Add service exposure policy and external access retest script

scripts/retest-external-access.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PRIVATE_ADMIN_HOSTS=(
+  gotify.lan.ddnsgeek.com
+  grafana.lan.ddnsgeek.com
+  prometheus.lan.ddnsgeek.com
+  node-red.lan.ddnsgeek.com
+  traefik.lan.ddnsgeek.com
+  portainer.lan.ddnsgeek.com
+  influxdb.lan.ddnsgeek.com
+  kuma.lan.ddnsgeek.com
+  monitor-kuma.lan.ddnsgeek.com
+  edge.lan.ddnsgeek.com
+)
+
+echo "[+] External retest started: $(date -u +'%Y-%m-%dT%H:%M:%SZ')"
+
+a11y_failures=0
+for host in "${PRIVATE_ADMIN_HOSTS[@]}"; do
+  code=$(curl -k -sS -o /dev/null -m 10 -w '%{http_code}' "https://${host}" || true)
+  if [[ "$code" == "000" || "$code" == "403" || "$code" == "401" ]]; then
+    echo "[PASS] ${host} blocked externally (code=${code})"
+  else
+    echo "[FAIL] ${host} appears reachable externally (code=${code})"
+    a11y_failures=$((a11y_failures + 1))
+  fi
+done
+
+echo
+if [[ $a11y_failures -eq 0 ]]; then
+  echo "[PASS] Non-public services are inaccessible from this source path."
+  exit 0
+else
+  echo "[FAIL] ${a11y_failures} private-admin service(s) still externally reachable."
+  exit 1
+fi