#!/usr/bin/env bash
# Narrowly scoped read-only DNS and HTTPS check on an authorized hostname.
set -uo pipefail
TARGET="${1:-}"
if [[ ! "$TARGET" =~ ^[A-Za-z0-9][A-Za-z0-9.-]{0,252}$ ]] || [[ "$TARGET" == *..* ]]; then
  printf 'Usage: bash network-diagnostics.sh authorized.example.com\n' >&2
  exit 2
fi
printf 'Authorized target: %s | UTC: %s\n' "$TARGET" "$(date -u +'%FT%TZ')"
if command -v getent >/dev/null 2>&1; then getent ahosts "$TARGET" || true; fi
if command -v dig >/dev/null 2>&1; then
  dig +time=2 +tries=1 +noall +answer "$TARGET" A || true
  dig +time=2 +tries=1 +noall +answer "$TARGET" AAAA || true
fi
if command -v curl >/dev/null 2>&1; then
  curl --head --silent --show-error --max-time 10 --max-redirs 0 --output /dev/null --write-out 'HTTP %{http_code} / IP %{remote_ip}\n' "https://$TARGET/" || true
fi
printf 'No scans or modifications performed; run only against authorized targets.\n'