Add optional healthcheck heartbeat

The check is silent by design on a healthy host, so an absent alert is
indistinguishable from a cron that stopped running. Ping HEALTHCHECK_URL
on a clean run and the /fail endpoint when the check alerts or cannot
complete. Empty by default, which disables the pings.

scripts/check-cert-expiry.sh

@@ -13,6 +13,7 @@ ALERT_ON_NO_CERTS="${ALERT_ON_NO_CERTS:-true}"
 CHECK_SERVED="${CHECK_SERVED:-true}"
 SERVED_ADDR="${SERVED_ADDR:-127.0.0.1:443}"
 SERVED_TIMEOUT="${SERVED_TIMEOUT:-10}"
+HEALTHCHECK_URL="${HEALTHCHECK_URL:-}"
 
 host="$(hostname -f 2>/dev/null || hostname 2>/dev/null || echo "unknown-host")"
 now_epoch="$(date +%s)"
@@ -59,9 +60,22 @@ served_expiry_epoch() {
   date -d "${enddate#notAfter=}" +%s 2>/dev/null
 }
 
+# Dead man's switch. ntfy reports what the check found; this reports that the
+# check ran at all. Without it, a dead cron, a failed boot or a bad chmod all
+# look exactly like a healthy fleet.
+ping_healthcheck() {
+  local suffix="${1:-}"
+
+  [[ -z "${HEALTHCHECK_URL}" ]] && return 0
+
+  curl -fsS -m 10 -o /dev/null "${HEALTHCHECK_URL}${suffix}" \
+    || echo "Failed to ping healthcheck at ${HEALTHCHECK_URL}${suffix}" >&2
+}
+
 fail() {
   local message="$1"
   send_alert "${message}" || echo "Failed to send ntfy alert to ${NTFY_URL}" >&2
+  ping_healthcheck "/fail"
   echo "${message}" >&2
   exit 1
 }
@@ -127,6 +141,7 @@ if (( cert_count == 0 )); then
   fi
 
   echo "No certificates found under ${CERT_DIR}; no alert sent."
+  ping_healthcheck
   exit 0
 fi
 
@@ -136,8 +151,10 @@ if (( ${#warnings[@]} > 0 )); then
 $(printf '%s\n' "${warnings[@]}")"
 
   send_alert "${message}" || echo "Failed to send ntfy alert to ${NTFY_URL}" >&2
+  ping_healthcheck "/fail"
   echo "${message}" >&2
   exit 1
 fi
 
 echo "All ${cert_count} certificate(s) are valid for more than ${EXPIRY_DAYS} day(s)."
+ping_healthcheck