Monitoring Coder Workspaces with Vigilmon: API Health, Provisioner Heartbeats, OIDC Endpoint & SSL Certificates

Coder is the open-source platform for remote development environments that provisions cloud-based workspaces on Kubernetes, AWS, GCP, or Azure using Terraform-based templates — giving engineering teams secure, reproducible, high-performance development environments accessible from any device. When the Coder API goes down or the workspace provisioner loses connectivity, every developer in your organization loses access to their development environment simultaneously. Vigilmon gives you external visibility into the Coder API health, workspace provisioner status, OIDC identity provider availability, template builds, and SSL certificates so platform teams can catch outages before developers are blocked.

What You'll Build

An HTTP monitor on the Coder API health endpoint
A heartbeat monitor verifying the Coder provisioner daemon is active
An HTTP monitor for your OIDC identity provider's discovery endpoint
SSL certificate monitoring for the Coder dashboard domain
An alerting runbook for Coder failure modes

Prerequisites

A running Coder deployment (v2.x) accessible over HTTPS
At least one provisioner daemon registered and active
A free account at vigilmon.online

Step 1: Verify the Coder API Health Endpoint

Coder exposes a /healthz endpoint that returns 200 OK when the API is healthy, and a /api/v2/buildinfo endpoint that provides richer status data:

curl https://coder.example.com/healthz

A healthy Coder deployment returns 200 OK. The buildinfo endpoint provides version and configuration details confirming the API is fully operational:

curl https://coder.example.com/api/v2/buildinfo

This returns a JSON response with version, build time, and external URL.

Step 2: Create Vigilmon HTTP Monitors for the Coder API

Primary health check:

Log in to Vigilmon → Add Monitor → HTTP.
URL: https://coder.example.com/healthz.
Check interval: 60 seconds.
Response timeout: 10 seconds.
Expected status: 200.
Label: Coder API Health.
Click Save.

Deep API check:

Add Monitor → HTTP.
URL: https://coder.example.com/api/v2/buildinfo.
Check interval: 2 minutes.
Expected status: 200.
Keyword: version.
Label: Coder API Buildinfo.
Click Save.

Set alerts after 1 consecutive failure — when the Coder API is down, developers cannot connect to existing workspaces, start new sessions, or access the dashboard.

Step 3: Monitor the Coder Provisioner Daemon with a Heartbeat

The Coder provisioner daemon executes Terraform plans to create, update, and destroy workspaces. When the provisioner goes down, existing workspaces remain accessible but no new workspaces can be started and pending builds hang indefinitely:

Step 3a — Create a Heartbeat monitor in Vigilmon:

Add Monitor → Heartbeat.
Name: Coder Provisioner Active.
Expected interval: 10 minutes.
Grace period: 5 minutes.
Copy the ping URL (e.g., https://vigilmon.online/ping/abc123).

Step 3b — Deploy a CronJob to check provisioner status:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: coder-provisioner-heartbeat
  namespace: coder
spec:
  schedule: "*/5 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: check
              image: curlimages/curl:latest
              command:
                - sh
                - -c
                - |
                  PROVISIONERS=$(curl -fsS \
                    -H "Coder-Session-Token: $CODER_TOKEN" \
                    https://coder.example.com/api/v2/provisionerdaemons \
                    | grep -c '"status":"ok"')
                  if [ "$PROVISIONERS" -gt "0" ]; then
                    curl -fsS -m 10 https://vigilmon.online/ping/abc123
                  fi
              env:
                - name: CODER_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: coder-monitor-token
                      key: token
          restartPolicy: OnFailure

The CronJob pings Vigilmon only when at least one provisioner daemon reports ok status.

Step 4: Monitor the OIDC Identity Provider Discovery Endpoint

Coder delegates authentication to an external OIDC provider (Keycloak, Auth0, Okta, Google, GitHub). If the identity provider is unreachable, users cannot log in even if the Coder API itself is healthy:

curl https://auth.example.com/.well-known/openid-configuration

Add Monitor → HTTP.
URL: https://auth.example.com/.well-known/openid-configuration.
Check interval: 2 minutes.
Expected status: 200.
Keyword: authorization_endpoint.
Label: Coder OIDC Provider.
Click Save.

Common OIDC discovery URLs:

Keycloak: https://keycloak.example.com/realms/<realm>/.well-known/openid-configuration
Auth0: https://<tenant>.auth0.com/.well-known/openid-configuration
Okta: https://<tenant>.okta.com/.well-known/openid-configuration

Step 5: Monitor Template Build Completion with a Heartbeat

Broken Coder workspace templates (due to provider version changes, cloud credential expiry, or Terraform misconfiguration) mean no developer can start a workspace using that template:

Step 5a — Create a Heartbeat monitor in Vigilmon:

Add Monitor → Heartbeat.
Name: Coder workspace template build.
Expected interval: 1 hour.
Grace period: 15 minutes.
Copy the ping URL.

Step 5b — Schedule a template health check:

#!/bin/bash
BUILD_STATUS=$(coder templates versions list my-template \
  --output json | jq -r '.[0].job.status')
if [ "$BUILD_STATUS" = "succeeded" ]; then
  curl -fsS -m 10 https://vigilmon.online/ping/<your-heartbeat-id>
fi

Step 6: Monitor Coder Dashboard SSL Certificates

An expired TLS certificate locks all developers out of their remote environments simultaneously:

Add Monitor → SSL Certificate.
Domain: coder.example.com.
Alert when expiry is within: 30 days.
Alert again at: 14 days, 7 days, 3 days, 1 day.
Click Save.

Also monitor the OIDC provider SSL certificate separately:

Add Monitor → SSL Certificate.
Domain: auth.example.com.
Alert when expiry is within: 30 days.
Click Save.

Step 7: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels:

| Monitor | Trigger | Action | |---|---|---| | Coder API health | Non-200 or timeout | kubectl get pods -n coder; review API logs | | Coder API buildinfo | version keyword missing | API degraded; check database connectivity | | Provisioner heartbeat | No ping within 15 min | Check provisioner pod; kubectl logs -n coder | | OIDC provider | Non-200 or keyword missing | Check IdP health; verify Coder OIDC config | | Template build heartbeat | No ping within 75 min | Check Terraform; verify cloud provider credentials | | Coder SSL certificate | < 30 days | Renew; check cert-manager or Ingress TLS config | | OIDC SSL certificate | < 30 days | Renew IdP certificate; update Coder OIDC trust config |

Common Coder Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Coder API pod crash or OOMKill | HTTP health monitor fires within 60 s | | Provisioner daemon disconnects | Provisioner heartbeat expires | | OIDC provider outage | OIDC HTTP monitor fires; logins blocked | | OIDC certificate expires | SSL monitor alerts at 30-day threshold | | Cloud credential expiry (Terraform) | Template build heartbeat stops | | Database connection loss | API buildinfo endpoint fails | | Coder TLS certificate expires | SSL monitor alerts at 30-day threshold | | Workspace builds hang indefinitely | Provisioner heartbeat eventually expires |

Coder's value is that every developer gets a consistent, always-available cloud workspace — but when the Coder API or provisioner goes down, the entire engineering organization loses access to their development environments at once, making Coder outages among the highest-blast-radius platform incidents. Vigilmon's layered monitoring of the Coder API, provisioner health, OIDC provider, template builds, and SSL certificates gives platform teams early warning so they can restore service before developers are blocked.

Start monitoring Coder in under 5 minutes — register free at vigilmon.online.