#!/bin/bash
# 网站SSL证书监控脚本
# 检测 hqbnb.com, hqbsh.com, szbjb.com, hqbsh.net, sjpdd.com 的HTTPS支持和证书有效期

# Telegram配置 (1号机token)
TELEGRAM_TOKEN="8529719199:AAGjLDflvMXAEdgrBTSBEczOoSMybLU4gcs"
TELEGRAM_CHAT_ID="5117446326"

# 监控网站列表
WEBSITES=("hqbnb.com" "hqbsh.com" "szbjb.com" "hqbsh.net" "sjpdd.com")

# 告警阈值（天数）
WARNING_DAYS=7

# 日志文件
LOG_FILE="/root/.openclaw/logs/ssl-monitor.log"

log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

send_telegram() {
    local message="$1"
    curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_TOKEN}/sendMessage" \
        -d "chat_id=${TELEGRAM_CHAT_ID}" \
        -d "text=${message}" \
        -d "parse_mode=HTML" > /dev/null 2>&1
}

check_ssl() {
    local domain="$1"
    local result=""
    
    # 提取证书信息
    cert_info=$(echo | openssl s_client -servername "$domain" -connect "$domain":443 2>/dev/null | openssl x509 -noout -dates -subject 2>/dev/null)
    
    if [ $? -ne 0 ]; then
        echo "HTTPS_ERROR|$domain|无法连接到443端口"
        return 1
    fi
    
    end_date=$(echo "$cert_info" | grep "notAfter" | cut -d= -f2)
    end_date_epoch=$(date -d "$end_date" +%s 2>/dev/null)
    current_epoch=$(date +%s)
    days_left=$(($end_date_epoch - $current_epoch) / 86400 )
    
    subject=$(echo "$cert_info" | grep "subject=" | cut -d= -f2-)
    
    http_status=$(curl -s -o /dev/null -w "%{http_code}" -L --connect-timeout 10 "https://$domain" 2>/dev/null)
    
    if [ "$http_status" == "200" ] || [ "$http_status" == "301" ] || [ "$http_status" == "302" ]; then
        echo "HTTPS_OK|$domain|$days_left|$subject|$http_status"
        return 0
    else
        echo "HTTPS_ERROR|$domain|HTTP状态码:$http_status"
        return 1
    fi
}

log "========== SSL证书检测开始 =========="

alert_message=""
success_count=0
error_count=0

for site in "${WEBSITES[@]}"; do
    log "检测网站: $site"
    
    result=$(check_ssl "$site")
    status=$(echo "$result" | cut -d'|' -f1)
    domain=$(echo "$result" | cut -d'|' -f2)
    days_left=$(echo "$result" | cut -d'|' -f3)
    subject=$(echo "$result" | cut -d'|' -f4)
    http_code=$(echo "$result" | cut -d'|' -f5)
    
    if [ "$status" == "HTTPS_OK" ]; then
        success_count=$($success_count + 1)
        log "✅ $site: HTTPS正常，证书还有 ${days_left} 天过期"
        
        if [ "$days_left" -lt "$WARNING_DAYS" ]; then
            log "⚠️ $site: 证书即将过期！仅剩 ${days_left} 天"
            alert_message="${alert_message}⚠️ <b>$site</b> 证书即将过期 (${days_left}天)\n"
        fi
    else
        error_count=$($error_count + 1)
        log "❌ $site: HTTPS异常 - $result"
        alert_message="${alert_message}❌ <b>$site</b> HTTPS异常: $result\n"
    fi
done

log "检测完成: $success_count 成功, $error_count 错误"

if [ -n "$alert_message" ]; then
    alert_message="🔔 <b>SSL证书监控告警</b>\n\n${alert_message}---\n检测时间: $(date '+%Y-%m-%d %H:%M:%S')"
    log "发送Telegram告警..."
    send_telegram "$alert_message"
fi

log "========== SSL证书检测完成 =========="
echo ""