monitor: read the ACME cache where it actually is, and report the soonest expiry !146
1 file changed, +24 −6
Layout: unified · split
deploy/cloud-init.yaml +24 −6
| @@ -67,13 +67,28 @@ write_files: | ||
| 67 | 67 | set -eu |
| 68 | 68 | disk=$(df -P /var/lib/gitbay | awk 'NR==2{print $5}') |
| 69 | 69 | svc=$(systemctl is-active gitbayd || true) |
| 70 | # Days until the ACME cert expires, if autocert cached one. | |
| 71 | cert=/var/lib/gitbay/autocert | |
| 70 | # Soonest ACME cert expiry. Reporting whichever name sorted first said | |
| 71 | # nothing about the one actually about to lapse, and the cache is under | |
| 72 | # acme/, so this read autocert/ and reported n/a forever. | |
| 73 | cert=/var/lib/gitbay/acme | |
| 72 | 74 | exp="n/a" |
| 75 | days="" | |
| 73 | 76 | if [ -d "$cert" ]; then |
| 74 | f=$(ls -1 "$cert" 2>/dev/null | grep -v acme_account | head -1 || true) | |
| 75 | if [ -n "$f" ]; then | |
| 76 | exp=$(openssl x509 -enddate -noout -in "$cert/$f" 2>/dev/null | cut -d= -f2 || echo n/a) | |
| 77 | soonest="" | |
| 78 | for f in "$cert"/*; do | |
| 79 | [ -f "$f" ] || continue | |
| 80 | case "${f##*/}" in acme_account*) continue ;; esac | |
| 81 | end=$(openssl x509 -enddate -noout -in "$f" 2>/dev/null | cut -d= -f2 || true) | |
| 82 | [ -n "$end" ] || continue | |
| 83 | secs=$(date -u -d "$end" +%s 2>/dev/null || true) | |
| 84 | [ -n "$secs" ] || continue | |
| 85 | if [ -z "$soonest" ] || [ "$secs" -lt "$soonest" ]; then | |
| 86 | soonest="$secs" | |
| 87 | exp="$end" | |
| 88 | fi | |
| 89 | done | |
| 90 | if [ -n "$soonest" ]; then | |
| 91 | days=$(( (soonest - $(date -u +%s)) / 86400 )) | |
| 77 | 92 | fi |
| 78 | 93 | fi |
| 79 | 94 | alert="" |
| @@ -84,9 +99,12 @@ write_files: | ||
| 84 | 99 | if [ "$pct" -ge 85 ]; then |
| 85 | 100 | alert="${alert}disk ${disk}; " |
| 86 | 101 | fi |
| 102 | if [ -n "$days" ] && [ "$days" -lt 21 ]; then | |
| 103 | alert="${alert}cert expires in ${days}d; " | |
| 104 | fi | |
| 87 | 105 | # journald always gets the reading, so an unset webhook cannot make a |
| 88 | 106 | # sick host look like a quiet one. |
| 89 | echo "disk=$disk service=$svc cert_expires=$exp" | |
| 107 | echo "disk=$disk service=$svc cert_expires=$exp${days:+ cert_days=$days}" | |
| 90 | 108 | url_file=/etc/gitbay/monitor.url |
| 91 | 109 | if [ -f "$url_file" ]; then |
| 92 | 110 | body=$(printf '{"disk":"%s","service":"%s","cert_expires":"%s","alert":"%s"}' "$disk" "$svc" "$exp" "$alert") |