delete-old-keys

#!/bin/bash

# Copyright 2014-2015 Richard Russon (FlatCap)
# Licensed under the GPLv3

PATH="/var/named/bin:/usr/bin:/usr/sbin"
source log.sh

export TZ="UTC"

set -o errexit	# set -e
set -o nounset	# set -u

renice --priority 19 --pid $$ > /dev/null
ionice --class 3     --pid $$ > /dev/null

shopt -s nullglob

function finish()
{
	local RETVAL=$?
	[ $RETVAL = 0 ] || log_error "${0##*/} failed: $RETVAL"
}

trap finish EXIT

cd /var/named

[ -d "$DNSSEC_KEY_DIR" ] || exit 0

FILES="$(find "$DNSSEC_KEY_DIR" -type f -name K\*)"

IGNORE=()
SAFE=()
DELETE=()

DATE_NOW=${1:-$(date "+%Y%m%d%H%M%S")}

for f in $FILES; do
	EXPIRY=$(awk '/Delete/{ print $3 ? $3 : $2 }' $f)
	if [ -z "$EXPIRY" ]; then
		IGNORE+=($f)
		continue
	fi

	if [ $DATE_NOW -gt $EXPIRY ]; then
		DELETE+=($f)
	else
		SAFE+=($f)
	fi
done

log_info "Delete old keys"

if [ ${#SAFE[@]} -gt 0 ]; then
	echo "Safe:"
	for f in ${SAFE[@]}; do
		echo -e "\t$f"
	done
fi

if [ ${#IGNORE[@]} -gt 0 ]; then
	echo "Ignore:"
	for f in ${IGNORE[@]}; do
		echo -e "\t$f"
	done
fi

if [ ${#DELETE[@]} -gt 0 ]; then
	log_warning "Delete:"
	for f in ${DELETE[@]}; do
		log_warning "\t$f"
		rm --force "$f"
	done
fi