isitup-cli 0.1.4__tar.gz → 0.2.0__tar.gz

{isitup_cli-0.1.4 → isitup_cli-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: isitup-cli
-Version: 0.1.4
+Version: 0.2.0
 Summary: A small CLI that periodically checks whether servers respond to ping, HTTP, and TCP ports
 Author: stefan.insam
 Author-email: stefan.insam <stefan.insam@netgo.de>
@@ -37,7 +37,7 @@ Description-Content-Type: text/markdown
 ---
 
 **isitup** is a small CLI that periodically checks whether servers respond to ping and,
-depending on how the target is written, HTTP or a TCP port:
+depending on how the target is written, HTTP, a TCP port, or SSH:
 
 | Target | Checks |
 | --- | --- |
@@ -45,14 +45,15 @@ depending on how the target is written, HTTP or a TCP port:
 | `example.com:1337` | ping + TCP connect to port 1337 |
 | `http://example.com` / `https://example.com` | ping + HTTP (catching a 500, a DNS failure, an expired TLS certificate, a redirect loop, etc.) |
 | `https://example.com:1337` | ping + HTTP, against that port |
+| `ssh://example.com` / `ssh://example.com:1337` | ping + SSH (connects and verifies the server's SSH identification banner; defaults to port 22) |
 
-Ping is checked independently from the HTTP/TCP probe: many hosts (behind
+Ping is checked independently from the HTTP/TCP/SSH probe: many hosts (behind
 load balancers, CDNs, or firewalls) drop ICMP but serve their actual service
 just fine, so a blocked ping alone doesn't mark a target down: the "Status"
-column is based on the probe (HTTP or TCP), with ping shown alongside as
-extra diagnostic info. A target only shows as `OFFLINE` when both ping and
-the probe fail; a ping-only target's status is based on ping alone, since
-there's nothing else to check.
+column is based on the probe, with ping shown alongside as extra diagnostic
+info. A target only shows as `OFFLINE` when both ping and the probe fail; a
+ping-only target's status is based on ping alone, since there's nothing else
+to check.
 
 If the same host appears more than once (e.g. `example.com` and
 `https://example.com/health`), it's only pinged once per round. The ping
@@ -64,8 +65,9 @@ updates in place (via [`rich`](https://github.com/Textualize/rich)) rather
 than reprinting on every round.
 
 Each target also keeps a rolling window of its last 20 response times for
-the session (HTTP response time or TCP connect time, whichever applies),
-shown as Min/Max latency columns and a tiny sparkline ("Trend"), along with
+the session (HTTP response time, TCP connect time, or SSH connect+banner
+time, whichever applies), shown as Min/Max latency columns and a tiny
+sparkline ("Trend"), along with
 the last time it was seen online and the last time it was seen offline.
 This history is in-memory only and resets each time you start the tool.
 
@@ -128,6 +130,11 @@ what's in the file).
 | `--ping-timeout SECONDS` | ping reply timeout (default: 2) |
 | `--http-timeout SECONDS` | timeout for the HTTP request or TCP connect (default: 5) |
 | `--no-ping` | skip ICMP entirely, HTTP/TCP-only checks |
+| `--columns LIST` | comma-separated list of table columns to show, in order (interactive UI only; `--plain`/`--json` always include every field) — see below |
+| `--basic-auth USER:PASS` | HTTP Basic Auth for CLI-supplied HTTP targets that don't set their own `basic_auth:` in the config file — see below |
+| `--basic-auth-env USER_VAR:PASS_VAR` | same as `--basic-auth`, but reads the username/password from the named environment variables |
+| `--tag TAG` | tag applied to CLI-supplied targets (repeatable) — see below |
+| `--filter-tag TAG` | only monitor targets carrying at least one of the given tags (repeatable) — see below |
 | `--once` | run a single round and exit; exit code is `1` if any target is down, `0` otherwise. Useful as a cron/CI health gate |
 | `--plain` | print one plain-text line per target per round instead of the live UI (for logging/piping) |
 | `--json` | print one JSON object per target per round instead of the live UI (for machine consumption) |
@@ -147,9 +154,124 @@ for it in the config file, or pass `--no-ping` to disable ICMP checks
 globally. Note that a ping-only target (bare hostname, no port) can't have
 `ping: false`, there would be nothing left to check.
 
+### SSH availability check
+
+`ssh://example.com` (or `ssh://example.com:1234` for a non-standard port,
+default 22) connects over TCP and reads the server's SSH identification
+banner (the string like `SSH-2.0-OpenSSH_9.6` that a compliant server sends
+before any client input, per RFC 4253) rather than just checking whether
+the port is open. If the port is open but the banner doesn't start with
+`SSH-`, the target is reported down with `error_kind: protocol` — this
+catches something else listening on the port. No SSH handshake, key
+exchange, or authentication is attempted, so no credentials are needed or
+used.
+
+### Customizing table columns
+
+The interactive table shows all of `target`, `status`, `ping`, `service`,
+`latency`, `min`, `max`, `trend`, `last_online`, `last_offline`, `detail`,
+`checked` by default, in that order. A few more are available but not
+shown by default — `tags` (see above) and the HTTP header columns
+`content_length`, `last_modified`, `etag`, `content_type`, `server`,
+`header_change` (see below). To show a different subset (or reorder
+them), pass `--columns` with a comma-separated list:
+
+```bash
+isitup --columns target,status,detail --url https://example.com
+```
+
+Or set it once in the config file:
+
+```yaml
+columns: [target, status, service, latency, detail]
+```
+
+`--columns` takes precedence over a config file's `columns:` list, which
+takes precedence over the default. This only affects the interactive UI —
+`--plain` and `--json` always include every field, since they're meant for
+machine consumption.
+
+### HTTP Basic Auth
+
+Set `basic_auth` on a config file target to send an `Authorization` header
+with its HTTP requests. Each of `username`/`password` can be given either
+literally or via a `*_env` reference to an environment variable (but not
+both):
+
+```yaml
+targets:
+  - name: Protected API
+    url: https://api.internal.example.com
+    basic_auth:
+      username: admin
+      password_env: API_PASSWORD   # read from $API_PASSWORD at startup
+```
+
+`basic_auth` only applies to `http://`/`https://` targets — it's rejected
+on a bare hostname or `hostname:port` target.
+
+For targets passed directly on the command line (positional or `--url`),
+use `--basic-auth USER:PASS` or `--basic-auth-env USER_VAR:PASS_VAR`
+instead. Either flag applies to every CLI-supplied HTTP target in that
+invocation, but never to config-file targets — those always use their own
+`basic_auth:` (or none), so the two never mix unexpectedly:
+
+```bash
+isitup --basic-auth-env API_USER:API_PASSWORD --url https://api.internal.example.com
+```
+
+### HTTP header/metadata tracking
+
+For HTTP(S) targets, a handful of response headers are captured every
+round — `Content-Length` (response size), `Last-Modified`, `ETag`,
+`Content-Type`, and `Server` — without ever touching the response body
+itself. `--plain`/`--json` always include them (nested under `http` in
+JSON, as `content_length=`/`last_modified=`/etc. fields in `--plain`),
+alongside a `last_header_change`/`header_change` timestamp: the last time
+any of those five values actually differed from the previous round (not
+set on the very first check, since there's nothing yet to compare against).
+This is handy for noticing "something on this page changed" without
+diffing the body yourself.
+
+In the interactive table these show up as the `content_length`,
+`last_modified`, `etag`, `content_type`, `server`, and `header_change`
+columns — available via `--columns`/config `columns:`, but not part of the
+default set (see above), so the table's default look is unaffected.
+
+### Tagging and grouping
+
+Any target (ping-only, TCP, or HTTP) can carry `tags` in the config file:
+
+```yaml
+targets:
+  - name: Prod Website
+    url: https://example.com
+    tags: [prod, web]
+  - name: Staging Website
+    url: https://staging.example.com
+    tags: [staging, web]
+```
+
+Tags show up as their own `Tags` table column — add it with `--columns
+target,tags,status,...` (or a config `columns:` list), since it isn't in
+the default set — and always as a `tags` field in `--plain`/`--json`
+output.
+
+To only monitor a subset, pass `--filter-tag` (repeatable — a target
+matches if it has *any* of the given tags):
+
+```bash
+isitup --config config.yaml --filter-tag prod
+```
+
+With no `--filter-tag` given, every target is monitored, same as today.
+For targets passed directly on the command line, `--tag TAG` (repeatable)
+tags every CLI-supplied target in that invocation — like `--basic-auth`,
+it never touches config-file targets, which set their own `tags:` instead.
+
 ### Failure classification
 
-When the HTTP or TCP probe fails, the specific reason is captured as
+When the HTTP, TCP, or SSH probe fails, the specific reason is captured as
 `error_kind` (visible in `--json` output, and shown as a short tag like
 `DOWN (DNS)` in the Service column otherwise):
 
@@ -160,6 +282,7 @@ When the HTTP or TCP probe fails, the specific reason is captured as
 | `redirect` | too many redirects (HTTP only, possible redirect loop) |
 | `timeout` | didn't complete within `--http-timeout` |
 | `connection` | connection refused or otherwise unreachable |
+| `protocol` | connected, but the server's response wasn't a valid SSH banner (SSH only) |
 | `client_error` / `server_error` | got a 4xx / 5xx HTTP response |
 | `request_error` | anything else `requests` raised |
 

{isitup_cli-0.1.4 → isitup_cli-0.2.0}/README.md

@@ -16,7 +16,7 @@
 ---
 
 **isitup** is a small CLI that periodically checks whether servers respond to ping and,
-depending on how the target is written, HTTP or a TCP port:
+depending on how the target is written, HTTP, a TCP port, or SSH:
 
 | Target | Checks |
 | --- | --- |
@@ -24,14 +24,15 @@ depending on how the target is written, HTTP or a TCP port:
 | `example.com:1337` | ping + TCP connect to port 1337 |
 | `http://example.com` / `https://example.com` | ping + HTTP (catching a 500, a DNS failure, an expired TLS certificate, a redirect loop, etc.) |
 | `https://example.com:1337` | ping + HTTP, against that port |
+| `ssh://example.com` / `ssh://example.com:1337` | ping + SSH (connects and verifies the server's SSH identification banner; defaults to port 22) |
 
-Ping is checked independently from the HTTP/TCP probe: many hosts (behind
+Ping is checked independently from the HTTP/TCP/SSH probe: many hosts (behind
 load balancers, CDNs, or firewalls) drop ICMP but serve their actual service
 just fine, so a blocked ping alone doesn't mark a target down: the "Status"
-column is based on the probe (HTTP or TCP), with ping shown alongside as
-extra diagnostic info. A target only shows as `OFFLINE` when both ping and
-the probe fail; a ping-only target's status is based on ping alone, since
-there's nothing else to check.
+column is based on the probe, with ping shown alongside as extra diagnostic
+info. A target only shows as `OFFLINE` when both ping and the probe fail; a
+ping-only target's status is based on ping alone, since there's nothing else
+to check.
 
 If the same host appears more than once (e.g. `example.com` and
 `https://example.com/health`), it's only pinged once per round. The ping
@@ -43,8 +44,9 @@ updates in place (via [`rich`](https://github.com/Textualize/rich)) rather
 than reprinting on every round.
 
 Each target also keeps a rolling window of its last 20 response times for
-the session (HTTP response time or TCP connect time, whichever applies),
-shown as Min/Max latency columns and a tiny sparkline ("Trend"), along with
+the session (HTTP response time, TCP connect time, or SSH connect+banner
+time, whichever applies), shown as Min/Max latency columns and a tiny
+sparkline ("Trend"), along with
 the last time it was seen online and the last time it was seen offline.
 This history is in-memory only and resets each time you start the tool.
 
@@ -107,6 +109,11 @@ what's in the file).
 | `--ping-timeout SECONDS` | ping reply timeout (default: 2) |
 | `--http-timeout SECONDS` | timeout for the HTTP request or TCP connect (default: 5) |
 | `--no-ping` | skip ICMP entirely, HTTP/TCP-only checks |
+| `--columns LIST` | comma-separated list of table columns to show, in order (interactive UI only; `--plain`/`--json` always include every field) — see below |
+| `--basic-auth USER:PASS` | HTTP Basic Auth for CLI-supplied HTTP targets that don't set their own `basic_auth:` in the config file — see below |
+| `--basic-auth-env USER_VAR:PASS_VAR` | same as `--basic-auth`, but reads the username/password from the named environment variables |
+| `--tag TAG` | tag applied to CLI-supplied targets (repeatable) — see below |
+| `--filter-tag TAG` | only monitor targets carrying at least one of the given tags (repeatable) — see below |
 | `--once` | run a single round and exit; exit code is `1` if any target is down, `0` otherwise. Useful as a cron/CI health gate |
 | `--plain` | print one plain-text line per target per round instead of the live UI (for logging/piping) |
 | `--json` | print one JSON object per target per round instead of the live UI (for machine consumption) |
@@ -126,9 +133,124 @@ for it in the config file, or pass `--no-ping` to disable ICMP checks
 globally. Note that a ping-only target (bare hostname, no port) can't have
 `ping: false`, there would be nothing left to check.
 
+### SSH availability check
+
+`ssh://example.com` (or `ssh://example.com:1234` for a non-standard port,
+default 22) connects over TCP and reads the server's SSH identification
+banner (the string like `SSH-2.0-OpenSSH_9.6` that a compliant server sends
+before any client input, per RFC 4253) rather than just checking whether
+the port is open. If the port is open but the banner doesn't start with
+`SSH-`, the target is reported down with `error_kind: protocol` — this
+catches something else listening on the port. No SSH handshake, key
+exchange, or authentication is attempted, so no credentials are needed or
+used.
+
+### Customizing table columns
+
+The interactive table shows all of `target`, `status`, `ping`, `service`,
+`latency`, `min`, `max`, `trend`, `last_online`, `last_offline`, `detail`,
+`checked` by default, in that order. A few more are available but not
+shown by default — `tags` (see above) and the HTTP header columns
+`content_length`, `last_modified`, `etag`, `content_type`, `server`,
+`header_change` (see below). To show a different subset (or reorder
+them), pass `--columns` with a comma-separated list:
+
+```bash
+isitup --columns target,status,detail --url https://example.com
+```
+
+Or set it once in the config file:
+
+```yaml
+columns: [target, status, service, latency, detail]
+```
+
+`--columns` takes precedence over a config file's `columns:` list, which
+takes precedence over the default. This only affects the interactive UI —
+`--plain` and `--json` always include every field, since they're meant for
+machine consumption.
+
+### HTTP Basic Auth
+
+Set `basic_auth` on a config file target to send an `Authorization` header
+with its HTTP requests. Each of `username`/`password` can be given either
+literally or via a `*_env` reference to an environment variable (but not
+both):
+
+```yaml
+targets:
+  - name: Protected API
+    url: https://api.internal.example.com
+    basic_auth:
+      username: admin
+      password_env: API_PASSWORD   # read from $API_PASSWORD at startup
+```
+
+`basic_auth` only applies to `http://`/`https://` targets — it's rejected
+on a bare hostname or `hostname:port` target.
+
+For targets passed directly on the command line (positional or `--url`),
+use `--basic-auth USER:PASS` or `--basic-auth-env USER_VAR:PASS_VAR`
+instead. Either flag applies to every CLI-supplied HTTP target in that
+invocation, but never to config-file targets — those always use their own
+`basic_auth:` (or none), so the two never mix unexpectedly:
+
+```bash
+isitup --basic-auth-env API_USER:API_PASSWORD --url https://api.internal.example.com
+```
+
+### HTTP header/metadata tracking
+
+For HTTP(S) targets, a handful of response headers are captured every
+round — `Content-Length` (response size), `Last-Modified`, `ETag`,
+`Content-Type`, and `Server` — without ever touching the response body
+itself. `--plain`/`--json` always include them (nested under `http` in
+JSON, as `content_length=`/`last_modified=`/etc. fields in `--plain`),
+alongside a `last_header_change`/`header_change` timestamp: the last time
+any of those five values actually differed from the previous round (not
+set on the very first check, since there's nothing yet to compare against).
+This is handy for noticing "something on this page changed" without
+diffing the body yourself.
+
+In the interactive table these show up as the `content_length`,
+`last_modified`, `etag`, `content_type`, `server`, and `header_change`
+columns — available via `--columns`/config `columns:`, but not part of the
+default set (see above), so the table's default look is unaffected.
+
+### Tagging and grouping
+
+Any target (ping-only, TCP, or HTTP) can carry `tags` in the config file:
+
+```yaml
+targets:
+  - name: Prod Website
+    url: https://example.com
+    tags: [prod, web]
+  - name: Staging Website
+    url: https://staging.example.com
+    tags: [staging, web]
+```
+
+Tags show up as their own `Tags` table column — add it with `--columns
+target,tags,status,...` (or a config `columns:` list), since it isn't in
+the default set — and always as a `tags` field in `--plain`/`--json`
+output.
+
+To only monitor a subset, pass `--filter-tag` (repeatable — a target
+matches if it has *any* of the given tags):
+
+```bash
+isitup --config config.yaml --filter-tag prod
+```
+
+With no `--filter-tag` given, every target is monitored, same as today.
+For targets passed directly on the command line, `--tag TAG` (repeatable)
+tags every CLI-supplied target in that invocation — like `--basic-auth`,
+it never touches config-file targets, which set their own `tags:` instead.
+
 ### Failure classification
 
-When the HTTP or TCP probe fails, the specific reason is captured as
+When the HTTP, TCP, or SSH probe fails, the specific reason is captured as
 `error_kind` (visible in `--json` output, and shown as a short tag like
 `DOWN (DNS)` in the Service column otherwise):
 
@@ -139,6 +261,7 @@ When the HTTP or TCP probe fails, the specific reason is captured as
 | `redirect` | too many redirects (HTTP only, possible redirect loop) |
 | `timeout` | didn't complete within `--http-timeout` |
 | `connection` | connection refused or otherwise unreachable |
+| `protocol` | connected, but the server's response wasn't a valid SSH banner (SSH only) |
 | `client_error` / `server_error` | got a 4xx / 5xx HTTP response |
 | `request_error` | anything else `requests` raised |
 

{isitup_cli-0.1.4 → isitup_cli-0.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "isitup-cli"
-version = "0.1.4"
+version = "0.2.0"
 description = "A small CLI that periodically checks whether servers respond to ping, HTTP, and TCP ports"
 readme = "README.md"
 license = "GPL-3.0-only"

{isitup_cli-0.1.4 → isitup_cli-0.2.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "isitup-cli"
-version = "0.1.4"
+version = "0.2.0"
 description = "A small CLI that periodically checks whether servers respond to ping, HTTP, and TCP ports"
 readme = "README.md"
 license = "GPL-3.0-only"

{isitup_cli-0.1.4 → isitup_cli-0.2.0}/src/isitup/checks.py

@@ -26,6 +26,19 @@ class Status(StrEnum):
     UNKNOWN = "unknown"
 
 
+# Response headers tracked for HTTP targets (metadata only — the body itself
+# is never hashed/diffed). Maps our field name to the actual header name.
+HTTP_HEADER_NAMES = {
+    "content_length": "Content-Length",
+    "last_modified": "Last-Modified",
+    "etag": "ETag",
+    "content_type": "Content-Type",
+    "server": "Server",
+}
+HTTP_HEADER_FIELDS = tuple(HTTP_HEADER_NAMES)
+HttpHeaders = dict[str, str | None]
+
+
 @dataclass
 class CheckResult:
     target: Target
@@ -39,17 +52,32 @@ class CheckResult:
     error_kind: ErrorKind
     detail: str
     checked_at: float
+    ssh_status: Status | None = None  # set only when target.kind is SSH
+    ssh_latency_ms: float | None = None
+    ssh_banner: str | None = None
+    http_headers: HttpHeaders | None = None  # set only on a successful HTTP response
 
     @property
     def latency_ms(self) -> float | None:
         """Whichever probe latency applies to this target's kind (HTTP
-        response time, TCP connect time, or None for a ping-only target)."""
+        response time, TCP connect time, SSH connect+banner time, or None
+        for a ping-only target)."""
         if self.target.kind == TargetKind.HTTP:
             return self.http_latency_ms
         if self.target.kind == TargetKind.TCP_PORT:
             return self.tcp_latency_ms
+        if self.target.kind == TargetKind.SSH:
+            return self.ssh_latency_ms
         return None
 
+    @property
+    def effective_latency_ms(self) -> float | None:
+        """`latency_ms`, falling back to ping latency when the probe didn't
+        produce one — e.g. it timed out/failed, or there's no probe at all
+        (ping-only target) — so a struggling or unreachable target still
+        shows a latency signal instead of a blank dash."""
+        return self.latency_ms if self.latency_ms is not None else self.ping_latency_ms
+
 
 def ping_once(host: str, timeout_s: float = 2.0) -> tuple[bool, float | None]:
     """Send a single ICMP echo request using the OS ping binary. Returns (reachable, latency_ms)."""
@@ -112,29 +140,36 @@ def _caused_by(exc: BaseException, cls: type[BaseException]) -> bool:
     return False
 
 
-def http_check(url: str, timeout_s: float = 5.0) -> tuple[Status, int | None, float | None, ErrorKind, str]:
+def _extract_headers(response: requests.Response) -> HttpHeaders:
+    return {field: response.headers.get(name) for field, name in HTTP_HEADER_NAMES.items()}
+
+
+def http_check(
+    url: str, timeout_s: float = 5.0, auth: tuple[str, str] | None = None
+) -> tuple[Status, int | None, float | None, ErrorKind, str, HttpHeaders | None]:
     try:
-        response = requests.get(url, timeout=timeout_s, allow_redirects=True)
+        response = requests.get(url, timeout=timeout_s, allow_redirects=True, auth=auth)
     except requests.exceptions.SSLError as exc:
-        return Status.DOWN, None, None, "tls", f"TLS/certificate error: {exc}"
+        return Status.DOWN, None, None, "tls", f"TLS/certificate error: {exc}", None
     except requests.exceptions.TooManyRedirects:
-        return Status.DOWN, None, None, "redirect", "too many redirects (possible redirect loop)"
+        return Status.DOWN, None, None, "redirect", "too many redirects (possible redirect loop)", None
     except requests.exceptions.Timeout:
-        return Status.DOWN, None, None, "timeout", "request timed out"
+        return Status.DOWN, None, None, "timeout", "request timed out", None
     except requests.exceptions.ConnectionError as exc:
         if _caused_by(exc, socket.gaierror):
-            return Status.DOWN, None, None, "dns", "DNS resolution failed"
-        return Status.DOWN, None, None, "connection", "connection failed"
+            return Status.DOWN, None, None, "dns", "DNS resolution failed", None
+        return Status.DOWN, None, None, "connection", "connection failed", None
     except requests.exceptions.RequestException as exc:
-        return Status.DOWN, None, None, "request_error", str(exc)
+        return Status.DOWN, None, None, "request_error", str(exc), None
 
     latency_ms = response.elapsed.total_seconds() * 1000
     code = response.status_code
+    headers = _extract_headers(response)
     if code >= 500:
-        return Status.DOWN, code, latency_ms, "server_error", f"HTTP {code} server error"
+        return Status.DOWN, code, latency_ms, "server_error", f"HTTP {code} server error", headers
     if code >= 400:
-        return Status.WARN, code, latency_ms, "client_error", f"HTTP {code} client error"
-    return Status.OK, code, latency_ms, None, f"HTTP {code}"
+        return Status.WARN, code, latency_ms, "client_error", f"HTTP {code} client error", headers
+    return Status.OK, code, latency_ms, None, f"HTTP {code}", headers
 
 
 def tcp_check(
@@ -155,6 +190,39 @@ def tcp_check(
     return Status.OK, latency_ms, None, f"port {port} open"
 
 
+def ssh_check(
+    hostname: str, port: int, timeout_s: float = 5.0
+) -> tuple[Status, float | None, ErrorKind, str, str | None]:
+    """Connect and read the SSH identification string — a compliant server
+    sends this itself before any client input (RFC 4253 §4.2), so checking
+    it confirms an actual SSH service without needing a full handshake."""
+    start = time.monotonic()
+    try:
+        with socket.create_connection((hostname, port), timeout=timeout_s) as sock:
+            sock.settimeout(timeout_s)
+            raw_banner = sock.recv(256)
+    except TimeoutError:
+        return Status.DOWN, None, "timeout", f"connection to port {port} timed out", None
+    except socket.gaierror:
+        return Status.DOWN, None, "dns", "DNS resolution failed", None
+    except OSError as exc:
+        return (
+            Status.DOWN,
+            None,
+            "connection",
+            f"connection to port {port} failed: {exc.strerror or exc}",
+            None,
+        )
+
+    latency_ms = (time.monotonic() - start) * 1000
+    banner = raw_banner.decode("utf-8", errors="replace").strip("\r\n")
+
+    if not banner.startswith("SSH-"):
+        return Status.DOWN, latency_ms, "protocol", f"port {port} open, but no SSH banner", banner or None
+
+    return Status.OK, latency_ms, None, f"SSH banner: {banner}", banner
+
+
 def probe_target(
     target: Target,
     ping_status: Status,
@@ -167,24 +235,35 @@ def probe_target(
     already been done — see `run_pings` for why it's handled separately."""
     checked_at = time.time()
 
-    http_status = http_code = http_latency_ms = None
+    http_status = http_code = http_latency_ms = http_headers = None
     tcp_status = tcp_latency_ms = None
+    ssh_status = ssh_latency_ms = ssh_banner = None
     error_kind: ErrorKind = None
 
     if target.kind == TargetKind.HTTP:
         assert target.url is not None
         if on_phase:
             on_phase("http")
-        http_status, http_code, http_latency_ms, error_kind, detail = http_check(target.url, timeout_s)
+        http_status, http_code, http_latency_ms, error_kind, detail, http_headers = http_check(
+            target.url, timeout_s, auth=target.basic_auth
+        )
     elif target.kind == TargetKind.TCP_PORT:
         assert target.port is not None
         if on_phase:
             on_phase("tcp")
         tcp_status, tcp_latency_ms, error_kind, detail = tcp_check(target.hostname, target.port, timeout_s)
+    elif target.kind == TargetKind.SSH:
+        assert target.port is not None
+        if on_phase:
+            on_phase("ssh")
+        ssh_status, ssh_latency_ms, error_kind, detail, ssh_banner = ssh_check(
+            target.hostname, target.port, timeout_s
+        )
     else:
         detail = "ping-only target (no scheme or port given)"
 
-    if ping_status == Status.DOWN and (http_status == Status.DOWN or tcp_status == Status.DOWN):
+    probe_down = Status.DOWN in (http_status, tcp_status, ssh_status)
+    if ping_status == Status.DOWN and probe_down:
         detail = "host did not respond to ping, and " + detail
 
     return CheckResult(
@@ -199,4 +278,8 @@ def probe_target(
         error_kind=error_kind,
         detail=detail,
         checked_at=checked_at,
+        ssh_status=ssh_status,
+        ssh_latency_ms=ssh_latency_ms,
+        ssh_banner=ssh_banner,
+        http_headers=http_headers,
     )