feat: expose signed platform health status

deploy/server/health-monitor.sh

@@ -18,6 +18,8 @@ if [[ -f "$monitor_config" ]]; then
 fi
 alert_webhook_url=${ALERT_WEBHOOK_URL:-}
 alert_webhook_secret_file=${ALERT_WEBHOOK_SECRET_FILE:-/etc/data-terminal-cloud/monitor-webhook-secret}
+platform_health_report_url=${PLATFORM_HEALTH_REPORT_URL:-}
+platform_health_report_secret_file=${PLATFORM_HEALTH_REPORT_SECRET_FILE:-/etc/data-terminal-cloud/platform-health-callback-secret}
 if [[ -f "$offsite_config_file" ]]; then
   # shellcheck disable=SC1090
   source "$offsite_config_file"
@@ -232,14 +234,12 @@ PY
 chmod 0644 "$status_tmp"
 mv -f "$status_tmp" "$status_file"
 
-if [[ -n "$alert_webhook_url" && "$previous_status" != "$overall" ]]; then
-  if [[ ! -r "$alert_webhook_secret_file" ]]; then
-    record_check alert_delivery critical secret_missing
-    echo "Alert webhook is configured but its HMAC secret is unreadable" >&2
-    exit 5
-  fi
+post_signed_status() {
+  local target_url=$1
+  local secret_file=$2
+  local timestamp signature
   timestamp=$(date +%s)
-  signature=$(python3 - "$alert_webhook_secret_file" "$status_file" "$timestamp" <<'PY'
+  signature=$(python3 - "$secret_file" "$status_file" "$timestamp" <<'PY'
 import hashlib
 import hmac
 import sys
@@ -249,7 +249,7 @@ body = open(sys.argv[2], "rb").read()
 print(hmac.new(secret, sys.argv[3].encode() + b"." + body, hashlib.sha256).hexdigest())
 PY
 )
-  python3 - "$alert_webhook_url" "$curl_config" <<'PY'
+  python3 - "$target_url" "$curl_config" <<'PY'
 import sys
 
 url = sys.argv[1].replace("\\", "\\\\").replace('"', '\\"')
@@ -260,6 +260,23 @@ PY
     -H "X-Platform-Timestamp: $timestamp" \
     -H "X-Platform-Signature: sha256=$signature" \
     --data-binary "@$status_file" >/dev/null
+}
+
+if [[ -n "$platform_health_report_url" ]]; then
+  if [[ ! -r "$platform_health_report_secret_file" ]]; then
+    echo "Platform health reporting is configured but its HMAC secret is unreadable" >&2
+    exit 6
+  fi
+  post_signed_status "$platform_health_report_url" "$platform_health_report_secret_file"
+fi
+
+if [[ -n "$alert_webhook_url" && "$previous_status" != "$overall" ]]; then
+  if [[ ! -r "$alert_webhook_secret_file" ]]; then
+    record_check alert_delivery critical secret_missing
+    echo "Alert webhook is configured but its HMAC secret is unreadable" >&2
+    exit 5
+  fi
+  post_signed_status "$alert_webhook_url" "$alert_webhook_secret_file"
 fi
 
 printf 'platform_health status=%s critical=%s warning=%s status_file=%s\n' \