feat: monitor public listener exposure

deploy/server/health-monitor.sh

@@ -20,6 +20,7 @@ alert_webhook_url=${ALERT_WEBHOOK_URL:-}
 alert_webhook_secret_file=${ALERT_WEBHOOK_SECRET_FILE:-/etc/data-terminal-cloud/monitor-webhook-secret}
 platform_health_report_url=${PLATFORM_HEALTH_REPORT_URL:-}
 platform_health_report_secret_file=${PLATFORM_HEALTH_REPORT_SECRET_FILE:-/etc/data-terminal-cloud/platform-health-callback-secret}
+expected_public_tcp_ports=${EXPECTED_PUBLIC_TCP_PORTS:-22,80,443}
 if [[ -f "$offsite_config_file" ]]; then
   # shellcheck disable=SC1090
   source "$offsite_config_file"
@@ -36,6 +37,10 @@ if (( disk_warning_percent >= disk_critical_percent || disk_critical_percent > 1
   echo "Disk thresholds are invalid" >&2
   exit 2
 fi
+if [[ ! "$expected_public_tcp_ports" =~ ^[0-9]+(,[0-9]+)*$ ]]; then
+  echo "EXPECTED_PUBLIC_TCP_PORTS must contain comma-separated integers" >&2
+  exit 2
+fi
 
 compose=(docker compose -f "$project_root/compose.yaml" -f "$project_root/deploy/server/compose.override.yaml" --env-file "$project_root/deploy/server/.env")
 mkdir -p "$state_dir"
@@ -81,6 +86,20 @@ else
   record_check public_https critical request_failed
 fi
 
+if ! command -v ss >/dev/null 2>&1; then
+  record_check public_tcp_listeners critical probe_unavailable
+else
+  listener_evidence=$(ss -H -ltn | python3 "$project_root/deploy/server/public_listener_policy.py" "$expected_public_tcp_ports" 2>/dev/null || true)
+  IFS='|' read -r listener_status listener_detail <<<"$listener_evidence"
+  if [[ "$listener_status" == healthy ]]; then
+    record_check public_tcp_listeners healthy "$listener_detail"
+  elif [[ "$listener_status" == critical ]]; then
+    record_check public_tcp_listeners critical "$listener_detail"
+  else
+    record_check public_tcp_listeners critical invalid_probe_result
+  fi
+fi
+
 expected_issuer="$public_origin/realms/voice-local"
 if curl --fail --silent --show-error --max-time 10 \
   "$expected_issuer/.well-known/openid-configuration" -o "$oidc_tmp"; then