Firewall state, listening ports, TLS expiry, and recent SSH auth events.
host firewall configured declaratively
Loopback listeners are shown but not treated as public exposure.
Renew with cloud server:ssl:renew <domain>.