From 7f188cc12a0b0313ab1a85f1426aa2f3733e3d7b Mon Sep 17 00:00:00 2001
From: Walusimbi Silver <107974377+swalusimbi@users.noreply.github.com>
Date: Thu, 3 Sep 2026 14:31:33 +0300
Subject: [PATCH] Restore install and cron docs for the cert check

These were dropped in b1b4296 when the README was trimmed, which left no
record in the repo of how the script gets onto the server or how it is
scheduled.
---
 README.md | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 55 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index a9f834e..1f63e5c 100644
--- a/README.md
+++ b/README.md
@@ -12,5 +12,58 @@ maintenance checks can be added here over time.
 
 ## SSL Certificate Expiry Alerts
 
-`scripts/check-cert-expiry.sh` checks Let's Encrypt certificates and alerts when
-any certificate expires in less than 14 days.
+`scripts/check-cert-expiry.sh` checks every Let's Encrypt certificate under
+`/etc/letsencrypt/live` and sends an ntfy alert when any certificate expires in
+less than 14 days.
+
+### Install
+
+```bash
+sudo install -m 0755 scripts/check-cert-expiry.sh /opt/scripts/check-cert-expiry.sh
+```
+
+### Root cron
+
+```cron
+15 8 * * * /opt/scripts/check-cert-expiry.sh >>/var/log/cert-expiry-check.log 2>&1
+```
+
+### Defaults
+
+```bash
+CERT_DIR=/etc/letsencrypt/live
+EXPIRY_DAYS=14
+NTFY_URL=https://ntfy.silverwal.com/certbot
+ALERT_ON_NO_CERTS=true
+```
+
+### Overrides
+
+```bash
+EXPIRY_DAYS=21 /opt/scripts/check-cert-expiry.sh
+```
+
+If the ntfy topic is protected with an access token:
+
+```bash
+NTFY_TOKEN=your-token /opt/scripts/check-cert-expiry.sh
+```
+
+### Manual test
+
+```bash
+sudo /opt/scripts/check-cert-expiry.sh
+```
+
+The script exits `0` when all certificates are healthy and `1` when it sends an
+alert or cannot run the check correctly.
+
+## Notification Notes
+
+ntfy is a good default for this server because it is already self-hosted, simple
+to call from shell scripts, and supports useful alert metadata such as title,
+priority, and tags.
+
+For jobs where silence is also a failure, pair ntfy with a dead man's switch such
+as Healthchecks. ntfy tells you what the script found; Healthchecks tells you when
+the script did not run at all.