#!/bin/bash
# ==============================================================================================
# ==================================== Cert Triage =============================================
# ==============================================================================================
#
# PURPOSE
# ─────────────────────────────────────────────────────────────────────────────
# Reads certbot's own logs and names why renewals failed, in the handful of categories they
# actually fall into.
#
# cert_history.sh counts failures — it notices an expiry in the past. It cannot say why. The why
# is in certbot's log, which here is 1001 rotated files and 639 MB, and the last time anyone
# answered "why did ten certificates stop renewing" they read them by hand.
#
# ==============================================================================================
# OPERATIONAL MODEL
# ==============================================================================================
#
# A wrapper. The work is in cert_triage.php.
#
# Counts runs, not lines. One log file is one certbot invocation, and one failure writes its
# reason three times — in the ACME response, the traceback, and certbot's own summary. Counting
# lines reports a single failure as three and inflates whichever category is most verbose.
#
# Reads the newest logs by rotation suffix, never by mtime. Every file here carries the same
# mtime because they are synced as a set, so mtime order is meaningless.
#
# The categories are separated into causes and consequences. Rate limiting is nearly always
# downstream — retries against a hostname with no DNS record exhaust the allowance, which then
# fails renewals for domains that have nothing wrong with them.
#
# ==============================================================================================
# RUNTIME MODES
# ==============================================================================================
#
# cert_triage.sh            summary — categories, affected domains, and the causal reading
# cert_triage.sh --json     the same as JSON, for the Certs tab
# cert_triage.sh --files=N  override how many rotated logs to read
#
# ==============================================================================================
# CONFIGURATION
# ==============================================================================================
#
# CERT_TRIAGE_FILES      rotated logs to read, newest first
# CERT_TRIAGE_MAX_BYTES  bytes read from the end of each
# CERT_TRIAGE_LOG_DIR    override the log directory; normally found from the NPM container
#
# ==============================================================================================

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
php "$SCRIPT_DIR/cert_triage.php" "$@"