Add a warning for node certificate expiring within 30 days (DB-138)

[dhingrak]

Fixed: Log a warning when certificates are close to expiry.

Fixes https://linear.app/eventstore/issue/DB-138/log-a-warning-when-certificates-are-close-to-expiry

The goal of this PR is to add a warning daily if the node certificate is going to expire within 30 days.

[linear]

DB-138 Log a warning when certificates are close to expiry

• Start warning when the certificate is 1 month from expiry
• Log the warning daily

[timothycoleman]

Suggested change

[timothycoleman]

I think it'd be nice to pass _certificateSelector into a new class that is responsible for monitoring the expiry rather than adding the logic to ClusterVNode. _certificateSelector is already passed elsewhere

We can store the ScheduleMessage returned by TimerMessage.Schedule.Create in a member variable and reuse it each time to save on these allocations that will end up in gen2 because they're long lived

[timothycoleman]

Ah sorry I should have been a bit clearer. The recent changes are a step in the right direction but I meant slightly more. We could have the CertificateExpiryMonitor be a component that communicates with messages (i.e. Handle the VerifyNodeCertificateExpiry and publish the _nodeCertificateExpirySchedule), so the ClusterVNode would wire it up and start it like it does the other major components without having to worry about calling it again after

[timothycoleman]

great thats look good

it would be cool if schedule message construction could be left to the monitor itself as well, then the whole implementation of how it works would be encapsulated away from the ClusterVNode. Then we'd be free to change the implementation of the monitor without it having a knock on effect elsewhere

it would likely make sense to have the Monitor Handle SystemMessage.SystemStart to achieve this

and then we'll be in a good position to write some unit tests for the monitor. if you find that the DateTime.Now call in the monitor is awkward in the test, you can do something like pass a Func to the monitor (which would be () => DateTime.Now in real life) but allows you to control time however you want in the test

one other thing, the monitor can receive the mainbus as a IPublisher rather than IQueuedHandler (all we are going to do with it is publish), and the member variable needn't be called _mainQueue because the monitor doesn't mind what queue it really is (which is nice because it means we can change the details of the ClusterVNode if we want without having a knock on effect on the monitor) so we can just call it _publisher or _output

[timothycoleman]

come to think of it the easiest thing to do would probably be to pass a

Func<DateTime?> getCertificateExpiry instead of Func<X509Certificate2> certificateSelector

then the tests will be easy even using DateTIme.now

[dhingrak]

Thank you so much Tim for your suggestions.

[timothycoleman]

Great, thanks!

[hayley-jean]

Looks good, I'm happy to merge as-is but I think it would be better to only show the remaining days as whole numbers:

Suggested change

	"Certificates are going to expire in {daysUntilExpiry:N1} days",
	"Certificates are going to expire in {daysUntilExpiry:N0} days",

[timothycoleman]

(for posterity, it can go either way but seeing 0.4 days is slightly more informative than 0 days)