monitoring: add WireGuard key expiry reminders for voidstash GL.iNet
Posts to #infrastructure-alerts via Slack bot on escalating schedule: - 2027-03-11: 1 month out - 2027-03-25, 04-01, 04-04: weekly - 2027-04-05 through 04-10: daily Key: neural_net-US-IL-267, expires 2027-04-11
This commit is contained in:
Will Anderson
@@ -0,0 +1,273 @@
|
||||
# WireGuard key expiry reminders — voidstash GL.iNet router key expires 2027-04-11
|
||||
# Schedule: 1 month out, then weekly, then daily in the last week
|
||||
# Posts to #infrastructure-alerts via Slack bot token from Vault
|
||||
#
|
||||
# To renew: ProtonVPN dashboard → WireGuard → neural_net-US-IL-267 → delete & regenerate
|
||||
# Then re-add to GL.iNet router WireGuard Client page
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: wireguard-reminder
|
||||
namespace: monitoring
|
||||
---
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: wireguard-reminder-slack
|
||||
namespace: monitoring
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: wireguard-reminder-slack
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: bot_token
|
||||
remoteRef:
|
||||
key: secret/data/slack
|
||||
property: bot_token
|
||||
---
|
||||
# Template for all reminder jobs — actual CronJobs below reference this pattern
|
||||
# Reminder script: posts to Slack with urgency based on days remaining
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: wireguard-reminder-script
|
||||
namespace: monitoring
|
||||
data:
|
||||
notify.sh: |
|
||||
#!/bin/sh
|
||||
CHANNEL="C0AND3S44CE"
|
||||
EXPIRY="2027-04-11"
|
||||
TODAY=$(date +%Y-%m-%d)
|
||||
DAYS=$(( ($(date -d "$EXPIRY" +%s 2>/dev/null || date -j -f "%Y-%m-%d" "$EXPIRY" +%s) - $(date +%s)) / 86400 ))
|
||||
|
||||
if [ "$DAYS" -le 7 ]; then
|
||||
EMOJI=":rotating_light:"
|
||||
URGENCY="*URGENT — $DAYS days left*"
|
||||
elif [ "$DAYS" -le 14 ]; then
|
||||
EMOJI=":warning:"
|
||||
URGENCY="*$DAYS days left*"
|
||||
else
|
||||
EMOJI=":bell:"
|
||||
URGENCY="$DAYS days left"
|
||||
fi
|
||||
|
||||
curl -s -X POST "https://slack.com/api/chat.postMessage" \
|
||||
-H "Authorization: Bearer $(cat /etc/slack/bot_token)" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{
|
||||
\"channel\": \"$CHANNEL\",
|
||||
\"text\": \"$EMOJI *WireGuard key expiry reminder* — $URGENCY\",
|
||||
\"blocks\": [{
|
||||
\"type\": \"section\",
|
||||
\"text\": {
|
||||
\"type\": \"mrkdwn\",
|
||||
\"text\": \"$EMOJI *ProtonVPN WireGuard key expiring soon*\n$URGENCY · expires $EXPIRY\n\n*Key:* \`neural_net-US-IL-267\` on GL.iNet home router\n\n*To renew:* ProtonVPN dashboard → WireGuard → delete \`neural_net-US-IL-267\` → generate new config → re-add to GL.iNet\"
|
||||
}
|
||||
}]
|
||||
}"
|
||||
echo "Notified Slack — $DAYS days until expiry"
|
||||
---
|
||||
# 1 month out: March 11, 2027
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: wireguard-reminder-1month
|
||||
namespace: monitoring
|
||||
spec:
|
||||
schedule: "0 9 11 3 *"
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: wireguard-reminder
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: notify
|
||||
image: alpine:latest
|
||||
command: ["sh", "/scripts/notify.sh"]
|
||||
volumeMounts:
|
||||
- name: script
|
||||
mountPath: /scripts
|
||||
- name: slack-token
|
||||
mountPath: /etc/slack
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
memory: 16Mi
|
||||
cpu: 10m
|
||||
limits:
|
||||
memory: 64Mi
|
||||
cpu: 50m
|
||||
volumes:
|
||||
- name: script
|
||||
configMap:
|
||||
name: wireguard-reminder-script
|
||||
defaultMode: 0755
|
||||
- name: slack-token
|
||||
secret:
|
||||
secretName: wireguard-reminder-slack
|
||||
---
|
||||
# Weekly: March 25, 2027
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: wireguard-reminder-week3
|
||||
namespace: monitoring
|
||||
spec:
|
||||
schedule: "0 9 25 3 *"
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: wireguard-reminder
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: notify
|
||||
image: alpine:latest
|
||||
command: ["sh", "/scripts/notify.sh"]
|
||||
volumeMounts:
|
||||
- name: script
|
||||
mountPath: /scripts
|
||||
- name: slack-token
|
||||
mountPath: /etc/slack
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
memory: 16Mi
|
||||
cpu: 10m
|
||||
limits:
|
||||
memory: 64Mi
|
||||
cpu: 50m
|
||||
volumes:
|
||||
- name: script
|
||||
configMap:
|
||||
name: wireguard-reminder-script
|
||||
defaultMode: 0755
|
||||
- name: slack-token
|
||||
secret:
|
||||
secretName: wireguard-reminder-slack
|
||||
---
|
||||
# Weekly: April 1, 2027
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: wireguard-reminder-week2
|
||||
namespace: monitoring
|
||||
spec:
|
||||
schedule: "0 9 1 4 *"
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: wireguard-reminder
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: notify
|
||||
image: alpine:latest
|
||||
command: ["sh", "/scripts/notify.sh"]
|
||||
volumeMounts:
|
||||
- name: script
|
||||
mountPath: /scripts
|
||||
- name: slack-token
|
||||
mountPath: /etc/slack
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
memory: 16Mi
|
||||
cpu: 10m
|
||||
limits:
|
||||
memory: 64Mi
|
||||
cpu: 50m
|
||||
volumes:
|
||||
- name: script
|
||||
configMap:
|
||||
name: wireguard-reminder-script
|
||||
defaultMode: 0755
|
||||
- name: slack-token
|
||||
secret:
|
||||
secretName: wireguard-reminder-slack
|
||||
---
|
||||
# Weekly: April 4, 2027
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: wireguard-reminder-week1
|
||||
namespace: monitoring
|
||||
spec:
|
||||
schedule: "0 9 4 4 *"
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: wireguard-reminder
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: notify
|
||||
image: alpine:latest
|
||||
command: ["sh", "/scripts/notify.sh"]
|
||||
volumeMounts:
|
||||
- name: script
|
||||
mountPath: /scripts
|
||||
- name: slack-token
|
||||
mountPath: /etc/slack
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
memory: 16Mi
|
||||
cpu: 10m
|
||||
limits:
|
||||
memory: 64Mi
|
||||
cpu: 50m
|
||||
volumes:
|
||||
- name: script
|
||||
configMap:
|
||||
name: wireguard-reminder-script
|
||||
defaultMode: 0755
|
||||
- name: slack-token
|
||||
secret:
|
||||
secretName: wireguard-reminder-slack
|
||||
---
|
||||
# Daily April 5-10: run every day in April, script computes days remaining
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: wireguard-reminder-daily
|
||||
namespace: monitoring
|
||||
spec:
|
||||
schedule: "0 9 5-10 4 *"
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: wireguard-reminder
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: notify
|
||||
image: alpine:latest
|
||||
command: ["sh", "/scripts/notify.sh"]
|
||||
volumeMounts:
|
||||
- name: script
|
||||
mountPath: /scripts
|
||||
- name: slack-token
|
||||
mountPath: /etc/slack
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
memory: 16Mi
|
||||
cpu: 10m
|
||||
limits:
|
||||
memory: 64Mi
|
||||
cpu: 50m
|
||||
volumes:
|
||||
- name: script
|
||||
configMap:
|
||||
name: wireguard-reminder-script
|
||||
defaultMode: 0755
|
||||
- name: slack-token
|
||||
secret:
|
||||
secretName: wireguard-reminder-slack
|
||||
Reference in New Issue
Block a user