audit echo vs log across all scripts — outcomes always visible, verbose for per-item loops

2026-06-14 12:40:15 -04:00
parent 4c37ab16fd
commit 3964f6fb46
1010 changed files with 377767 additions and 132 deletions
@@ -0,0 +1,129 @@
+<?php
+header('Content-Type: application/json');
+require_once dirname(__DIR__) . '/include/config.php';
+require_once dirname(__DIR__) . '/include/auth.php';
+
+$action = ($_SERVER['REQUEST_METHOD'] === 'POST')
+    ? trim($_POST['action'] ?? '')
+    : trim($_GET['action'] ?? '');
+
+$cacheFile = STATE_DIR . '/cert_status.json';
+
+// ── Live NPM cert list ────────────────────────────────────────────────────────
+if ($action === 'npm') {
+    $raw = vv_npm_req('GET', '/api/nginx/certificates');
+    if (!is_array($raw) || isset($raw['_err']))
+        die(json_encode(['ok' => false, 'error' => $raw['_err'] ?? 'NPM request failed']));
+
+    $master = vv_read_conf_raw('master.conf');
+    preg_match('/^\s*CERT_WARN_DAYS\s*=\s*(\d+)/m', $master, $w);
+    preg_match('/^\s*CERT_CRIT_DAYS\s*=\s*(\d+)/m', $master, $c);
+    $warn = (int)($w[1] ?? 30);
+    $crit = (int)($c[1] ?? 7);
+    $now  = time();
+
+    $certs = [];
+    foreach ($raw as $cert) {
+        $exp    = !empty($cert['expires_on']) ? strtotime($cert['expires_on']) : false;
+        $days   = $exp !== false ? (int)(($exp - $now) / 86400) : null;
+        $status = $days === null ? 'UNKN'
+                : ($days < 0    ? 'CRIT'
+                : ($days <= $crit ? 'CRIT'
+                : ($days <= $warn ? 'WARN' : 'OK')));
+        $certs[] = [
+            'id'          => $cert['id'],
+            'nice_name'   => $cert['nice_name'] ?? implode(', ', $cert['domain_names'] ?? []),
+            'domain_names'=> $cert['domain_names'] ?? [],
+            'provider'    => $cert['provider'] ?? 'unknown',
+            'expires'     => !empty($cert['expires_on']) ? substr($cert['expires_on'], 0, 10) : '',
+            'days'        => $days,
+            'status'      => $status,
+        ];
+    }
+    usort($certs, fn($a, $b) => ($a['days'] ?? PHP_INT_MAX) <=> ($b['days'] ?? PHP_INT_MAX));
+
+    echo json_encode(['ok' => true, 'certs' => $certs, 'warn_days' => $warn, 'crit_days' => $crit]);
+    exit;
+}
+
+// ── Read configured domains (without running checks) ─────────────────────────
+if ($action === 'domains') {
+    $hostId   = vv_detect_host();
+    $hostIdUp = strtoupper($hostId);
+    $confRaw  = ($hostId !== 'unknown') ? vv_read_conf_raw($hostId . '.conf') : '';
+    $master   = vv_read_conf_raw('master.conf');
+
+    // Extract CERT_WARN_DAYS / CERT_CRIT_DAYS from master
+    preg_match('/^\s*CERT_WARN_DAYS\s*=\s*(\d+)/m', $master, $w);
+    preg_match('/^\s*CERT_CRIT_DAYS\s*=\s*(\d+)/m', $master, $c);
+
+    // Extract domains array from host conf
+    $domains = [];
+    if (preg_match('/' . $hostIdUp . '_CERT_MONITOR_DOMAINS\s*=\s*\(([^)]*)\)/s', $confRaw, $dm)) {
+        preg_match_all('/"([^"]+)"/', $dm[1], $dd);
+        $domains = $dd[1] ?? [];
+    }
+
+    echo json_encode([
+        'ok'        => true,
+        'host_id'   => $hostId,
+        'domains'   => $domains,
+        'warn_days' => (int)($w[1] ?? 30),
+        'crit_days' => (int)($c[1] ?? 7),
+    ]);
+    exit;
+}
+
+// ── Run cert_monitor.sh now ───────────────────────────────────────────────────
+if ($action === 'run') {
+    $script = SCRIPTS_DIR . '/Monitors/cert_monitor.sh';
+    if (!file_exists($script)) {
+        echo json_encode(['ok' => false, 'error' => 'cert_monitor.sh not found']);
+        exit;
+    }
+    set_time_limit(180);
+    exec('bash ' . escapeshellarg($script) . ' 2>&1', $out, $rc);
+    // Read freshly written cache
+    $data = file_exists($cacheFile)
+        ? (json_decode(file_get_contents($cacheFile), true) ?: null)
+        : null;
+    echo json_encode([
+        'ok'     => true,
+        'data'   => $data,
+        'output' => array_slice(array_filter(array_map('trim', $out)), 0, 30),
+        'rc'     => $rc,
+    ]);
+    exit;
+}
+
+// ── Default: return cached status ─────────────────────────────────────────────
+if (!file_exists($cacheFile)) {
+    // No cache yet — return configured domains so UI can show them unchecked
+    $hostId   = vv_detect_host();
+    $hostIdUp = strtoupper($hostId);
+    $confRaw  = ($hostId !== 'unknown') ? vv_read_conf_raw($hostId . '.conf') : '';
+    $master   = vv_read_conf_raw('master.conf');
+
+    preg_match('/^\s*CERT_WARN_DAYS\s*=\s*(\d+)/m', $master, $w);
+    preg_match('/^\s*CERT_CRIT_DAYS\s*=\s*(\d+)/m', $master, $c);
+    $domains = [];
+    if (preg_match('/' . $hostIdUp . '_CERT_MONITOR_DOMAINS\s*=\s*\(([^)]*)\)/s', $confRaw, $dm)) {
+        preg_match_all('/"([^"]+)"/', $dm[1], $dd);
+        foreach ($dd[1] ?? [] as $d) {
+            $domains[] = ['domain' => $d, 'status' => 'UNKN', 'days' => null, 'expires' => ''];
+        }
+    }
+
+    echo json_encode([
+        'ok'         => true,
+        'checked_at' => null,
+        'host'       => $hostId !== 'unknown' ? strtoupper($hostId) : null,
+        'warn_days'  => (int)($w[1] ?? 30),
+        'crit_days'  => (int)($c[1] ?? 7),
+        'domains'    => $domains,
+    ]);
+    exit;
+}
+
+$data = json_decode(file_get_contents($cacheFile), true) ?: [];
+echo json_encode(array_merge(['ok' => true], $data));