AkurAI-Mail / scripts/ops/cert-age-alert.sh

Latest change e0753e49bfea7ef672aabf8df9a3a27b8bdd9dc7 - Recover EC2-only ops scripts, checks and live divergent copies by Ólafur Búi Ólafsson

#!/usr/bin/env bash
# scripts/ops/cert-age-alert.sh — TLS cert expiry alert for mail.olibuijr.com.
# Run by cert-age-alert.timer (systemd), independent of certbot's own renewal
# schedule, so a stuck/broken renewal is caught even if certbot never fires.
set -euo pipefail

: "${CERT_NAME:=mail.olibuijr.com}"
: "${CERT_ALERT_TO:=postmaster@olibuijr.com}"
: "${CERT_ALERT_STATE:=/var/lib/akurai-mail-ops/cert-age-alert.state}"
CERT="/etc/letsencrypt/live/${CERT_NAME}/cert.pem"
THRESHOLDS=(21 14 7)

mkdir -p "$(dirname "$CERT_ALERT_STATE")"
exp_epoch=$(openssl x509 -enddate -noout -in "$CERT" | cut -d= -f2 | xargs -I{} date -d {} +%s)
now_epoch=$(date +%s)
days_left=$(( (exp_epoch - now_epoch) / 86400 ))
today=$(date +%F)
last=""
[ -f "$CERT_ALERT_STATE" ] && last=$(cat "$CERT_ALERT_STATE")

for t in "${THRESHOLDS[@]}"; do
    if [ "$days_left" -le "$t" ]; then
        key="${today}:${t}"
        if [ "$last" != "$key" ]; then
            {
                echo "Subject: [mail VM] TLS cert for ${CERT_NAME} expires in ${days_left}d (<= ${t}d threshold)"
                echo "To: ${CERT_ALERT_TO}"
                echo
                echo "certificate: ${CERT}"
                echo "days remaining: ${days_left}"
                openssl x509 -enddate -noout -in "$CERT"
                echo
                systemctl is-enabled certbot.timer && systemctl is-active certbot.timer || true
            } | /usr/sbin/sendmail -t
            echo "$key" > "$CERT_ALERT_STATE"
        fi
        exit 0
    fi
done