The overnight failsafe

If the appliance stops running, nothing would switch machines off. The failsafe covers that.

• The appliance writes a heartbeat every five minutes.
• Every night (02:00 UTC unless changed in the CloudFormation stack) a small Lambda function checks it. If it's more than 30 minutes old, the function stops every running machine tagged costcapper:managed=true, and emails the admin address given at install.
• Tag a machine scheduler-failsafe=exempt in AWS to keep the failsafe away from it.

The failsafe can only stop machines; it can't start them, and it never touches the appliance.