A compact, non-exhaustive reference for the values that appear across the notes. Prefer the linked source for the authoritative rule; these tables are memory aids.

HTTP status and cache freshness

CodeMeaningUsed for
200 OKThe request succeeded; response content depends on the method (HEAD has none)baseline for a healthy route
301 Moved PermanentlyThe URI changed permanentlydeciding between the old and new URI in logs
308 Permanent RedirectA permanent redirect preserves the request method, including GET and HEADthe redirects note
206 Partial ContentA range request was honoredthe range-requests note
304 / 412304 permits conditional GET/HEAD reuse; 412 reports a failed preconditionthe conditional-requests note
404Not foundmissing-route checks; a custom error page must keep the correct status
500 / 502 / 503Unexpected server error / invalid upstream response / temporary unavailabilityrelease smoke tests and restart loops
Directive or headerEffect
Cache-Control: public, max-age=31536000, immutableshared-cache storage and a long freshness lifetime for content-hashed assets; immutable applies while fresh
Cache-Control: private, max-age=300 plus ETagprivate-cache freshness for 300 seconds; ETag enables revalidation, while shared caches must not store it
Cache-Control: no-storeinstructs caches not to store this exchange; not a retroactive purge or a privacy guarantee
ETag / If-None-Match leading to 304GET/HEAD revalidation uses weak comparison; 304 has no body and does not prove byte identity
Last-Modified / If-Modified-Sincetimestamp-based validation, usually weak; ignored when If-None-Match is also sent

See also: cache headers, conditional requests, compression, method semantics.

Security headers at the public edge

HeaderA short version of the policy
Content-Security-Policydefault-src 'self'; script-src 'none' blocks script execution under this policy in supporting browsers
Strict-Transport-Securitymax-age=31536000; includeSubDomains stores a one-year HTTPS policy for the host and its descendants after valid HTTPS receipt
X-Content-Type-Optionsnosniff rejects script/style loads with missing or unsuitable MIME types
X-Frame-OptionsDENY prevents framing
Referrer-Policystrict-origin-when-cross-origin limits referrers
Set-CookieSecure; HttpOnly; SameSite=Lax explicitly restricts transport, script access, and cross-site sending; Domain and Path remain separate

These are policy examples, not universal defaults or a current edge measurement. HSTS cannot protect an unknown host on its first HTTP visit without prior policy (such as preload). Prepare HTTPS on every covered descendant before enabling includeSubDomains; removing the header does not erase cached policy. Cookie attributes do not create a host/path boundary or replace CSRF defenses.

See also: security headers, HSTS rollout, cookie scope, content type.

DNS and TLS checks

Record or checkWhat it answers
A / AAAAwhich address the name resolves to
CNAMEwhich canonical name the alias follows
CAAwhich CAs the effective policy authorizes at issuance time; not a TLS trust check
TTLordinary cache freshness; lower at least one old TTL before a change, since existing cached answers keep their old lifetime

TTL is not a universal cutover deadline: stale-answer policies, application caches, and existing connections can outlast it. Keep both endpoints working through the observation window. The examples below are inspection recipes, not fresh measurements; use only authorized targets.

# where a name resolves, and for how long
dig +nocmd +noall +answer +ttl example.com A

# print the first (leaf) certificate's dates and issuer; not chain validation
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null | openssl x509 -noout -dates -issuer

The answer-only dig display hides DNS status and authority details; an empty display alone does not diagnose failure. In the OpenSSL pipeline, x509 reads the first certificate, so -showcerts does not make the final output a full chain. SNI selects the host but does not verify its name or trust. The pipeline discards s_client diagnostics and, without a pipeline-failure option, its final status can hide an earlier failure. Retain diagnostics and perform separate hostname/trust checks with an appropriate timeout; this inspection pipeline has no explicit network deadline.

See also: CAA records, DNS change window, certificate chain, expiry check.

Caddy and release smoke tests

StepCheck
Buildone complete artifact directory per release
Manifestevery published byte named with a checksum
Publishswitch the served directory only after verification; keep the previous one
Edgerequest a page, a file, and a missing path; compare status codes and content types
TLStest the HTTP-to-HTTPS redirect and the certificate name on the public hostname

The helpers are downloadable from resources and stored in the repository under static/downloads/. The bare names below assume the reviewed scripts are executable and on PATH; otherwise invoke a reviewed local copy with sh. Replace <file> with a real, quoted filename before use; the angle brackets are notation, not literal shell syntax.

# per file
sha256sum <file>

# plain-text checks from the operator kit
check-http-headers.sh https://www.xbcatm.com/
check-tls-expiry.sh www.xbcatm.com 30

The HTTP helper performs GET, follows redirects (possibly to other hosts), discards the body, and has a 20-second transfer limit. Check its printed status and final URL: HTTP 4xx/5xx alone do not make it fail. The TLS helper checks the leaf’s notAfter against the requested interval; it does not validate notBefore, hostname, chain trust, or revocation, and needs a separate job timeout. Neither helper compares published body bytes. These network examples have not been executed for this reference review.

See also: static root, release checklist, read the edge, atomic switch, release manifest, resources.

Sources