These five rules define how observations become topology rather than merely describing implementation details.
1. One logical vhost per domain
The conventional TLS server block and its port-80 redirect twin merge when they share a primary server_name. Listen ports, upstreams, server names, TLS state, certificate path, root, and gate state are combined. A redirect-only block listing several domains does not donate those names to a neighbouring vhost.
False positive prevented: one real domain appearing as duplicate rows and receiving duplicate defect reports, or an unrelated sibling acquiring names from a shared redirect block.
2. A gate means edge-enforced authentication
A vhost is configured as gated when nginx contains an Authelia auth_request, an authelia-authrequest include, a server-level authelia-location include, or auth_basic with a real realm. auth_basic off is explicitly not a gate. Location-level gate state is also retained on each upstream.
False positive prevented: reporting an HTTP Basic protected surface as unexpectedly open, or treating an explicit auth_basic off as protection and raising a reverse GATE_MISMATCH.
3. --only cannot judge the whole host
--only <substr> keeps vhosts whose server_name contains the substring, then limits probes and vhost verdicts to that subset. Rules that require the complete registry, listener, vhost, or unit view are removed from a scoped result:
DEAD_UPSTREAMCONVENTION_VIOLATIONPORT_COLLISIONUNREGISTERED_PORTREGISTRY_ORPHANWORLD_EXPOSEDUNIT_FAILED
False positive prevented: a deliberately omitted vhost making a registered listener look orphaned or dead, and an unrelated failed unit or exposed listener appearing to describe the selected hostname.
4. IP server names carry no SNI
The TLS probe connects to the local edge but omits options.servername when the vhost name is an IP literal. Node does not accept an IP as SNI. The probe still checks the presented certificate against the IP address.
False positive prevented: classifying Node’s invalid-IP SNI behavior as a transport-level TLS_ERROR; the truthful outcome for a reachable edge serving a certificate that does not cover the IP is CERT_MISMATCH.
5. Unit state is judged, not counted
System and user service units retain both systemd columns. A unit produces UNIT_FAILED when either ACTIVE or SUB equals failed; an inventory total alone is not a health signal.
False positive prevented: declaring the service inventory healthy because one column or the aggregate count looks normal while the other state column records failure.