Robert Helewka
0a053c1cd6
- Updated HAProxy configuration template to reflect changes for the Taurus Production Environment, including SSL settings and rate limiting for specific endpoints. - Introduced new playbooks for certificate distribution and validation with OCI Vault, ensuring certificates are correctly managed and renewed. - Added hooks for uploading renewed certificates to OCI Vault and validating their integrity. - Enhanced the HAProxy configuration playbook to ensure proper service management and verification of the HAProxy service. - Updated inventory variables for certificate management and ensured compatibility with the new structure.
72 lines
3.1 KiB
Django/Jinja
72 lines
3.1 KiB
Django/Jinja
#!/bin/bash
|
|
# Certificate metrics for Prometheus node_exporter textfile collector
|
|
# Managed by Ansible - DO NOT EDIT MANUALLY
|
|
#
|
|
# Writes metrics to: {{ prometheus_node_exporter_text_directory }}/ssl_cert.prom
|
|
# Metrics:
|
|
# ssl_certificate_expiry_timestamp - Unix timestamp when cert expires
|
|
# ssl_certificate_expiry_seconds - Seconds until expiry
|
|
# ssl_certificate_valid - 1 if valid, 0 if expired or missing
|
|
|
|
set -euo pipefail
|
|
|
|
METRICS_DIR="{{ prometheus_node_exporter_text_directory }}"
|
|
METRICS_FILE="${METRICS_DIR}/ssl_cert.prom"
|
|
CERT_FILE="{{ haproxy_cert_path }}"
|
|
DOMAIN="{{ haproxy_domain }}"
|
|
|
|
# Create temp file for atomic write
|
|
TEMP_FILE=$(mktemp "${METRICS_DIR}/.ssl_cert.prom.XXXXXX")
|
|
|
|
# Write metric headers
|
|
cat > "${TEMP_FILE}" << 'EOF'
|
|
# HELP ssl_certificate_expiry_timestamp Unix timestamp when the SSL certificate expires
|
|
# TYPE ssl_certificate_expiry_timestamp gauge
|
|
# HELP ssl_certificate_expiry_seconds Seconds until the SSL certificate expires
|
|
# TYPE ssl_certificate_expiry_seconds gauge
|
|
# HELP ssl_certificate_valid Whether the SSL certificate is valid (1) or expired/missing (0)
|
|
# TYPE ssl_certificate_valid gauge
|
|
EOF
|
|
|
|
if [[ -f "${CERT_FILE}" ]]; then
|
|
# Extract expiry date from certificate
|
|
EXPIRY_DATE=$(openssl x509 -enddate -noout -in "${CERT_FILE}" 2>/dev/null | cut -d= -f2)
|
|
|
|
if [[ -n "${EXPIRY_DATE}" ]]; then
|
|
# Convert to Unix timestamp
|
|
EXPIRY_TIMESTAMP=$(date -d "${EXPIRY_DATE}" +%s 2>/dev/null || echo "0")
|
|
CURRENT_TIMESTAMP=$(date +%s)
|
|
EXPIRY_SECONDS=$((EXPIRY_TIMESTAMP - CURRENT_TIMESTAMP))
|
|
|
|
# Check if certificate is valid (not expired)
|
|
if [[ ${EXPIRY_SECONDS} -gt 0 ]]; then
|
|
VALID=1
|
|
else
|
|
VALID=0
|
|
fi
|
|
|
|
# Extract issuer for label
|
|
ISSUER=$(openssl x509 -issuer -noout -in "${CERT_FILE}" 2>/dev/null | sed 's/.*O = \([^,]*\).*/\1/' | tr -d '"' || echo "unknown")
|
|
|
|
# Write metrics
|
|
echo "ssl_certificate_expiry_timestamp{domain=\"${DOMAIN}\",issuer=\"${ISSUER}\"} ${EXPIRY_TIMESTAMP}" >> "${TEMP_FILE}"
|
|
echo "ssl_certificate_expiry_seconds{domain=\"${DOMAIN}\",issuer=\"${ISSUER}\"} ${EXPIRY_SECONDS}" >> "${TEMP_FILE}"
|
|
echo "ssl_certificate_valid{domain=\"${DOMAIN}\",issuer=\"${ISSUER}\"} ${VALID}" >> "${TEMP_FILE}"
|
|
else
|
|
# Could not parse certificate
|
|
echo "ssl_certificate_expiry_timestamp{domain=\"${DOMAIN}\",issuer=\"unknown\"} 0" >> "${TEMP_FILE}"
|
|
echo "ssl_certificate_expiry_seconds{domain=\"${DOMAIN}\",issuer=\"unknown\"} 0" >> "${TEMP_FILE}"
|
|
echo "ssl_certificate_valid{domain=\"${DOMAIN}\",issuer=\"unknown\"} 0" >> "${TEMP_FILE}"
|
|
fi
|
|
else
|
|
# Certificate file does not exist
|
|
echo "ssl_certificate_expiry_timestamp{domain=\"${DOMAIN}\",issuer=\"none\"} 0" >> "${TEMP_FILE}"
|
|
echo "ssl_certificate_expiry_seconds{domain=\"${DOMAIN}\",issuer=\"none\"} 0" >> "${TEMP_FILE}"
|
|
echo "ssl_certificate_valid{domain=\"${DOMAIN}\",issuer=\"none\"} 0" >> "${TEMP_FILE}"
|
|
fi
|
|
|
|
# Set permissions and atomic move
|
|
chmod 644 "${TEMP_FILE}"
|
|
chown prometheus:prometheus "${TEMP_FILE}" 2>/dev/null || true
|
|
mv "${TEMP_FILE}" "${METRICS_FILE}"
|