Merge branch 'main' into fix/domain-port-tls-state-lookup

internal/watcher/watcher.go

@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"sort"
 	"strings"
+	"sync"
 	"time"
 
 	"go.uber.org/fx"
@@ -40,15 +41,17 @@ type Params struct {
 
 // Watcher orchestrates all monitoring checks on a schedule.
 type Watcher struct {
-	log       *slog.Logger
-	config    *config.Config
-	state     *state.State
-	resolver  DNSResolver
-	portCheck PortChecker
-	tlsCheck  TLSChecker
-	notify    Notifier
-	cancel    context.CancelFunc
-	firstRun  bool
+	log              *slog.Logger
+	config           *config.Config
+	state            *state.State
+	resolver         DNSResolver
+	portCheck        PortChecker
+	tlsCheck         TLSChecker
+	notify           Notifier
+	cancel           context.CancelFunc
+	firstRun         bool
+	expiryNotifiedMu sync.Mutex
+	expiryNotified   map[string]time.Time
 }
 
 // New creates a new Watcher instance wired into the fx lifecycle.
@@ -57,14 +60,15 @@ func New(
 	params Params,
 ) (*Watcher, error) {
 	w := &Watcher{
-		log:       params.Logger.Get(),
-		config:    params.Config,
-		state:     params.State,
-		resolver:  params.Resolver,
-		portCheck: params.PortCheck,
-		tlsCheck:  params.TLSCheck,
-		notify:    params.Notify,
-		firstRun:  true,
+		log:            params.Logger.Get(),
+		config:         params.Config,
+		state:          params.State,
+		resolver:       params.Resolver,
+		portCheck:      params.PortCheck,
+		tlsCheck:       params.TLSCheck,
+		notify:         params.Notify,
+		firstRun:       true,
+		expiryNotified: make(map[string]time.Time),
 	}
 
 	lifecycle.Append(fx.Hook{
@@ -100,14 +104,15 @@ func NewForTest(
 	n Notifier,
 ) *Watcher {
 	return &Watcher{
-		log:       slog.Default(),
-		config:    cfg,
-		state:     st,
-		resolver:  res,
-		portCheck: pc,
-		tlsCheck:  tc,
-		notify:    n,
-		firstRun:  true,
+		log:            slog.Default(),
+		config:         cfg,
+		state:          st,
+		resolver:       res,
+		portCheck:      pc,
+		tlsCheck:       tc,
+		notify:         n,
+		firstRun:       true,
+		expiryNotified: make(map[string]time.Time),
 	}
 }
 
@@ -713,6 +718,22 @@ func (w *Watcher) checkTLSExpiry(
 		return
 	}
 
+	// Deduplicate expiry warnings: don't re-notify for the same
+	// hostname within the TLS check interval.
+	dedupKey := fmt.Sprintf("expiry:%s:%s", hostname, ip)
+
+	w.expiryNotifiedMu.Lock()
+
+	lastNotified, seen := w.expiryNotified[dedupKey]
+	if seen && time.Since(lastNotified) < w.config.TLSInterval {
+		w.expiryNotifiedMu.Unlock()
+
+		return
+	}
+
+	w.expiryNotified[dedupKey] = time.Now()
+	w.expiryNotifiedMu.Unlock()
+
 	msg := fmt.Sprintf(
 		"Host: %s\nIP: %s\nCN: %s\n"+
 			"Expires: %s (%.0f days)",