Alert before and after the subscription expires

The subscription due date was only available as text, without any alert.

- New item pve.subscription.nextduedate.epoch carrying the due date as a Unix
  timestamp
- Trigger "expires in less than {$PVE.SUBSCRIPTION.EXPIRE.DAYS}", Warning,
  lead time 30 days by default
- Trigger "has expired", Average, once the date has passed

Neither needs an enable macro: a host without a subscription reports no due
date, so the item stays empty and the triggers cannot fire.
{$PVE.SUBSCRIPTION.ALERT} still governs only the status trigger for notfound,
invalid and suspended.

Both the advance warning and the status trigger depend on the expired trigger,
so a lapsed subscription raises one problem instead of three.

This is the one place where JavaScript preprocessing is unavoidable.
/nodes/{node}/subscription reports nextduedate as a plain date string, unlike
the certificate endpoint which already delivers an epoch, and Zabbix has no
preprocessing step that parses a date. "Already expired" could be done with
date(), "expires in N days" cannot. One line, with a format check: an
unexpected format throws so the item turns visibly unsupported instead of
yielding a wrong date.

Author: Thomas Rzen

Virtualization/template_proxmox-ve-rest-api-zabbix/7.0/README.md

@@ -123,6 +123,7 @@ Values must carry a time unit.
 | `{$IFACE.ACTIVE.WINDOW}` | `7d` | An interface must have been up once within this window before the interface down trigger fires. |
 | `{$PVE.REPL.LAG}` | `2h` | Maximum age of the last successful replication. Must stay above the replication schedule, otherwise the trigger fires between two runs. |
 | `{$PVE.CERT.EXPIRE.DAYS}` | `21d` | Lead time before certificate expiry. |
+| `{$PVE.SUBSCRIPTION.EXPIRE.DAYS}` | `30d` | Lead time before the subscription expires. |
 
 ### Discovery Filter Macros
 
@@ -187,7 +188,9 @@ Set to `0` to suppress a trigger globally. Supports context macros for per-insta
 | APT repository files are broken | Warning | At least one repository file cannot be parsed, updates will fail |
 | APT repository configuration has warnings | Info | For example the enterprise repository enabled without a subscription |
 | Package updates pending | Info | Disabled by default, like the item it depends on |
-| PVE subscription is not active | Warning | Disabled by default, see `{$PVE.SUBSCRIPTION.ALERT}` |
+| PVE subscription has expired | Average | The subscription period has ended, the enterprise repository is no longer accessible |
+| PVE subscription expires soon | Warning | Advance warning via `{$PVE.SUBSCRIPTION.EXPIRE.DAYS}`, depends on the expired trigger so only one is open at a time |
+| PVE subscription is not active | Warning | Status invalid, suspended or notfound. Off by default, see `{$PVE.SUBSCRIPTION.ALERT}` |
 
 ### VM / LXC Prototypes
 
@@ -265,7 +268,7 @@ The template includes a pre-built dashboard **"Proxmox VE - Monitoring Dashboard
 - **Physical NIC traffic:** Not available either. `/nodes/{node}/netstat` returns per-guest tap devices and resets its counters on every read, so there are no byte counters for `eno1` or `vmbr0`. `/nodes/{node}/rrddata` only carries the node aggregate.
 - **ZFS:** `/nodes/{node}/disks/zfs` requires `Sys.Audit` on `/`, not on `/nodes/{node}`. On nodes without ZFS the discovery simply returns nothing and stays supported.
 - **Replication:** The list endpoint already carries the job state, so no extra request per job is needed. Fields such as `last_sync` and `error` are absent before the first run or while the job is healthy; those items discard the value instead of turning unsupported.
-- **Subscription:** `/nodes/{node}/subscription` needs no special permission and answers with HTTP 200 even without a subscription, reporting status `notfound`.
+- **Subscription:** `/nodes/{node}/subscription` needs no special permission and answers with HTTP 200 even without a subscription, reporting status `notfound`. Unlike the certificate endpoint it reports `nextduedate` as a plain date string rather than an epoch, so a single JavaScript preprocessing line converts it for the expiry triggers. Those triggers need no enable macro: a host without a subscription reports no due date, so the item stays empty and they cannot fire.
 - **Permission errors:** The API answers with HTTP 403, so an item lacking permissions turns visibly unsupported rather than silently staying empty.
 - **ZFS pool health:** Stored as a number with a value map rather than as text, so it can be graphed and shown on a dashboard. 0 is ONLINE, everything above is a fault. The mapping is done with preprocessing steps, not with a script. A state outside the seven known zpool states leaves text in place and the item turns visibly unsupported instead of reporting a wrong number.
 - **Long term data:** Numeric performance and capacity items keep 365 days of trends. Timestamp items such as `last_sync` or `notafter` deliberately keep trends disabled, a trend over a Unix timestamp carries no meaning.

Virtualization/template_proxmox-ve-rest-api-zabbix/7.0/template_proxmox-ve-rest-api.yaml

@@ -1536,7 +1536,7 @@ zabbix_export:
           delay: '0'
           value_type: CHAR
           trends: '0'
-          description: 'Next due date as reported by PVE (string, not a timestamp). Alerting is done on the status item instead.'
+          description: 'Next due date as reported by PVE, a plain date string. The numeric form for alerting is in pve.subscription.nextduedate.epoch.'
           preprocessing:
             - type: JSONPATH
               parameters:
@@ -1547,6 +1547,37 @@ zabbix_export:
           tags:
             - tag: PVE
               value: Subscription
+        - uuid: d3ed6d06a2194635b5580d04303e143d
+          name: 'Subscription expiry'
+          type: DEPENDENT
+          key: pve.subscription.nextduedate.epoch
+          delay: '0'
+          value_type: FLOAT
+          units: unixtime
+          trends: '0'
+          description: 'Expiry date as a Unix timestamp so the remaining time can be compared. PVE reports nextduedate as a plain date string, unlike the certificate endpoint which already delivers an epoch. Zabbix has no preprocessing step that parses a date, hence the one line of JavaScript. Without a subscription the field is absent and the value is discarded.'
+          preprocessing:
+            - type: JSONPATH
+              parameters:
+                - '$.data.nextduedate'
+              error_handler: DISCARD_VALUE
+            - type: JAVASCRIPT
+              parameters:
+                - |
+                  // PVE reports nextduedate as YYYY-MM-DD. Anchored to UTC so the
+                  // result does not shift with the server timezone. An unexpected
+                  // format throws, which turns the item visibly unsupported instead
+                  // of silently producing a wrong date.
+                  var t = Date.parse(value + 'T00:00:00Z');
+                  if (isNaN(t)) {
+                      throw 'unexpected nextduedate format: ' + value;
+                  }
+                  return Math.floor(t / 1000);
+          master_item:
+            key: pve.subscription.raw
+          tags:
+            - tag: PVE
+              value: Subscription
       discovery_rules:
         - uuid: 91bb690f87b743cb8045704ac4a4c9e0
           name: 'Discover backup'
@@ -4565,6 +4596,9 @@ zabbix_export:
         - macro: '{$PVE.SERVICE.STATE.ALERT}'
           value: '1'
           description: 'Enables the service state trigger. Use the context form {$PVE.SERVICE.STATE.ALERT:"pveproxy"}=0 to silence a single service.'
+        - macro: '{$PVE.SUBSCRIPTION.EXPIRE.DAYS}'
+          value: 30d
+          description: 'Lead time before the subscription expires. Must include a time unit, for example 30d. The expiry triggers need no enable macro: hosts without a subscription report no due date, so the item stays empty.'
         - macro: '{$PVE.SUBSCRIPTION.ALERT}'
           value: '0'
           description: 'Set to 1 on hosts that are meant to carry a subscription. Off by default so community hosts do not alert on status notfound.'
@@ -5474,11 +5508,29 @@ zabbix_export:
       status: DISABLED
       description: 'Disabled by default, like the item it depends on. The master item needs Sys.Modify, which PVEAuditor does not grant.'
       manual_close: 'YES'
+    - uuid: 7350199fa4884df6bf61d5797c37cf4a
+      expression: 'last(/Template Proxmox VE REST API/pve.subscription.nextduedate.epoch)<now()'
+      name: 'PVE subscription has expired on {HOST.NAME}'
+      opdata: 'Expired on: {ITEM.LASTVALUE1}'
+      priority: AVERAGE
+      description: 'The subscription period has ended. Access to the enterprise repository is gone, updates from it will fail. Needs no enable macro: without a subscription PVE does not report a due date, so the item stays empty and this trigger cannot fire on community hosts.'
+    - uuid: 3e3366874a4d4191a88632af4344bcce
+      expression: 'last(/Template Proxmox VE REST API/pve.subscription.nextduedate.epoch)-now()<{$PVE.SUBSCRIPTION.EXPIRE.DAYS}'
+      name: 'PVE subscription expires in less than {$PVE.SUBSCRIPTION.EXPIRE.DAYS} on {HOST.NAME}'
+      opdata: 'Expires on: {ITEM.LASTVALUE1}'
+      priority: WARNING
+      description: 'Advance warning before the subscription runs out, so it can be renewed in time. Depends on the expired trigger, so only one of the two is open at a time.'
+      dependencies:
+        - name: 'PVE subscription has expired on {HOST.NAME}'
+          expression: 'last(/Template Proxmox VE REST API/pve.subscription.nextduedate.epoch)<now()'
     - uuid: 57b2f7fad21f4672874712a66208931a
       expression: 'last(/Template Proxmox VE REST API/pve.subscription.status)<>"active" and {$PVE.SUBSCRIPTION.ALERT}=1'
       name: 'PVE subscription is not active on {HOST.NAME} ({ITEM.LASTVALUE})'
       priority: WARNING
-      description: 'Status is notfound, invalid, expired or suspended. Disabled by default, set {$PVE.SUBSCRIPTION.ALERT}=1 on hosts that carry a subscription.'
+      description: 'Status is notfound, invalid, expired or suspended. Off by default, set {$PVE.SUBSCRIPTION.ALERT}=1 on hosts that are meant to carry a subscription. Depends on the expired trigger so a lapsed subscription raises one problem, not two.'
+      dependencies:
+        - name: 'PVE subscription has expired on {HOST.NAME}'
+          expression: 'last(/Template Proxmox VE REST API/pve.subscription.nextduedate.epoch)<now()'
   graphs:
     - uuid: bbdef5c2775146b4ad30ac91ad877624
       name: 'Load average'