cert-canary: alert text points at dead-domain pruning (certbot delete), not the stale pending-approval memo

6f9425366e65dffab53bddbae2882d15a7eb319f · 2026-08-03 10:18:41 -0700 · Steve

Files touched

M run.sh

Diff

commit 6f9425366e65dffab53bddbae2882d15a7eb319f
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon Aug 3 10:18:41 2026 -0700

    cert-canary: alert text points at dead-domain pruning (certbot delete), not the stale pending-approval memo
---
 run.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/run.sh b/run.sh
index 8703987..d172c5b 100755
--- a/run.sh
+++ b/run.sh
@@ -65,7 +65,7 @@ curl -sS --max-time 10 "$CNCP/api/parking-lot" -H 'Content-Type: application/jso
 if [ -f "$HOME/.claude/skills/_shared/george-send.sh" ]; then
   . "$HOME/.claude/skills/_shared/george-send.sh"
   ROWS=$(echo "$SOON" | sed 's/&/\&amp;/g;s/</\&lt;/g' | awk 'NF{print "<div>• "$0"</div>"}')
-  BODY="<div style=\"font-family:-apple-system,sans-serif\"><h3 style=\"color:#b23b3b\">⚠ Kamatera SSL renewal worsening</h3><div><b>$EXPIRED</b> expired (was $P_EXP) · <b>$EXPIRING</b> expiring &le;${EXPIRING_DAYS}d (was $P_ING) · last renew run had <b>$FAILURES</b> failures (was $P_FAIL) of $TOTAL certs.</div><p style=\"color:#444;font-size:13px\">Renewal fix is drafted in ~/.claude/yolo-queue/pending-approval/ (HTTP-01 fails on redirect-only vhosts; DNS-01 blocked by CF token scope). Deleting/converting certs is Steve-gated.</p>$ROWS</div>"
+  BODY="<div style=\"font-family:-apple-system,sans-serif\"><h3 style=\"color:#b23b3b\">⚠ Kamatera SSL renewal worsening</h3><div><b>$EXPIRED</b> expired (was $P_EXP) · <b>$EXPIRING</b> expiring &le;${EXPIRING_DAYS}d (was $P_ING) · last renew run had <b>$FAILURES</b> failures (was $P_FAIL) of $TOTAL certs.</div><p style=\"color:#444;font-size:13px\">Triage each named cert: if the domain no longer resolves (dig +short @1.1.1.1 &lt;d&gt; = no NS/A) it is a dead orphan lineage &rarr; prune with certbot delete --cert-name &lt;d&gt; (disable any still-enabled vhost FIRST so nginx -t stays green). If it DOES resolve, it is a live-renewal issue (HTTP-01 on redirect-only vhosts / DNS-01 CF-token scope). Deleting/converting certs is Steve-gated.</p>$ROWS</div>"
   RESP="$(george_send steve-office "${CERT_TO:-steve@designerwallcoverings.com}" "⚠ Kamatera SSL renewal $VERDICT — $(date +%H:%M)" "$BODY")"
   echo "$RESP" | grep -q '"success":true' && log "emailed" || log "email failed"
 fi

← 168265c auto-save: 2026-08-03T09:52:50 (1 files) — data/latest.json · back to Dw Cert Renewal Canary · auto-save: 2026-08-03T21:27:28 (1 files) — data/latest.json bb71c5b →