# WireGuard key expiry reminders — voidstash GL.iNet router key expires 2027-04-11
# Schedule: 1 month out, then weekly, then daily in the last week
# Posts to #infrastructure-alerts via Slack bot token from Vault
#
# To renew: ProtonVPN dashboard → WireGuard → neural_net-US-IL-267 → delete & regenerate
# Then re-add to GL.iNet router WireGuard Client page
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: wireguard-reminder
  namespace: monitoring
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: wireguard-reminder-slack
  namespace: monitoring
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: wireguard-reminder-slack
    creationPolicy: Owner
  data:
    - secretKey: bot_token
      remoteRef:
        key: secret/data/slack
        property: bot_token
---
# Template for all reminder jobs — actual CronJobs below reference this pattern
# Reminder script: posts to Slack with urgency based on days remaining
apiVersion: v1
kind: ConfigMap
metadata:
  name: wireguard-reminder-script
  namespace: monitoring
data:
  notify.sh: |
    #!/bin/sh
    CHANNEL="C0AND3S44CE"
    EXPIRY="2027-04-11"
    TODAY=$(date +%Y-%m-%d)
    DAYS=$(( ($(date -d "$EXPIRY" +%s 2>/dev/null || date -j -f "%Y-%m-%d" "$EXPIRY" +%s) - $(date +%s)) / 86400 ))

    if [ "$DAYS" -le 7 ]; then
      EMOJI=":rotating_light:"
      URGENCY="*URGENT — $DAYS days left*"
    elif [ "$DAYS" -le 14 ]; then
      EMOJI=":warning:"
      URGENCY="*$DAYS days left*"
    else
      EMOJI=":bell:"
      URGENCY="$DAYS days left"
    fi

    curl -s -X POST "https://slack.com/api/chat.postMessage" \
      -H "Authorization: Bearer $(cat /etc/slack/bot_token)" \
      -H "Content-Type: application/json" \
      -d "{
        \"channel\": \"$CHANNEL\",
        \"text\": \"$EMOJI *WireGuard key expiry reminder* — $URGENCY\",
        \"blocks\": [{
          \"type\": \"section\",
          \"text\": {
            \"type\": \"mrkdwn\",
            \"text\": \"$EMOJI *ProtonVPN WireGuard key expiring soon*\n$URGENCY · expires $EXPIRY\n\n*Key:* \`neural_net-US-IL-267\` on GL.iNet home router\n\n*To renew:* ProtonVPN dashboard → WireGuard → delete \`neural_net-US-IL-267\` → generate new config → re-add to GL.iNet\"
          }
        }]
      }"
    echo "Notified Slack — $DAYS days until expiry"
---
# 1 month out: March 11, 2027
apiVersion: batch/v1
kind: CronJob
metadata:
  name: wireguard-reminder-1month
  namespace: monitoring
spec:
  schedule: "0 9 11 3 *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: wireguard-reminder
          restartPolicy: OnFailure
          containers:
            - name: notify
              image: alpine:latest
              command: ["sh", "/scripts/notify.sh"]
              volumeMounts:
                - name: script
                  mountPath: /scripts
                - name: slack-token
                  mountPath: /etc/slack
                  readOnly: true
              resources:
                requests:
                  memory: 16Mi
                  cpu: 10m
                limits:
                  memory: 64Mi
                  cpu: 50m
          volumes:
            - name: script
              configMap:
                name: wireguard-reminder-script
                defaultMode: 0755
            - name: slack-token
              secret:
                secretName: wireguard-reminder-slack
---
# Weekly: March 25, 2027
apiVersion: batch/v1
kind: CronJob
metadata:
  name: wireguard-reminder-week3
  namespace: monitoring
spec:
  schedule: "0 9 25 3 *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: wireguard-reminder
          restartPolicy: OnFailure
          containers:
            - name: notify
              image: alpine:latest
              command: ["sh", "/scripts/notify.sh"]
              volumeMounts:
                - name: script
                  mountPath: /scripts
                - name: slack-token
                  mountPath: /etc/slack
                  readOnly: true
              resources:
                requests:
                  memory: 16Mi
                  cpu: 10m
                limits:
                  memory: 64Mi
                  cpu: 50m
          volumes:
            - name: script
              configMap:
                name: wireguard-reminder-script
                defaultMode: 0755
            - name: slack-token
              secret:
                secretName: wireguard-reminder-slack
---
# Weekly: April 1, 2027
apiVersion: batch/v1
kind: CronJob
metadata:
  name: wireguard-reminder-week2
  namespace: monitoring
spec:
  schedule: "0 9 1 4 *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: wireguard-reminder
          restartPolicy: OnFailure
          containers:
            - name: notify
              image: alpine:latest
              command: ["sh", "/scripts/notify.sh"]
              volumeMounts:
                - name: script
                  mountPath: /scripts
                - name: slack-token
                  mountPath: /etc/slack
                  readOnly: true
              resources:
                requests:
                  memory: 16Mi
                  cpu: 10m
                limits:
                  memory: 64Mi
                  cpu: 50m
          volumes:
            - name: script
              configMap:
                name: wireguard-reminder-script
                defaultMode: 0755
            - name: slack-token
              secret:
                secretName: wireguard-reminder-slack
---
# Weekly: April 4, 2027
apiVersion: batch/v1
kind: CronJob
metadata:
  name: wireguard-reminder-week1
  namespace: monitoring
spec:
  schedule: "0 9 4 4 *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: wireguard-reminder
          restartPolicy: OnFailure
          containers:
            - name: notify
              image: alpine:latest
              command: ["sh", "/scripts/notify.sh"]
              volumeMounts:
                - name: script
                  mountPath: /scripts
                - name: slack-token
                  mountPath: /etc/slack
                  readOnly: true
              resources:
                requests:
                  memory: 16Mi
                  cpu: 10m
                limits:
                  memory: 64Mi
                  cpu: 50m
          volumes:
            - name: script
              configMap:
                name: wireguard-reminder-script
                defaultMode: 0755
            - name: slack-token
              secret:
                secretName: wireguard-reminder-slack
---
# Daily April 5-10: run every day in April, script computes days remaining
apiVersion: batch/v1
kind: CronJob
metadata:
  name: wireguard-reminder-daily
  namespace: monitoring
spec:
  schedule: "0 9 5-10 4 *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: wireguard-reminder
          restartPolicy: OnFailure
          containers:
            - name: notify
              image: alpine:latest
              command: ["sh", "/scripts/notify.sh"]
              volumeMounts:
                - name: script
                  mountPath: /scripts
                - name: slack-token
                  mountPath: /etc/slack
                  readOnly: true
              resources:
                requests:
                  memory: 16Mi
                  cpu: 10m
                limits:
                  memory: 64Mi
                  cpu: 50m
          volumes:
            - name: script
              configMap:
                name: wireguard-reminder-script
                defaultMode: 0755
            - name: slack-token
              secret:
                secretName: wireguard-reminder-slack