Monitoring Cloudron with Vigilmon

Cloudron turns any Ubuntu VPS into a fully managed app platform — one-click installs for Nextcloud, GitLab, Ghost, Rocket.Chat, and 100+ more apps, with automatic SSL certificates, backups, user management, and email hosting. Everything is polished and automated, which makes the rare Cloudron outage or backup failure feel especially alarming when you have no monitoring in place. Vigilmon adds the external uptime layer Cloudron doesn't include: dashboard availability, API health, per-app status checks, SSL certificate alerts, and automated backup health heartbeats.

What You'll Set Up

• Cloudron admin dashboard availability monitor (port 443 HTTPS)
• Cloudron API health check at /api/v1/cloudron/status
• Installed app availability monitors for critical app subdomains
• SSL certificate expiry alerts for all Cloudron-managed domains
• Heartbeat monitor for Cloudron backup job health

Prerequisites

• Cloudron installed on an Ubuntu 20.04+ VPS or dedicated server
• Cloudron accessible at https://my.yourdomain.com (your Cloudron admin domain)
• Admin API token from your Cloudron dashboard (Profile → Access Tokens)
• A free Vigilmon account

Step 1: Monitor the Cloudron Admin Dashboard

Cloudron serves its React admin SPA on port 443 at the root path of your configured Cloudron domain. A 200 response confirms the Nginx reverse proxy and the Cloudron dashboard are operational.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter your Cloudron admin URL: https://my.yourdomain.com.
4. Set Check interval to 5 minutes.
5. Set Expected HTTP status to 200.
6. Click Save.

Cloudron typically uses a my. subdomain as the admin interface. If you configured a different subdomain during setup, use that URL instead.

A failure here means either Cloudron's Nginx proxy has crashed or the Cloudron dashboard app container is down — both situations prevent you from accessing the admin interface to investigate problems with installed apps.

Step 2: Monitor the Cloudron API

Cloudron provides a REST API for app and system management. The /api/v1/cloudron/status endpoint returns JSON with the Cloudron version, app count, and system status, confirming the Node.js backend is alive:

{
  "version": "7.x.x",
  "boxVersion": "7.x.x",
  "adminFqdn": "my.yourdomain.com"
}

Add a dedicated API health monitor:

1. Click Add Monitor → HTTP / HTTPS.
2. Set URL to https://my.yourdomain.com/api/v1/cloudron/status.
3. Set Check interval to 5 minutes.
4. Set Expected HTTP status to 200.
5. Under Request headers, add your Cloudron API token:
   • Header: Authorization
   • Value: Bearer YOUR_CLOUDRON_API_TOKEN
6. Under Response body contains, enter version to verify the JSON payload.
7. Click Save.

The Cloudron status endpoint requires authentication. Your API token can be generated in the Cloudron admin dashboard under Profile → Access Tokens. Keep this token secure — treat it like a password.

This monitor catches situations where the Nginx proxy is healthy but the Cloudron backend process has crashed. In this state, the admin dashboard loads its cached HTML but all API calls fail silently.

Step 3: Monitor Installed App Availability

Cloudron hosts each app on its own subdomain (e.g., nextcloud.yourdomain.com, git.yourdomain.com). Add a Vigilmon monitor for each critical installed app:

1. Click Add Monitor → HTTP / HTTPS.
2. Set the URL to the app's subdomain, for example:
   • Nextcloud: https://nextcloud.yourdomain.com
   • GitLab: https://git.yourdomain.com
   • Ghost: https://blog.yourdomain.com
   • Rocket.Chat: https://chat.yourdomain.com
3. Set Check interval to 5 minutes.
4. Set Expected HTTP status to 200.
5. Click Save.

Repeat for each app you rely on. You can retrieve the list of installed apps and their domains via the Cloudron API:

curl -sf -H "Authorization: Bearer YOUR_API_TOKEN" \
  https://my.yourdomain.com/api/v1/apps | \
  python3 -c "import sys,json; [print(a['location']+'.'+a['domain']) for a in json.load(sys.stdin)['apps']]"

A 502 response on an app subdomain typically means the specific app container has crashed while Cloudron's Nginx proxy is still running. Cloudron usually auto-restarts crashed app containers, but the outage window can be several minutes — Vigilmon will catch and alert on it.

Step 4: SSL Certificate Alerts for Cloudron-Managed Domains

Cloudron automatically issues and renews Let's Encrypt certificates for every app subdomain and the admin domain. Renewal can fail if DNS is misconfigured, rate limits are hit, or the ACME challenge fails. A wildcard certificate renewal failure affects all app subdomains at once.

Add a certificate expiry monitor for your Cloudron admin domain and each critical app subdomain:

1. Open the dashboard monitor created in Step 1.
2. Enable Monitor SSL certificate under the SSL section.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.
5. Repeat for each installed app subdomain monitor.

To check certificate expiry from the command line:

echo | openssl s_client -connect nextcloud.yourdomain.com:443 2>/dev/null \
  | openssl x509 -noout -dates

Cloudron renews certificates 30 days before expiry. A 21-day alert in Vigilmon gives you 9 days of buffer before the Cloudron renewal window closes.

If you use a wildcard certificate for all app subdomains, one expiry alert on the base domain is sufficient — but verify your Cloudron configuration to confirm whether it uses per-subdomain or wildcard certificates.

Step 5: Heartbeat Monitoring for Cloudron Backup Health

Cloudron backs up all app data automatically to your configured storage backend (S3, SFTP, or WebDAV). Backup job failures are silent — there's no push notification when a backup doesn't complete. Use a Vigilmon heartbeat to monitor backup job health:

1. Click Add Monitor → Cron Heartbeat in Vigilmon.
2. Set the expected ping interval to match your Cloudron backup schedule (e.g. 24 hours for daily backups).
3. Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).
4. Set up a cron job that calls the Cloudron backups API and pings Vigilmon if the most recent backup succeeded:

#!/bin/bash
# /usr/local/bin/cloudron-backup-check.sh
RESPONSE=$(curl -sf -H "Authorization: Bearer YOUR_API_TOKEN" \
  https://my.yourdomain.com/api/v1/backups)

# Check if the most recent backup completed successfully
LAST_STATE=$(echo "$RESPONSE" | python3 -c "
import sys, json
backups = json.load(sys.stdin).get('backups', [])
print(backups[0].get('state', 'unknown') if backups else 'none')
")

if [ "$LAST_STATE" = "normal" ]; then
  curl -s https://vigilmon.online/heartbeat/abc123
fi

Schedule this check to run daily, 30–60 minutes after your configured Cloudron backup time:

# /etc/cron.d/cloudron-backup-heartbeat
30 3 * * * root /usr/local/bin/cloudron-backup-check.sh

The Cloudron backups API returns a list of recent backup records with timestamps and state values. If the latest backup state is not normal — or if the API call itself fails — the heartbeat won't ping Vigilmon, and you'll receive an alert.

Step 6: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and configure email, Slack, Discord, or PagerDuty notifications.
2. Set Consecutive failures before alert to 2 on dashboard and app monitors — Cloudron restarts containers during updates, causing brief (30–90 second) outages.
3. For the backup heartbeat, set the Grace period to 90 minutes to account for backup window variance and the check timing offset.
4. Use Vigilmon's Maintenance windows feature before running Cloudron platform updates:

# Schedule a 15-minute maintenance window before updating
curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_VIGILMON_API_KEY" \
  -d '{"monitor_id": "MONITOR_ID", "duration_minutes": 15}'

# Then run the Cloudron update
# (done via the Cloudron dashboard UI)

Summary

| Monitor | Target | What It Catches | |---|---|---| | Admin dashboard | https://my.yourdomain.com | Nginx down, dashboard crash | | Cloudron API | /api/v1/cloudron/status | Backend process crash | | Installed apps | Each app subdomain | App container crash, proxy 502 | | SSL certificates | Admin domain + app subdomains | Let's Encrypt renewal failure | | Backup health heartbeat | /api/v1/backups | Silent backup job failure |

Cloudron handles the heavy lifting of self-hosting — Vigilmon makes sure you know the moment anything in that managed stack stops working or your backup routine fails silently.