#!/bin/sh
# Usage: wg-check [max_age_seconds]   (default 180; run from root's crontab every minute)
# Logs "tunnel wg0 DOWN" at daemon.err when the last WireGuard handshake is older
# than max_age, or has never happened. Forwarded to the SIEM, where an alert watches it.
max=${1:-180}
age=$(/sbin/ifconfig wg0 2>/dev/null | sed -n 's/.*last handshake: \([0-9][0-9]*\) seconds ago.*/\1/p')
if [ -z "$age" ] || [ "$age" -gt "$max" ]; then
	/usr/bin/logger -t wg-check -p daemon.err "tunnel wg0 DOWN (last handshake: ${age:-never} s ago)"
fi