monitoring: add WireGuard key expiry reminders for voidstash GL.iNet
Posts to #infrastructure-alerts via Slack bot on escalating schedule: - 2027-03-11: 1 month out - 2027-03-25, 04-01, 04-04: weekly - 2027-04-05 through 04-10: daily Key: neural_net-US-IL-267, expires 2027-04-11
This commit is contained in:
Will Anderson
@@ -0,0 +1,273 @@
|
|||||||
|
# WireGuard key expiry reminders — voidstash GL.iNet router key expires 2027-04-11
|
||||||
|
# Schedule: 1 month out, then weekly, then daily in the last week
|
||||||
|
# Posts to #infrastructure-alerts via Slack bot token from Vault
|
||||||
|
#
|
||||||
|
# To renew: ProtonVPN dashboard → WireGuard → neural_net-US-IL-267 → delete & regenerate
|
||||||
|
# Then re-add to GL.iNet router WireGuard Client page
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: wireguard-reminder
|
||||||
|
namespace: monitoring
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: wireguard-reminder-slack
|
||||||
|
namespace: monitoring
|
||||||
|
spec:
|
||||||
|
refreshInterval: 1h
|
||||||
|
secretStoreRef:
|
||||||
|
name: vault
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
target:
|
||||||
|
name: wireguard-reminder-slack
|
||||||
|
creationPolicy: Owner
|
||||||
|
data:
|
||||||
|
- secretKey: bot_token
|
||||||
|
remoteRef:
|
||||||
|
key: secret/data/slack
|
||||||
|
property: bot_token
|
||||||
|
---
|
||||||
|
# Template for all reminder jobs — actual CronJobs below reference this pattern
|
||||||
|
# Reminder script: posts to Slack with urgency based on days remaining
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: wireguard-reminder-script
|
||||||
|
namespace: monitoring
|
||||||
|
data:
|
||||||
|
notify.sh: |
|
||||||
|
#!/bin/sh
|
||||||
|
CHANNEL="C0AND3S44CE"
|
||||||
|
EXPIRY="2027-04-11"
|
||||||
|
TODAY=$(date +%Y-%m-%d)
|
||||||
|
DAYS=$(( ($(date -d "$EXPIRY" +%s 2>/dev/null || date -j -f "%Y-%m-%d" "$EXPIRY" +%s) - $(date +%s)) / 86400 ))
|
||||||
|
|
||||||
|
if [ "$DAYS" -le 7 ]; then
|
||||||
|
EMOJI=":rotating_light:"
|
||||||
|
URGENCY="*URGENT — $DAYS days left*"
|
||||||
|
elif [ "$DAYS" -le 14 ]; then
|
||||||
|
EMOJI=":warning:"
|
||||||
|
URGENCY="*$DAYS days left*"
|
||||||
|
else
|
||||||
|
EMOJI=":bell:"
|
||||||
|
URGENCY="$DAYS days left"
|
||||||
|
fi
|
||||||
|
|
||||||
|
curl -s -X POST "https://slack.com/api/chat.postMessage" \
|
||||||
|
-H "Authorization: Bearer $(cat /etc/slack/bot_token)" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d "{
|
||||||
|
\"channel\": \"$CHANNEL\",
|
||||||
|
\"text\": \"$EMOJI *WireGuard key expiry reminder* — $URGENCY\",
|
||||||
|
\"blocks\": [{
|
||||||
|
\"type\": \"section\",
|
||||||
|
\"text\": {
|
||||||
|
\"type\": \"mrkdwn\",
|
||||||
|
\"text\": \"$EMOJI *ProtonVPN WireGuard key expiring soon*\n$URGENCY · expires $EXPIRY\n\n*Key:* \`neural_net-US-IL-267\` on GL.iNet home router\n\n*To renew:* ProtonVPN dashboard → WireGuard → delete \`neural_net-US-IL-267\` → generate new config → re-add to GL.iNet\"
|
||||||
|
}
|
||||||
|
}]
|
||||||
|
}"
|
||||||
|
echo "Notified Slack — $DAYS days until expiry"
|
||||||
|
---
|
||||||
|
# 1 month out: March 11, 2027
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: CronJob
|
||||||
|
metadata:
|
||||||
|
name: wireguard-reminder-1month
|
||||||
|
namespace: monitoring
|
||||||
|
spec:
|
||||||
|
schedule: "0 9 11 3 *"
|
||||||
|
jobTemplate:
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
spec:
|
||||||
|
serviceAccountName: wireguard-reminder
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
containers:
|
||||||
|
- name: notify
|
||||||
|
image: alpine:latest
|
||||||
|
command: ["sh", "/scripts/notify.sh"]
|
||||||
|
volumeMounts:
|
||||||
|
- name: script
|
||||||
|
mountPath: /scripts
|
||||||
|
- name: slack-token
|
||||||
|
mountPath: /etc/slack
|
||||||
|
readOnly: true
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 16Mi
|
||||||
|
cpu: 10m
|
||||||
|
limits:
|
||||||
|
memory: 64Mi
|
||||||
|
cpu: 50m
|
||||||
|
volumes:
|
||||||
|
- name: script
|
||||||
|
configMap:
|
||||||
|
name: wireguard-reminder-script
|
||||||
|
defaultMode: 0755
|
||||||
|
- name: slack-token
|
||||||
|
secret:
|
||||||
|
secretName: wireguard-reminder-slack
|
||||||
|
---
|
||||||
|
# Weekly: March 25, 2027
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: CronJob
|
||||||
|
metadata:
|
||||||
|
name: wireguard-reminder-week3
|
||||||
|
namespace: monitoring
|
||||||
|
spec:
|
||||||
|
schedule: "0 9 25 3 *"
|
||||||
|
jobTemplate:
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
spec:
|
||||||
|
serviceAccountName: wireguard-reminder
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
containers:
|
||||||
|
- name: notify
|
||||||
|
image: alpine:latest
|
||||||
|
command: ["sh", "/scripts/notify.sh"]
|
||||||
|
volumeMounts:
|
||||||
|
- name: script
|
||||||
|
mountPath: /scripts
|
||||||
|
- name: slack-token
|
||||||
|
mountPath: /etc/slack
|
||||||
|
readOnly: true
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 16Mi
|
||||||
|
cpu: 10m
|
||||||
|
limits:
|
||||||
|
memory: 64Mi
|
||||||
|
cpu: 50m
|
||||||
|
volumes:
|
||||||
|
- name: script
|
||||||
|
configMap:
|
||||||
|
name: wireguard-reminder-script
|
||||||
|
defaultMode: 0755
|
||||||
|
- name: slack-token
|
||||||
|
secret:
|
||||||
|
secretName: wireguard-reminder-slack
|
||||||
|
---
|
||||||
|
# Weekly: April 1, 2027
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: CronJob
|
||||||
|
metadata:
|
||||||
|
name: wireguard-reminder-week2
|
||||||
|
namespace: monitoring
|
||||||
|
spec:
|
||||||
|
schedule: "0 9 1 4 *"
|
||||||
|
jobTemplate:
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
spec:
|
||||||
|
serviceAccountName: wireguard-reminder
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
containers:
|
||||||
|
- name: notify
|
||||||
|
image: alpine:latest
|
||||||
|
command: ["sh", "/scripts/notify.sh"]
|
||||||
|
volumeMounts:
|
||||||
|
- name: script
|
||||||
|
mountPath: /scripts
|
||||||
|
- name: slack-token
|
||||||
|
mountPath: /etc/slack
|
||||||
|
readOnly: true
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 16Mi
|
||||||
|
cpu: 10m
|
||||||
|
limits:
|
||||||
|
memory: 64Mi
|
||||||
|
cpu: 50m
|
||||||
|
volumes:
|
||||||
|
- name: script
|
||||||
|
configMap:
|
||||||
|
name: wireguard-reminder-script
|
||||||
|
defaultMode: 0755
|
||||||
|
- name: slack-token
|
||||||
|
secret:
|
||||||
|
secretName: wireguard-reminder-slack
|
||||||
|
---
|
||||||
|
# Weekly: April 4, 2027
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: CronJob
|
||||||
|
metadata:
|
||||||
|
name: wireguard-reminder-week1
|
||||||
|
namespace: monitoring
|
||||||
|
spec:
|
||||||
|
schedule: "0 9 4 4 *"
|
||||||
|
jobTemplate:
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
spec:
|
||||||
|
serviceAccountName: wireguard-reminder
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
containers:
|
||||||
|
- name: notify
|
||||||
|
image: alpine:latest
|
||||||
|
command: ["sh", "/scripts/notify.sh"]
|
||||||
|
volumeMounts:
|
||||||
|
- name: script
|
||||||
|
mountPath: /scripts
|
||||||
|
- name: slack-token
|
||||||
|
mountPath: /etc/slack
|
||||||
|
readOnly: true
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 16Mi
|
||||||
|
cpu: 10m
|
||||||
|
limits:
|
||||||
|
memory: 64Mi
|
||||||
|
cpu: 50m
|
||||||
|
volumes:
|
||||||
|
- name: script
|
||||||
|
configMap:
|
||||||
|
name: wireguard-reminder-script
|
||||||
|
defaultMode: 0755
|
||||||
|
- name: slack-token
|
||||||
|
secret:
|
||||||
|
secretName: wireguard-reminder-slack
|
||||||
|
---
|
||||||
|
# Daily April 5-10: run every day in April, script computes days remaining
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: CronJob
|
||||||
|
metadata:
|
||||||
|
name: wireguard-reminder-daily
|
||||||
|
namespace: monitoring
|
||||||
|
spec:
|
||||||
|
schedule: "0 9 5-10 4 *"
|
||||||
|
jobTemplate:
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
spec:
|
||||||
|
serviceAccountName: wireguard-reminder
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
containers:
|
||||||
|
- name: notify
|
||||||
|
image: alpine:latest
|
||||||
|
command: ["sh", "/scripts/notify.sh"]
|
||||||
|
volumeMounts:
|
||||||
|
- name: script
|
||||||
|
mountPath: /scripts
|
||||||
|
- name: slack-token
|
||||||
|
mountPath: /etc/slack
|
||||||
|
readOnly: true
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 16Mi
|
||||||
|
cpu: 10m
|
||||||
|
limits:
|
||||||
|
memory: 64Mi
|
||||||
|
cpu: 50m
|
||||||
|
volumes:
|
||||||
|
- name: script
|
||||||
|
configMap:
|
||||||
|
name: wireguard-reminder-script
|
||||||
|
defaultMode: 0755
|
||||||
|
- name: slack-token
|
||||||
|
secret:
|
||||||
|
secretName: wireguard-reminder-slack
|
||||||
Reference in New Issue
Block a user