{
  "summary" : {
    "total" : 9,
    "crit" : 1,
    "high" : 1,
    "warn" : 7,
    "now" : 7,
    "ssh-bound" : 2
  },
  "items" : [ {
    "sev" : "crit",
    "title" : "Boxes with no restore point",
    "detail" : "4 of 4 boxes have zero snapshots",
    "fix" : "take a snapshot now — one click on the Backups page",
    "stage" : "1 · backups",
    "gate" : "none"
  }, {
    "sev" : "high",
    "title" : "No offsite backup",
    "detail" : "every restore point is a same-DC image snapshot — a Contabo-account or DC loss takes them too",
    "fix" : "restic → object storage in a second failure domain, with a tested restore",
    "stage" : "1 · backups",
    "gate" : "SSH"
  }, {
    "title" : "box 173.212.203.211 · box 173.212.203.211",
    "detail" : "product price unknown — excluded from the fleet total",
    "sev" : "warn",
    "fix" : "read the Storage VPS line item from the invoice and add it to the price oracle",
    "stage" : "—",
    "gate" : "invoice"
  }, {
    "title" : "box 45.90.121.59 · box 45.90.121.59",
    "detail" : "product price unknown — excluded from the fleet total",
    "sev" : "warn",
    "fix" : "read the Storage VPS line item from the invoice and add it to the price oracle",
    "stage" : "—",
    "gate" : "invoice"
  }, {
    "title" : "box 149.102.137.139 · box 149.102.137.139",
    "detail" : "product price unknown — excluded from the fleet total",
    "sev" : "warn",
    "fix" : "read the Storage VPS line item from the invoice and add it to the price oracle",
    "stage" : "—",
    "gate" : "invoice"
  }, {
    "title" : "box 5.189.145.105 · box 5.189.145.105",
    "detail" : "product price unknown — excluded from the fleet total",
    "sev" : "warn",
    "fix" : "read the Storage VPS line item from the invoice and add it to the price oracle",
    "stage" : "—",
    "gate" : "invoice"
  }, {
    "sev" : "warn",
    "title" : "Cert name mismatch",
    "detail" : "39 host(s) present a cert for a different name (parked → default_server)",
    "fix" : "prune the DNS record or add the vhost; a wildcard fixes all at once",
    "stage" : "3 · correctness",
    "gate" : "DNS only"
  }, {
    "sev" : "warn",
    "title" : "hyperstitious.org → GitHub Pages → 404",
    "detail" : "www works, apex 404",
    "fix" : "point the apex at a real host or a working redirect",
    "stage" : "3 · correctness",
    "gate" : "DNS only"
  }, {
    "sev" : "warn",
    "title" : "Hosts with no TLS",
    "detail" : "4 host(s) answer without a cert (live)",
    "fix" : "provision a cert on the box",
    "stage" : "3 · correctness",
    "gate" : "SSH"
  } ]
}