#!/usr/bin/env bash
#
# 检查证书剩余有效期，低于阈值时以非 0 退出，便于接入告警。
# 自动续签有可能静默失败，必须有一个独立的检查点。
#
set -euo pipefail

CERT_NAME="${CERT_NAME:-stonelan.cn}"
CERT="${CERT:-/etc/letsencrypt/live/$CERT_NAME/cert.pem}"
WARN_DAYS="${WARN_DAYS:-20}"

if [ ! -f "$CERT" ]; then
    echo "证书不存在：$CERT" >&2
    exit 1
fi

end="$(openssl x509 -enddate -noout -in "$CERT" | cut -d= -f2)"
end_ts="$(date -d "$end" +%s)"
days=$(( (end_ts - $(date +%s)) / 86400 ))

echo "证书文件：$CERT"
echo "到期时间：$end（剩余 $days 天）"
openssl x509 -subject -issuer -noout -in "$CERT" | sed 's/^/  /'
openssl x509 -text -noout -in "$CERT" \
    | grep -A1 "Subject Alternative Name" | sed 's/^/  /'

if [ "$days" -lt "$WARN_DAYS" ]; then
    echo "警告：剩余 $days 天，低于阈值 $WARN_DAYS 天" >&2
    exit 1
fi

echo "证书状态正常"