one verdict for a web domain, thirteen checks in parallel
probe-webserver answers one question about a web domain: is anything
wrong with it right now. Thirteen checks -- the A and AAAA records and the
address answering on 443, the permanent redirect off port 80, the
certificate served and its chain against the system trust store, TLS 1.2
and TLS 1.3, the Strict-Transport-Security policy, DANE/TLSA and the
DNSKEY and DS without which a TLSA proves nothing, CAA read against the
authority that really issued, the AAAA serving the same
certificate as the A, the alias names, OCSP stapling, the security
headers and the cipher suites negotiated -- run in parallel, each under
its own deadline, so the probe costs the slowest check and not their sum.

The default output follows the reed-alert probe contract: silence and rc
0 when everything holds, rc 1 and a single summary line on stderr naming
the failing checks, rc 2 when the probe itself could not do its work.
With -f json the same run is printed as one JSON object, the summary
line staying on stderr so an alerting daemon keeps working either way.
With -f text every check is listed with its verdict and its detail, for
someone reading at a terminal rather than a daemon.

The configuration comes from the file -c names, else from
/etc/probe-webserver/<domain>.conf, else from
/etc/probe-webserver.conf: one command watches domains that do not
hold the same policy. It reads that file and nothing else: no cache,
no state directory, no privilege. Nothing is written to the network
beyond the HEAD requests the headers are read from.

Maintainer: Jean-Gerard Pailloncy <j-g@pailloncy.com>
