How to Monitor CryptPad with Vigilmon (HTTP, WebSocket, and SSL Alerts)

CryptPad is an end-to-end encrypted collaboration suite — documents, spreadsheets, and whiteboards with zero-knowledge encryption. If you run a self-hosted CryptPad instance for your team or organization, downtime means lost access to encrypted documents that no one else can open.

This tutorial walks you through setting up monitoring for a self-hosted CryptPad using Vigilmon — free tier, no credit card.

Why CryptPad needs external monitoring

CryptPad's self-hosted architecture has several layers that can fail independently:

• Web UI unavailable — the Node.js process crashes or the HTTP server stops responding; users see a blank page or connection error
• WebSocket service down — CryptPad uses WebSockets for real-time collaboration; if port 3000 (or your configured WebSocket port) becomes unreachable, documents open but edits don't sync
• API sandbox failure — CryptPad runs a separate sandboxed iframe server (typically port 3001) for security isolation; if that port goes down, document editing breaks even if the main UI loads
• SSL certificate expiry — CryptPad requires HTTPS; an expired cert blocks all access and is especially disruptive because the zero-knowledge encryption model means there's no server-side fallback

External monitoring catches these from the outside — the same perspective as your users.

What you'll need

• A self-hosted CryptPad instance
• A free Vigilmon account

Step 1: Identify your CryptPad endpoints

A typical self-hosted CryptPad deployment has three relevant endpoints:

https://cryptpad.yourdomain.com          # Main web UI (port 443 via nginx)
https://cryptpad.yourdomain.com/api/config  # JSON config endpoint (health signal)
wss://cryptpad.yourdomain.com/cryptpad_websocket  # WebSocket collaboration

Verify the config API endpoint is reachable:

curl https://cryptpad.yourdomain.com/api/config
# Expect: JSON response with CryptPad configuration

This endpoint returns 200 with valid JSON when CryptPad is running correctly — it's the most reliable unauthenticated health signal.

Step 2: Monitor the web UI

Start with basic HTTP availability to ensure the page loads at all.

1. Log in to vigilmon.online and go to Monitors → New Monitor
2. Choose HTTP / HTTPS
3. URL: https://cryptpad.yourdomain.com
4. Check interval: 1 minute
5. Expected status code: 200
6. (Optional) Response body contains: CryptPad
7. Save the monitor

This fires when the Node.js process is down, nginx fails to proxy, or the server runs out of memory.

Step 3: Monitor the API config endpoint

The /api/config endpoint is a stronger health signal than the homepage — it exercises the Node.js application layer and confirms that CryptPad's configuration is being served correctly.

1. Monitors → New Monitor → HTTP / HTTPS
2. URL: https://cryptpad.yourdomain.com/api/config
3. Check interval: 1 minute
4. Expected status code: 200
5. Response body contains: fileHost (a key present in all valid CryptPad config responses)
6. Save the monitor

If this returns a non-200 status or an unexpected body, CryptPad's Node.js backend has a problem even if the nginx layer is up.

Step 4: Add a TCP check for the WebSocket port

CryptPad's WebSocket server is essential for real-time collaboration. A TCP port check confirms the port is accepting connections — even before a full WebSocket handshake.

1. Monitors → New Monitor → TCP Port
2. Host: cryptpad.yourdomain.com
3. Port: 3000 (or whatever port your WebSocket server runs on before nginx proxying)
4. Save the monitor

If your WebSocket traffic goes through nginx on port 443, add a TCP check on port 443 instead. The goal is to confirm the proxy + backend chain is intact end-to-end.

Step 5: Monitor SSL certificate expiry

CryptPad won't function without a valid HTTPS certificate — the zero-knowledge model depends on TLS integrity. Users can't dismiss the browser's certificate warning and fall back to HTTP.

1. Monitors → New Monitor → SSL Certificate
2. Domain: cryptpad.yourdomain.com
3. Alert when expiring in fewer than: 14 days
4. Save the monitor

With Let's Encrypt auto-renewal via certbot, this mostly acts as a safety net — but renewal failures are more common than people expect, especially after server reboots that change NGINX config.

Step 6: Configure alert channels

1. Alert Channels → Add Channel
2. Choose email, Slack, Discord, or webhook
3. Assign the channel to all CryptPad monitors

For a team relying on CryptPad for sensitive documents, routing alerts to the person who manages the server (rather than a general team channel) reduces alert fatigue while ensuring the right person gets paged.

Step 7: Create a status page

If multiple teams use your CryptPad instance, a status page removes the "is it just me?" question.

1. Status Pages → New Status Page
2. Name: "CryptPad Status"
3. Add monitors: Web UI, API config, WebSocket TCP, SSL
4. Publish and share the URL with your users

Monitoring summary

| Monitor | Type | What it catches | |---------|------|-----------------| | https://cryptpad.yourdomain.com | HTTP | Node.js crash, nginx failure, blank page | | https://cryptpad.yourdomain.com/api/config | HTTP | Backend failure, config not served | | cryptpad.yourdomain.com:3000 | TCP | WebSocket port unreachable, collaboration broken | | cryptpad.yourdomain.com | SSL | Certificate expiry before HTTPS access is blocked |

What's next

• Heartbeat monitoring — CryptPad backup jobs can ping a Vigilmon heartbeat so you know if encrypted document backups stop running
• Response time history — detect Node.js memory pressure through rising response times before the process crashes

Get started free at vigilmon.online — no credit card, first monitors live in under two minutes.