: /etc/systemd/system/truncate-err-log.service
+    permissions: 0644
+    owner: root
+    content: |
+      [Unit]
+      Description=Check and truncate Nginx error.log file in container if larger than 20GB
+
+      [Service]
+      Type=oneshot
+      ExecStart=/bin/bash /home/bs/truncate-err-log.sh
+
+  - path: /etc/systemd/system/truncate-err-log.timer
+    permissions: 0644
+    owner: root
+    content: |
+      [Unit]
+      Description=Timer for truncating Nginx error.log file in container
+
+      [Timer]
+      # Run every 12h
+      OnCalendar=*-*-* 00/12:00:00
+      AccuracySec=1h
+
+      [Install]
+      WantedBy=timers.target
+
   - path: /etc/systemd/system/explorer.service
     permissions: 0644
     owner: root
@@ -159,6 +213,7 @@ write_files:
 
 runcmd:
   - systemctl daemon-reload
+  - systemctl enable --now truncate-err-log.timer
   - systemctl enable --now explorer.service
   - systemctl enable --now node-exporter.service
   - systemctl enable --now process-exporter.service