feat(checks): wire up TLS certificate expiry monitoring
The ontology declared monitoring [cert-expiry] on the certificate type and a working checkCertExpiry probe existed, but checkdefaults had no cert-expiry builder and no certificate entities were seeded — so certificate expiry, a real failure mode, was invisible. Add a KindCertExpiry builder (dials the cert's hostname on :443 hourly, warns at 30d / crit at 7d) and seed certificate entities for the 20 public *.hubris.network routes plus uses-certificate edges from each ingress route.
This commit is contained in:
@@ -339,6 +339,30 @@ entities:
|
||||
- {slug: "ingress:sab.hubris.network", type: ingress-route, name: sab.hubris.network,
|
||||
attributes: {forward_auth: true}}
|
||||
|
||||
# ─── TLS certificates (Caddy-managed, *.hubris.network) ───────────
|
||||
# One entity per public hostname; the cert-expiry checker dials each on
|
||||
# :443 and reads NotAfter. The cn/name is the hostname the checker dials.
|
||||
- {slug: "cert:proxmox.hubris.network", type: certificate, name: proxmox.hubris.network}
|
||||
- {slug: "cert:git.hubris.network", type: certificate, name: git.hubris.network}
|
||||
- {slug: "cert:auth.hubris.network", type: certificate, name: auth.hubris.network}
|
||||
- {slug: "cert:media.hubris.network", type: certificate, name: media.hubris.network}
|
||||
- {slug: "cert:cloud.hubris.network", type: certificate, name: cloud.hubris.network}
|
||||
- {slug: "cert:paperless.hubris.network", type: certificate, name: paperless.hubris.network}
|
||||
- {slug: "cert:matrix.hubris.network", type: certificate, name: matrix.hubris.network}
|
||||
- {slug: "cert:photos.hubris.network", type: certificate, name: photos.hubris.network}
|
||||
- {slug: "cert:artifacto.hubris.network", type: certificate, name: artifacto.hubris.network}
|
||||
- {slug: "cert:trmnl.hubris.network", type: certificate, name: trmnl.hubris.network}
|
||||
- {slug: "cert:zimaos.hubris.network", type: certificate, name: zimaos.hubris.network}
|
||||
- {slug: "cert:teddy.hubris.network", type: certificate, name: teddy.hubris.network}
|
||||
- {slug: "cert:mcp.hubris.network", type: certificate, name: mcp.hubris.network}
|
||||
- {slug: "cert:house.hubris.network", type: certificate, name: house.hubris.network}
|
||||
- {slug: "cert:books.hubris.network", type: certificate, name: books.hubris.network}
|
||||
- {slug: "cert:seanime.hubris.network", type: certificate, name: seanime.hubris.network}
|
||||
- {slug: "cert:roms.hubris.network", type: certificate, name: roms.hubris.network}
|
||||
- {slug: "cert:jellyseerr.hubris.network", type: certificate, name: jellyseerr.hubris.network}
|
||||
- {slug: "cert:qbit.hubris.network", type: certificate, name: qbit.hubris.network}
|
||||
- {slug: "cert:sab.hubris.network", type: certificate, name: sab.hubris.network}
|
||||
|
||||
# ─── Governance ────────────────────────────────────────────────────
|
||||
- {slug: "person:dtoro", type: person, name: dtoro,
|
||||
attributes: {matrix_id: "@dtoro:avispero"}}
|
||||
@@ -486,6 +510,28 @@ relationships:
|
||||
- {source: "ingress:jellyseerr.hubris.network", target: "service:caddy", type: served-by}
|
||||
- {source: "ingress:qbit.hubris.network", target: "service:caddy", type: served-by}
|
||||
- {source: "ingress:sab.hubris.network", target: "service:caddy", type: served-by}
|
||||
# Each public route is served with its TLS certificate.
|
||||
- {source: "ingress:proxmox.hubris.network", target: "cert:proxmox.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:git.hubris.network", target: "cert:git.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:auth.hubris.network", target: "cert:auth.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:media.hubris.network", target: "cert:media.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:cloud.hubris.network", target: "cert:cloud.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:paperless.hubris.network", target: "cert:paperless.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:matrix.hubris.network", target: "cert:matrix.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:photos.hubris.network", target: "cert:photos.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:artifacto.hubris.network", target: "cert:artifacto.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:trmnl.hubris.network", target: "cert:trmnl.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:zimaos.hubris.network", target: "cert:zimaos.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:teddy.hubris.network", target: "cert:teddy.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:mcp.hubris.network", target: "cert:mcp.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:house.hubris.network", target: "cert:house.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:books.hubris.network", target: "cert:books.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:seanime.hubris.network", target: "cert:seanime.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:roms.hubris.network", target: "cert:roms.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:jellyseerr.hubris.network", target: "cert:jellyseerr.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:qbit.hubris.network", target: "cert:qbit.hubris.network", type: uses-certificate}
|
||||
- {source: "ingress:sab.hubris.network", target: "cert:sab.hubris.network", type: uses-certificate}
|
||||
|
||||
- {source: "ingress:secrets.hubris.network", target: "service:secrets-issuance", type: routes-to}
|
||||
- {source: "ingress:house.hubris.network", target: "service:house", type: routes-to}
|
||||
- {source: "ingress:books.hubris.network", target: "service:grimmory", type: routes-to}
|
||||
|
||||
Reference in New Issue
Block a user