# Silver Server Ops

Server-wide maintenance scripts and operational notes for the Silver Cloud Hetzner host.

This repo is for host-level improvements that are not tied to one specific app or
service. SSL expiry alerts are the first check in the repo; more server-wide
maintenance checks can be added here over time.

## Implemented Checks

- SSL certificate expiry alerts

## SSL Certificate Expiry Alerts

`scripts/check-cert-expiry.sh` checks every Let's Encrypt certificate under
`/etc/letsencrypt/live` and sends an ntfy alert when any certificate expires in
less than 14 days.

### Install

```bash
sudo install -m 0755 scripts/check-cert-expiry.sh /opt/scripts/check-cert-expiry.sh
```

### Root cron

```cron
15 8 * * * /opt/scripts/check-cert-expiry.sh >>/var/log/cert-expiry-check.log 2>&1
```

### Defaults

```bash
CERT_DIR=/etc/letsencrypt/live
EXPIRY_DAYS=14
NTFY_URL=https://ntfy.silverwal.com/certbot
ALERT_ON_NO_CERTS=true
```

### Overrides

```bash
EXPIRY_DAYS=21 /opt/scripts/check-cert-expiry.sh
```

If the ntfy topic is protected with an access token:

```bash
NTFY_TOKEN=your-token /opt/scripts/check-cert-expiry.sh
```

### Manual test

```bash
sudo /opt/scripts/check-cert-expiry.sh
```

The script exits `0` when all certificates are healthy and `1` when it sends an
alert or cannot run the check correctly.

## Notification Notes

ntfy is a good default for this server because it is already self-hosted, simple
to call from shell scripts, and supports useful alert metadata such as title,
priority, and tags.

For jobs where silence is also a failure, pair ntfy with a dead man's switch such
as Healthchecks. ntfy tells you what the script found; Healthchecks tells you when
the script did not run at all.