tutorial

Monitoring Dhall-Powered Infrastructure with Vigilmon: Package Registry Health, Configuration Compilation Services, and CI Pipeline Checks

How to monitor Dhall-powered infrastructure with Vigilmon — package registry availability, configuration compilation API health, CI webhook endpoints, and SSL certificate alerts.

Dhall is a total, programmable configuration language designed for reproducible infrastructure — its type system and lack of side effects make it safe to evaluate in any context, which is exactly why platform teams use it for generating Kubernetes manifests, Terraform configurations, CI/CD pipeline definitions, and Helm values files from a single typed source of truth. Infrastructure teams relying on Dhall depend on a shared package registry or prelude mirror, a configuration compilation service that renders Dhall to JSON or YAML, and CI pipelines that validate configuration changes before they reach production. When any of these services fail, infrastructure changes stall or land without type-checking. Vigilmon gives you external, agent-free monitoring of every Dhall infrastructure availability surface.

What You'll Build

  • An HTTP monitor on your Dhall package registry to detect prelude and import availability failures
  • A configuration compilation API health check for Dhall-to-JSON/YAML rendering services
  • A CI webhook endpoint monitor for Dhall validation pipelines
  • SSL certificate monitoring for your Dhall infrastructure
  • An alerting setup that distinguishes registry failures from compilation service failures

Prerequisites

  • A self-hosted Dhall package registry or prelude mirror accessible over HTTPS
  • A Dhall compilation service (dhall-to-json or dhall-to-yaml) with a health endpoint
  • CI pipeline webhook receivers for Dhall validation
  • A free account at vigilmon.online

Step 1: Understand Dhall's Production Availability Surfaces

Dhall infrastructure in production consists of three main components:

1. Package Registry / Prelude Mirror — Dhall files import from URLs. Teams that rely on prelude.dhall-lang.org or a self-hosted mirror for shared types and functions need that registry to be available at dhall import evaluation time. An unreachable registry causes all Dhall evaluations that use imports to fail.

# Check your self-hosted Dhall prelude mirror
curl -s https://dhall.example.com/healthz
# Returns: {"status":"ok","packages":128}

2. Configuration Compilation API — A REST service wrapping dhall-to-json or dhall-to-yaml, used by CI/CD pipelines to render Dhall templates into deployable configuration:

curl -s https://dhall-compile.example.com/health
# Returns: {"status":"healthy","dhallVersion":"1.42.x"}

3. CI/CD Webhook Triggers — Webhook receivers that trigger Dhall type-checking and compilation on pull request events, preventing invalid configuration changes from reaching main.

Step 2: Monitor the Dhall Package Registry

Dhall's import system fetches remote files at evaluation time. If your prelude mirror or internal package registry is down, every CI pipeline that evaluates Dhall files with remote imports fails immediately:

  1. Log in to Vigilmon → Add Monitor → HTTP.
  2. URL: https://dhall.example.com/healthz.
  3. Check interval: 60 seconds.
  4. Response timeout: 15 seconds.
  5. Expected status: 200.
  6. Keyword: ok (present in the health response body).
  7. Label: Dhall Package Registry.
  8. Click Save.

For a functional check that confirms a specific prelude package is reachable:

curl -s https://dhall.example.com/Prelude/List/map.dhall | head -1
# Returns the first line of the Dhall prelude function
  1. Add Monitor → HTTP.
  2. URL: https://dhall.example.com/Prelude/List/map.dhall.
  3. Check interval: 5 minutes.
  4. Response timeout: 15 seconds.
  5. Expected status: 200.
  6. Keyword: let (Dhall function definitions begin with let).
  7. Label: Dhall Prelude Check.
  8. Click Save.

This monitor catches:

  • Registry server crashes or pod restarts
  • Storage backend failures that make package files unavailable
  • CDN or proxy failures in front of the registry
  • File system corruption or missing package paths
  • Registry upgrade failures that leave the service in a broken state

Alert sensitivity: Trigger after 1 consecutive failure. When the Dhall registry is unreachable, CI pipelines running dhall resolve or dhall-to-json fail immediately across all repositories that import from the registry.

Step 3: Monitor the Dhall Compilation Service

The compilation service wraps dhall-to-json or dhall-to-yaml in a REST API, enabling CI pipelines to compile Dhall to deployable configuration without installing the Dhall toolchain in every CI runner:

curl -s https://dhall-compile.example.com/health
# Returns: {"status":"healthy","dhallVersion":"1.42.x"}
  1. Add Monitor → HTTP.
  2. URL: https://dhall-compile.example.com/health.
  3. Check interval: 2 minutes.
  4. Response timeout: 15 seconds.
  5. Expected status: 200.
  6. Keyword: healthy.
  7. Label: Dhall Compilation Service.
  8. Click Save.

For a deeper functional check that submits a minimal Dhall expression:

curl -s -X POST https://dhall-compile.example.com/compile \
  -H "Content-Type: application/json" \
  -d '{"expression": "{ field = \"value\" }"}' \
| jq '.result.field'
# Returns: "value"

Add a second monitor targeting /compile with a minimal POST body and the keyword value to verify the Dhall evaluator is functional, not just the HTTP server.

Step 4: Monitor CI Webhook Receivers for Dhall Validation

Dhall validation pipelines trigger on pull request events — running dhall type-check and dhall-to-json against changed files to block merges that introduce type errors. The webhook receiver that processes GitHub or GitLab pull request events must be available:

curl -s https://dhall-ci.example.com/healthz
# Returns: {"status":"ok","pendingJobs":0}
  1. Add Monitor → HTTP.
  2. URL: https://dhall-ci.example.com/healthz.
  3. Check interval: 2 minutes.
  4. Response timeout: 15 seconds.
  5. Expected status: 200.
  6. Keyword: ok.
  7. Label: Dhall CI Webhook Receiver.
  8. Click Save.

When the webhook receiver is down, GitHub marks the Dhall validation check as "pending" indefinitely. If your branch protection requires this check, merges are blocked across all repositories. If the check is optional, invalid Dhall changes land on main without type validation.

Step 5: Monitor SSL Certificates

Dhall's import integrity system uses HTTPS with certificate pinning via the .integrity hash mechanism. Additionally, webhook receivers require valid TLS certificates to receive events from GitHub or GitLab. Certificate expiry breaks both import resolution and webhook delivery:

openssl s_client -connect dhall.example.com:443 2>/dev/null | openssl x509 -noout -dates
openssl s_client -connect dhall-compile.example.com:443 2>/dev/null | openssl x509 -noout -dates
  1. Add Monitor → SSL Certificate.
  2. Domain: dhall.example.com.
  3. Alert when expiry is within: 30 days.
  4. Alert again: 14 days, 7 days, 3 days, 1 day.
  5. Click Save.

Repeat for dhall-compile.example.com and dhall-ci.example.com.

Dhall's import integrity check stores an expected hash alongside the URL. If you rotate the SSL certificate and the file content hasn't changed, existing hash pins remain valid. But if an expired certificate causes HTTP clients to reject the connection outright, no Dhall evaluation that fetches remote imports can succeed regardless of hash correctness.

Step 6: Monitor the TCP Port for the Compilation Service

A TCP check confirms the compilation service port is accepting connections independently of application health:

nc -zv dhall-compile.example.com 443
  1. Add Monitor → TCP.
  2. Host: dhall-compile.example.com.
  3. Port: 443.
  4. Check interval: 2 minutes.
  5. Label: Dhall Compile TCP.
  6. Click Save.

TCP checks catch network-layer failures — such as a Kubernetes Service losing its endpoints after a deployment rollout — that return a TCP RST rather than an HTTP error code. These are common during Dhall compilation service version upgrades.

Step 7: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels:

| Monitor | Trigger | Action | |---|---|---| | Dhall registry /healthz | Non-200 or keyword missing | Registry down; all CI jobs with remote imports fail immediately | | Dhall prelude check | Non-200 or keyword missing | Specific prelude package unavailable; check storage backend | | Dhall compilation API | Non-200 or keyword missing | CI pipelines cannot compile Dhall → YAML/JSON | | Dhall CI webhook receiver | Non-200 or keyword missing | PR type-checking blocked or bypassed depending on branch protection | | SSL certificates | < 30 days to expiry | Renew cert; import resolution and webhook delivery break at expiry | | TCP port check | Connection refused | Network/load balancer failure; check Kubernetes Service endpoints |

Alert after: 1 consecutive failure for the registry and compilation service. 2 consecutive failures for the webhook receiver.

Common Dhall Infrastructure Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Registry server pod crash | Registry health monitor fires within 60 s; all CI imports fail | | Prelude package file missing from storage | Prelude content check fires; keyword let absent | | Compilation service OOM | Compilation API health fires; CI jobs get connection refused | | SSL certificate expires on registry | SSL monitor alerts 30 days ahead; import resolution fails at expiry | | GitHub webhook cannot reach CI receiver | Webhook receiver TCP and HTTP monitors fire; PR checks pending forever | | Dhall version upgrade breaks evaluation | Compilation API health check catches server startup failure | | Load balancer routing change during deploy | TCP monitor fires before HTTP; compilation fails mid-rollout | | CI receiver backlog causes health check timeout | Response time alert fires; jobs queue but do not process |

Dhall's guarantees — totality, reproducibility, and type safety — depend on the infrastructure that serves packages and runs evaluations being available. When the package registry is down, imports fail. When the compilation service crashes, CI pipelines cannot render configuration. When SSL certificates expire, the import resolution and webhook delivery that power your entire Dhall-based infrastructure pipeline stop working. Vigilmon gives you external visibility into every layer — registry availability, specific prelude reachability, compilation service health, CI webhook connectivity, and certificate expiry — so Dhall keeps delivering configuration integrity without silent gaps.

Start monitoring your Dhall infrastructure in under 5 minutes — register free at vigilmon.online.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles