Whether SSH is locked down on every server in the fleet, on the public record — the same transparency-not-tamper-proof idea as the access ledger, one level down at the machines themselves. Each box answers about itself: it reads its own firewall, SSH config, auto-updates and admin tunnel. Boxes it can see are also probed from the outside — a connect-only check of whether port 22 answers from the mesh. That outside view is vantage-dependent, so it is deliberately cautious (below): only a box that actually answers with an SSH banner is called exposed. This is a mirror held up to the fleet, not a security control.

Last collected

How each box is judged — and what the probe can’t prove

🤖 The local read is authoritative; the outside probe is a hint. A box reports its own posture from its own OS: wireguard-only when port 22 is allowed only over the admin tunnel (wg0) and there is no bare public rule, internet-facing the moment a public port-22 rule exists. Those local reads are the truth for that box.

🤖 The peer :22 probe is vantage-dependent. One box connecting to another’s port 22 only sees the fleet from where it stands — a firewall might admit the probing box but deny everyone else. So the probe is read conservatively: only a returned SSH-… banner is a confident exposed; a clean refusal or timeout is not reachable; anything else that isn’t a clean refusal is inconclusive — shown as a warn state, never a pass. The definitive answer for any box is that box self-reading its own firewall once it runs the collector.

🤖 Unknown is loud. Any signal the collector can’t read — an unreadable firewall, a peer that hasn’t self-reported — renders as a bordered warn chip, never as a quiet green pass. And like the access ledger, this is transparency, not tamper-proof forensics: the box publishes its own report, and the bucket it publishes to is versioned so after-the-fact edits leave a history. No hostnames appear here — a box is named by the same whimsical label the fleet page shows.

Servers, most exposed first