Munin contributed plugins

#!/bin/bash

=head1 DESCRIPTION

This plugin monitors the number of certificate signing requests (CSRs) done with letsencrypt's certbot.

It tries to determine the registered domain and reports the number also per registered domain.

For people running multiple servers this enables aggregation of those numbers across multiple nodes in the munin.conf

=head1 CONFIGURATION

  [letsencrypt_weekly]

  # run with a user that is able to read /etc/letsencrypt/csr/ files and at least list directories in

  # /etc/letsencrypt/archive/

  user root

  # warn when more than 40 certificates have been requested in the last week

  env.warning :40

  # critical when more than 50 certificates have been requested in the last week

  env.critical :50

=head1 AGGREGATION CONFIGURATION

When you have multiple servers issuing certficates for the same registered domain you can aggregate the numbers with

this config:

  [letsencrypt]

      update no

      contact no

      # summarize letsencrypt_weekly from all hosts

      # see http://guide.munin-monitoring.org/en/latest/example/graph/aggregated-stack.html#extract-from-munin-conf

      # see http://guide.munin-monitoring.org/en/latest/example/graph/aggregate.html#example-plugin-aggregate

      letsencrypt_weekly_example_com.update no

      letsencrypt_weekly_example_com.graph_args --base 1000 -l 0

      letsencrypt_weekly_example_com.graph_category security

      letsencrypt_weekly_example_com.graph_period week

      letsencrypt_weekly_example_com.graph_title Letsencrypt example.com certificate requests

      letsencrypt_weekly_example_com.graph_vlabel requests / week

      letsencrypt_weekly_example_com.graph_scale no

      letsencrypt_weekly_example_com.graph_total Total

      letsencrypt_weekly_example_com.weekly.label Certificates for example.com

      letsencrypt_weekly_example_com.weekly.draw AREA

      letsencrypt_weekly_example_com.weekly.stack \

            line1_name=example.com;line1-host-name.example.com:letsencrypt_weekly.example_com_weekly \

            line2_name=example.com;line2-host-name.example.com:letsencrypt_weekly.example_com_weekly

      letsencrypt_renewal_weekly_example_com.update no

      letsencrypt_renewal_weekly_example_com.graph_args --base 1000 -l 0

      letsencrypt_renewal_weekly_example_com.graph_category security

      letsencrypt_renewal_weekly_example_com.graph_period week

      letsencrypt_renewal_weekly_example_com.graph_title Letsencrypt example.com certificate renewal requests

      letsencrypt_renewal_weekly_example_com.graph_vlabel requests / week

      letsencrypt_renewal_weekly_example_com.graph_scale no

      letsencrypt_renewal_weekly_example_com.graph_total Total

      letsencrypt_renewal_weekly_example_com.weekly.label Certificate renewals for example.com

      letsencrypt_renewal_weekly_example_com.weekly.draw AREA

      letsencrypt_renewal_weekly_example_com.weekly.stack \

            line1_name=example.com;line1-host-name.example.com:letsencrypt_weekly.example_com_renewal_weekly \

            line2_name=example.com;line2-host-name.example.com:letsencrypt_weekly.example_com_renewal_weekly

get_files_and_domains() {

	find /etc/letsencrypt/csr/ -mtime -7 -type f -print0 2>/dev/null | xargs -0 -I pem bash -c 'echo -n "pem "; openssl req -in pem -text -noout | grep DNS: | sed "s/.*DNS://g"'

}

get_registered_domains() {

	local REMOVE_PATH

	local TRIM_SUBDOMAIN

	REMOVE_PATH='s,.*/,,;'

	TRIM_SUBDOMAIN='s/.*\.\([a-z0-9-]\+\.[a-z]\+\)/\1/;'

	find /etc/letsencrypt/archive/ -mindepth 1 -maxdepth 1 | sed "$REMOVE_PATH $TRIM_SUBDOMAIN" | sort | uniq

}

	for domain in $(get_registered_domains); do

		key=${domain//[-.]/_}

		echo "${key}_weekly.label $domain"

		print_warning "${key}_weekly"

		print_critical "${key}_weekly"

		echo "${key}_renewal_weekly.label $domain renewals"

	done

	if existing_renewal_requests=$(get_files_and_domains); then

		value=$(echo "$existing_renewal_requests" | grep -v '^$' -c)

	values=""

	for domain in $(get_registered_domains); do

		key=${domain//[-.]/_}

		if [ "$values" != "" ] ; then

			values="$values\n${key}_weekly.value 0\n${key}_renewal_weekly.value 0"

		else

			values="${key}_weekly.value 0\n${key}_renewal_weekly.value 0"

		fi

	done

	while read -r file_domain; do

		file=${file_domain% *}

		domain=${file_domain#* }

		registered_domain_key=$(echo "$domain" | sed 's/.*\.\([a-z0-9-]\+\.[a-z]\+\)/\1/;s/[-.]/_/g')

		previous_certs=$(find "/etc/letsencrypt/archive/$domain" -name 'cert*.pem' -not -cnewer "$file" | wc -l)	

		if [ "$previous_certs" -gt 0 ] ; then

			value_key="${registered_domain_key}_renewal_weekly.value "

		else

			value_key="${registered_domain_key}_weekly.value "

		fi

		old_value=$(echo -e "$values" | grep "$value_key" | sed 's/.* //g')

		value=$((old_value + 1))

		values=${values//$value_key$old_value/$value_key$value}

	done < <(get_files_and_domains)

	echo -e $"$values"