gogios: add Shuriken album-age check (1w warn, 2w crit)

Add a custom gogios check that monitors shuriken album freshness via
dist/status.json's unix_epoch, read locally on each frontend (so it
covers the whole generation+sync pipeline). warn at 1 week, crit at 2
weeks; CRIT if status.json is missing (album not published). DependsOn
the site's HTTP checks.

The check_shuriken_age plugin (Perl, Nagios API) lives in the
shuriken.sh repo (contrib/); the frontends Rexfile gogios task installs
it to /usr/local/bin/ from the sibling shuriken.sh checkout (single
source of truth, no vendored copy).

2 files changed, 28 insertions, 0 deletions

diff --git a/frontends/Rexfile b/frontends/Rexfile
index 3e72227..b673897 100644
--- a/frontends/Rexfile
+++ b/frontends/Rexfile
@@ -11,6 +11,7 @@
 use Rex -feature => [ '1.14', 'exec_autodie' ];
 use Rex::Logger;
 use File::Slurp;
+use File::Basename qw(dirname);
 
 # REX CONFIG SECTION
 
@@ -650,6 +651,14 @@ task 'gogios',
       group   => 'wheel',
       mode    => '744';
 
+    # Shuriken album-age check plugin (canonical copy lives in the shuriken.sh
+    # repo; read it from the sibling checkout so there is one source of truth).
+    file '/usr/local/bin/check_shuriken_age',
+      content => read_file( dirname(__FILE__) . '/../../shuriken.sh/contrib/check_shuriken_age' ),
+      owner   => 'root',
+      group   => 'wheel',
+      mode    => '755';
+
     file '/var/run/gogios',
       ensure => 'directory',
       owner  => '_gogios',
diff --git a/frontends/etc/gogios.json.tpl b/frontends/etc/gogios.json.tpl
index 4258592..be003c4 100644
--- a/frontends/etc/gogios.json.tpl
+++ b/frontends/etc/gogios.json.tpl
@@ -184,6 +184,25 @@
       "RandomSpread": 10,
       "RunInterval": 300,
       "Args": ["-w", "2,1,1", "-c", "4,3,3"]
+    },
+    <%# Shuriken album freshness: status.json is written last by a successful
+        generation and pushed to the frontends by shuriken-sync, so a stale
+        epoch means the daily generation CronJob or the rsync sync is broken.
+        warn=1 week (604800s), crit=2 weeks (1209600s). Only run when the site
+        itself is reachable (DependsOn its HTTP checks). -%>
+    "Check Shuriken Age irregular.ninja": {
+      "Plugin": "/usr/local/bin/check_shuriken_age",
+      "RandomSpread": 10,
+      "RunInterval": 1800,
+      "Args": ["-f", "/var/www/htdocs/irregular.ninja/status.json", "-w", "604800", "-c", "1209600"],
+      "DependsOn": ["Check HTTP IPv4 irregular.ninja", "Check HTTP IPv6 irregular.ninja"]
+    },
+    "Check Shuriken Age alt.irregular.ninja": {
+      "Plugin": "/usr/local/bin/check_shuriken_age",
+      "RandomSpread": 10,
+      "RunInterval": 1800,
+      "Args": ["-f", "/var/www/htdocs/alt.irregular.ninja/status.json", "-w", "604800", "-c", "1209600"],
+      "DependsOn": ["Check HTTP IPv4 alt.irregular.ninja", "Check HTTP IPv6 alt.irregular.ninja"]
     }
   }
 }