For reading and verification only. You may not copy, use, modify or redistribute this code. Full notice on the main page.
tunnel/deploy/all-tunnel-cert-check
| 1 | #!/bin/sh |
| 2 | # Runs after every `certbot renew` of the node's own certificate (ExecStartPost of all-tunnel-certbot.service) and fails when the certificate is not |
| 3 | # healthy. certbot exits 0 when nothing was due, and also when a renewal "worked" but nothing downstream took it, so a green renewal proves nothing: this |
| 4 | # looks at what the node is actually serving. |
| 5 | # - the certificate file must have more than ALL_TUNNEL_CERT_MIN_DAYS left (the first of policy.monitoring.node_cert_alert_days: 14); |
| 6 | # - when /metrics can be read, the certificate IN SERVICE must too (a renewed file that was never reloaded is the other silent failure). |
| 7 | # Success clears the failure marker all-tunnel-certbot-failed.service writes. |
| 8 | set -eu |
| 9 | here=$(dirname "$0") |
| 10 | . "${ALL_TUNNEL_LIB:-$here/all-tunnel-cert-lib.sh}" |
| 11 | |
| 12 | min_days="${ALL_TUNNEL_CERT_MIN_DAYS:-}" |
| 13 | [ -n "$min_days" ] || die "ALL_TUNNEL_CERT_MIN_DAYS is not set" |
| 14 | cert=$(env_value TUNNEL_CERT_FILE) |
| 15 | [ -n "$cert" ] || die "$ALL_TUNNEL_ENV does not say TUNNEL_CERT_FILE" |
| 16 | [ -r "$cert" ] || die "the node certificate $cert cannot be read" |
| 17 | |
| 18 | openssl x509 -in "$cert" -noout -checkend $((min_days * 86400)) >/dev/null || |
| 19 | die "the node certificate has less than $min_days days left: the renewal is not happening (journalctl -u all-tunnel-certbot)" |
| 20 | |
| 21 | left=$(metric all_tunnel_node_cert_seconds_left) |
| 22 | if [ -n "$left" ] && [ "$left" -lt $((min_days * 86400)) ]; then |
| 23 | die "the node serves a certificate with less than $min_days days left although the file on disk is newer: reload the node (systemctl reload all-tunnel)" |
| 24 | fi |
| 25 | |
| 26 | rm -f "${ALL_TUNNEL_STATE_DIR:-/var/lib/all-tunnel}/certbot.failed" |
| 27 | say info "node certificate has more than $min_days days left" |