Proxmox Tailscale Certificate

#!/bin/bash

LOG_FILE="/var/log/proxmox-cert-renewal.log"
LAST_RUN_FILE="/var/lib/proxmox-cert-renewal/last_run"
LOCK_FILE="/var/run/proxmox-cert-renewal.lock"

log_message() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

cleanup() {
    rm -f "$LOCK_FILE"
    log_message "Lock file cleanup completed"
}

if [ "$EUID" -ne 0 ]; then
    log_message "Error: Script must be run as root"
    exit 1
fi

mkdir -p "$(dirname "$LAST_RUN_FILE")"

if [ -f "$LOCK_FILE" ]; then
    if kill -0 "$(cat "$LOCK_FILE")" 2>/dev/null; then
        log_message "Another instance of the script is already running. Exiting."
        exit 1
    fi
    rm -f "$LOCK_FILE"
fi

echo $$ > "$LOCK_FILE"
trap cleanup EXIT

if [ -f "$LAST_RUN_FILE" ]; then
    last_run=$(cat "$LAST_RUN_FILE")
    now=$(date +%s)
    if [ $((now - last_run)) -lt 6048000 ]; then
        log_message "The certificate was renewed less than 10 weeks ago. No action needed."
        exit 0
    fi
fi

if ! tailscale status >/dev/null 2>&1; then
    log_message "Error: Tailscale is not running"
    exit 1
fi

if ! tailscale status | grep -q "^100\."; then
    log_message "Error: Tailscale is not properly connected"
    exit 1
fi

NAME="$(tailscale status --json | jq '.Self.DNSName | .[:-1]' -r)"
if [ -z "$NAME" ]; then
    log_message "Error: Unable to retrieve DNS name from Tailscale"
    exit 1
fi

log_message "Starting certificate renewal for $NAME"

if ! tailscale cert "$NAME"; then
    log_message "Error: Certificate generation failed"
    exit 1
fi

if [ ! -f "${NAME}.crt" ] || [ ! -f "${NAME}.key" ]; then
    log_message "Error: Certificate files not found"
    exit 1
fi

if ! openssl x509 -in "${NAME}.crt" -noout -text >/dev/null 2>&1; then
    log_message "Error: The generated certificate is invalid"
    rm -f "${NAME}.crt" "${NAME}.key"
    exit 1
fi

if ! pvenode cert set "${NAME}.crt" "${NAME}.key" --force --restart; then
    log_message "Error: Failed to install certificate in Proxmox"
    rm -f "${NAME}.crt" "${NAME}.key"
    exit 1
fi

rm -f "${NAME}.crt" "${NAME}.key"

date +%s > "$LAST_RUN_FILE"

log_message "Certificate renewal completed successfully"

exit 0