#!/bin/bash
# SSL certificate expiry checker for agentforms.io
# Run via cron: monthly check, alert if < 15 days to expiry

DOMAIN="agentforms.io"
THRESHOLD_DAYS=15

EXPIRY=$(echo | openssl s_client -connect "$DOMAIN:443" -servername "$DOMAIN" 2>/dev/null \
  | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)

if [ -z "$EXPIRY" ]; then
  echo "ERROR: Could not retrieve SSL cert for $DOMAIN"
  exit 1
fi

EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s 2>/dev/null)
NOW_EPOCH=$(date +%s)
DAYS_LEFT=$(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))

if [ "$DAYS_LEFT" -lt "$THRESHOLD_DAYS" ]; then
  echo "ALERT: SSL cert for $DOMAIN expires in ${DAYS_LEFT} days (${EXPIRY}). Threshold: ${THRESHOLD_DAYS} days."
  exit 1
else
  echo "OK: SSL cert for $DOMAIN expires in ${DAYS_LEFT} days (${EXPIRY})."
  exit 0
fi