Read the public edge in two commands

Mon, 24 Aug 2026 00:00:00 +0000

A deployment is complete when the public edge agrees with the files you chose, not when the last upload command exits zero. Two read-only helpers from the operator kit make that agreement visible from any machine that can reach the host.

Inspect the response headers

check-http-headers.sh fetches one URL and prints the response line, the headers, and the final URL after redirects:

check-http-headers.sh https://www.xbcatm.com/

A recent read against this site produced:

HTTP/2 200
accept-ranges: bytes
content-security-policy: default-src 'self'; base-uri 'self'; form-action 'none'; frame-ancestors 'none'; object-src 'none'; script-src 'none'; style-src 'self'; img-src 'self' data:
content-type: text/html; charset=utf-8
last-modified: Mon, 24 Aug 2026 11:20:54 GMT
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), microphone=(), payment=(), usb=()
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: DENY

HTTP_STATUS 200
FINAL_URL https://www.xbcatm.com/

Two lines matter immediately: a 200 status with a FINAL_URL that matches the host you intended, and a Content-Security-Policy that still says script-src 'none'. If any of those differ from the policy you believe is live, the edge is not the tree you staged.

Inspect the certificate

check-tls-expiry.sh HOST [DAYS] reads the public certificate for the hostname and enforces a minimum validity window:

check-tls-expiry.sh www.xbcatm.com 30

A recent read printed:

subject=CN=www.xbcatm.com
issuer=C=US, O=Let's Encrypt, CN=YE1
notBefore=Aug 21 08:37:13 2026 GMT
notAfter=Nov 19 08:37:12 2026 GMT

certificate remains valid for at least 30 day(s)

Notice the subject is the exact hostname, not a wildcard from an adjacent site. notAfter is a concrete date; if it is closer than the window you passed, the helper exits non-zero and your release check can treat that as a failing condition.

Use both around a release

Once before and once after you swap directories:

Before: record last-modified, the CSP, and the certificate dates as your baseline.
Deploy the staged tree.
After: run the same two commands and compare last-modified and the checksums.

The two outputs together are a small but complete contract: the certificate is current, the policy is intact, and the bytes changing at the edge match what you published. That is the evidence a release claim is allowed to be.

Sources

Caddy Automatic HTTPS, automatic TLS certificate management, checked 2026-08-24.
MDN: Content Security Policy guide, CSP directive names and syntax, checked 2026-08-24.
OpenSSL s_client documentation, SNI and certificate inspection options, checked 2026-08-24.

Https · XB Field Notes

Read the public edge in two commands

Inspect the response headers

Inspect the certificate

Use both around a release

Sources