Monitoring Cypht Webmail with Vigilmon

Cypht takes a different approach to self-hosted webmail: security and modularity first. It signs every session with HMAC, encrypts session data on the filesystem (or in Redis/Memcached), and loads only the plugins you explicitly enable. Its single-page architecture means all authenticated actions flow through a single AJAX endpoint rather than full page loads. This design is excellent for security — but it also means that a broken session store, a misconfigured plugin, or a failed IMAP connection can produce silent failures that look identical to a logged-out state to the end user. Vigilmon lets you monitor Cypht's web UI availability, session middleware health, and AJAX backend processing so you catch these failures before your users do.

What You'll Set Up

HTTP uptime monitor for the Cypht login page (web UI and PHP availability)
Keyword monitor to verify the CSRF token is present (session middleware health)
AJAX endpoint monitor for the Cypht backend (PHP request processing health)
SSL certificate expiry alerts (Cypht's security model requires HTTPS)
Heartbeat monitor for end-to-end IMAP connectivity via a periodic login check

Prerequisites

Cypht installed on Apache or nginx with PHP-FPM
An IMAP mail server backend configured in Cypht
A free Vigilmon account

Step 1: Monitor the Cypht Login Page

Cypht's root URL (/) performs a session check and redirects unauthenticated users to the login page. A successful response with the expected content confirms that PHP is processing requests and the Cypht routing layer is functioning.

Log in to vigilmon.online and click Add Monitor.
Set Type to HTTP / HTTPS.
Enter your Cypht URL — e.g. https://mail.yourdomain.com.
Set Check interval to 1 minute.
Set Expected HTTP status to 200.
Expand the Keyword section and enter Cypht.
Click Save.

The keyword Cypht appears in the page title and body of the login page. If PHP-FPM is down, nginx returns a 502; if Cypht's routing is broken, the response may be empty or redirect to an error. The keyword check catches both cases.

Step 2: Verify the CSRF Token Is Present (Session Middleware Health)

Cypht's security model generates a per-session CSRF token for every login form render. This token is created by the PHP session and security middleware — if the session storage backend (filesystem, Redis, or Memcached) is broken, the CSRF token will be absent and users will be unable to log in even though the page appears to load.

Open the Cypht monitor from Step 1 (or create a new HTTP monitor for the same URL).
In the Keyword section, change the keyword to hm_empty_page or check for the login form's CSRF token field.

Alternatively, monitor for the login form's hidden input field:

<input type="hidden" name="hm_page_name"

Cypht's login form always includes the hm_page_name hidden input. Its presence confirms that:

PHP session initialization succeeded
The CSRF token was generated and embedded
The login template rendered completely

If you see a 200 response without this form field, the session middleware is failing silently.

Step 3: Monitor the Cypht AJAX Endpoint

All authenticated Cypht actions — fetching the inbox, reading messages, sending email — are handled through a single AJAX endpoint at /ajax_endpoint. Even an unauthenticated POST to this endpoint returns a JSON error response, which confirms the PHP backend is alive and routing AJAX requests correctly.

Click Add Monitor in Vigilmon.
Set Type to HTTP / HTTPS.
Enter https://mail.yourdomain.com/ajax_endpoint.
Set Method to POST.
Set Request body to hm_page_name=login (URL-encoded form data).
Set Content-Type header to application/x-www-form-urlencoded.
Set Check interval to 1 minute.
Set Expected HTTP status to 200.
Expand Keyword and enter hm_error (the JSON error key Cypht returns for unauthenticated requests).
Click Save.

An unauthenticated POST to /ajax_endpoint returns a JSON response containing hm_error. If the PHP backend is down, the session middleware is broken, or the AJAX routing is misconfigured, the request will fail or return an unexpected response, triggering a Vigilmon alert.

Step 4: SSL Certificate Alerts

Cypht's security model explicitly requires HTTPS. Its session cookies are marked Secure, and the HMAC-signed session data is meaningless without TLS protecting the transport. Running Cypht over plain HTTP is not recommended and is explicitly warned against in the documentation. This makes SSL certificate expiry particularly critical — an expired certificate blocks every user instantly.

Open the Cypht login page monitor from Step 1.
Scroll to the SSL Certificate section.
Enable Monitor SSL certificate expiry.
Set Alert threshold to 21 days before expiry.
Click Save.

Check that automatic renewal is configured for your certificate:

# Verify certbot auto-renewal
certbot renew --dry-run

# Check renewal hooks
ls /etc/letsencrypt/renewal-hooks/

A failed Let's Encrypt renewal that goes unnoticed for 3 weeks will cause a hard browser error that blocks all Cypht access. The 21-day alert window ensures you have time to resolve any renewal failure before it reaches users.

Step 5: Heartbeat Monitoring for IMAP Connectivity

Cypht loads IMAP mailboxes at login and via periodic AJAX requests. If the IMAP server goes down, the Cypht login page still renders correctly — users only see a failure when they attempt to load the inbox. A heartbeat monitor catches IMAP unavailability proactively.

In Vigilmon, click Add Monitor → Cron Heartbeat.
Set the expected ping interval to 5 minutes.
Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).

Create a health check script that performs a Cypht login and verifies IMAP connectivity:

#!/bin/bash
# /usr/local/bin/cypht-health-check.sh

CYPHT_URL="https://mail.yourdomain.com"
TEST_USER="monitor@yourdomain.com"
TEST_PASS="your-test-password"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/abc123"

# Fetch the login page and extract the CSRF token
PAGE=$(curl -s -c /tmp/cypht_cookies.txt "$CYPHT_URL")
CSRF=$(echo "$PAGE" | grep -oP 'name="hm_ajax_key" value="\K[^"]+')

if [ -z "$CSRF" ]; then
  # Try fetching the login page directly
  PAGE=$(curl -s -c /tmp/cypht_cookies.txt "$CYPHT_URL/index.php")
  CSRF=$(echo "$PAGE" | grep -oP 'name="hm_ajax_key" value="\K[^"]+')
fi

if [ -z "$CSRF" ]; then
  echo "Failed to fetch CSRF token from login page"
  exit 1
fi

# Submit the login form
RESPONSE=$(curl -s -b /tmp/cypht_cookies.txt -c /tmp/cypht_cookies.txt \
  -X POST "$CYPHT_URL/index.php" \
  -d "username=$TEST_USER&password=$TEST_PASS&hm_page_name=login&hm_ajax_key=$CSRF")

# Check if login succeeded (redirects to the home page)
if echo "$RESPONSE" | grep -q 'hm_home_page' || \
   curl -s -b /tmp/cypht_cookies.txt "$CYPHT_URL/" | grep -q 'hm_content'; then
  curl -s "$HEARTBEAT_URL" > /dev/null
  echo "Login and IMAP check successful — heartbeat sent"
else
  echo "Login failed — IMAP backend may be unreachable"
  exit 1
fi

rm -f /tmp/cypht_cookies.txt

Create a dedicated monitoring account in Cypht with access to a test IMAP mailbox, then schedule the check:

*/5 * * * * /usr/local/bin/cypht-health-check.sh >> /var/log/cypht-health.log 2>&1

If IMAP is unreachable, the login will fail (Cypht validates IMAP connectivity at login), the heartbeat will not be sent, and Vigilmon will alert after 5 minutes.

Step 6: Configure Alert Channels

Go to Alert Channels in Vigilmon and add email, Slack, PagerDuty, or a webhook.
Set Consecutive failures before alert to 2 on the web UI and AJAX endpoint monitors — brief PHP-FPM restarts during package updates can cause a single probe miss.
Keep the heartbeat alert sensitive: 1 missed ping is sufficient, since a missed heartbeat already represents 5 minutes of IMAP unavailability affecting all Cypht users.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP + keyword (Cypht) | https://mail.yourdomain.com | PHP crash, nginx/Apache down | | Keyword (hm_page_name) | Cypht login form | Session middleware failure | | HTTP POST to AJAX endpoint | /ajax_endpoint | PHP backend processing failure | | SSL certificate | Webmail domain | Let's Encrypt renewal failure | | Cron heartbeat | Heartbeat URL every 5 min | IMAP server down, login chain failure |

Cypht's security-first architecture is a strength for privacy — but its encrypted sessions and AJAX-driven design can fail silently. Vigilmon gives you external visibility into each layer, from the login page and session middleware to the IMAP backend, so you stay ahead of any failure your users might encounter.