tutorial

How to Monitor Ente Photos (Self-Hosted) with Vigilmon

Ente Photos' self-hosted museum server stores end-to-end encrypted photo blobs in S3-compatible storage with PostgreSQL metadata. This guide shows you how to monitor server health, database connectivity, object storage, API endpoints, and TLS certificates with Vigilmon.

Ente Photos is an end-to-end encrypted, privacy-first alternative to Google Photos. When you self-host the museum server, your encrypted photo blobs go into S3-compatible object storage (MinIO or any S3 backend), and PostgreSQL holds all encrypted metadata, user accounts, and album definitions. That architecture gives you full data sovereignty — but it also means uptime is your responsibility.

This tutorial shows you how to monitor every critical layer of a self-hosted Ente Photos deployment using Vigilmon: server health, database connectivity, object storage, authentication and upload APIs, and TLS certificate expiry.

What You'll Set Up

  • Museum server availability monitor (GET /ping)
  • PostgreSQL database TCP connectivity check
  • Object storage (MinIO / S3) bucket health check
  • User authentication API endpoint monitor (/users/getSrpAttributes)
  • Photo upload API availability check (/files)
  • TLS certificate expiry alert
  • Disk space heartbeat for object storage capacity

Prerequisites

  • A running Ente Photos museum server (Go binary, default port 8080)
  • PostgreSQL accessible from the museum server
  • MinIO or another S3-compatible backend configured
  • A free Vigilmon account

Step 1: Monitor the Museum Server Availability

Ente's museum server exposes a /ping endpoint specifically for health checks. It returns {"message":"pong!"} with HTTP 200 when the server is running and accepting connections.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter the URL: https://your-ente-server.example.com/ping
  4. Set Check interval to 1 minute.
  5. Set Expected HTTP status to 200.
  6. Under Response body contains, enter pong to confirm the response body.
  7. Click Save.

This is your primary liveness check. If museum goes down, crashes, or stops binding its port, this monitor fires within a minute.

Step 2: Monitor PostgreSQL Database Connectivity

PostgreSQL stores encrypted photo metadata, user accounts, album definitions, sharing data, and access tokens. If the database becomes unreachable, uploads fail and clients cannot authenticate.

Add a TCP port check:

  1. Click Add Monitor → TCP Port.
  2. Enter your PostgreSQL host (e.g. your-db-host.example.com) and port 5432.
  3. Set Check interval to 1 minute.
  4. Click Save.

The TCP check verifies that PostgreSQL is accepting connections at the network level. Pair it with the application-level /ping check above — if the DB goes down, museum's /ping will start returning 500 and the TCP check will independently confirm the cause.

If you expose PostgreSQL only on localhost or a private network, run a small TCP proxy or health-check sidecar that Vigilmon can reach externally:

# Simple socat TCP relay example (for internal-only databases)
socat TCP-LISTEN:15432,fork TCP:localhost:5432 &

Then point Vigilmon at port 15432 on your server's public address.

Step 3: Monitor Object Storage (MinIO / S3)

Encrypted photo blobs are stored in your S3-compatible backend. If MinIO is unavailable or the bucket becomes inaccessible, uploads silently queue and eventually fail.

MinIO health endpoint

MinIO exposes /minio/health/live for liveness and /minio/health/ready for readiness checks:

  1. Click Add Monitor → HTTP / HTTPS.
  2. URL: https://your-minio.example.com/minio/health/live
  3. Expected status: 200
  4. Check interval: 1 minute
  5. Click Save.

Add a second monitor for the readiness endpoint:

  • URL: https://your-minio.example.com/minio/health/ready
  • Expected status: 200

The readiness check fails if MinIO loses quorum (in a distributed setup) or cannot reach its data drives.

S3-compatible backends (non-MinIO)

For Backblaze B2, Wasabi, or Cloudflare R2, check bucket accessibility via a small polling script that runs as a cron job and sends a Vigilmon heartbeat:

#!/bin/bash
# Check bucket accessibility and ping Vigilmon heartbeat if successful
aws s3 ls s3://your-ente-bucket --endpoint-url https://your-s3-endpoint.example.com \
  && curl -sf https://vigilmon.online/heartbeat/YOUR_HEARTBEAT_ID

Add this to cron every 5 minutes:

*/5 * * * * /opt/scripts/check-ente-bucket.sh

Step 4: Monitor the User Authentication API

Ente uses SRP (Secure Remote Password) for zero-knowledge authentication. The /users/getSrpAttributes endpoint is the first call clients make during login — if it fails, no user can authenticate.

  1. Click Add Monitor → HTTP / HTTPS.
  2. URL: https://your-ente-server.example.com/users/getSrpAttributes?email=healthcheck@example.com
  3. Expected status: 404 or 200 (a 404 "user not found" means the endpoint is responding correctly; change this to 200 if you configure a test account).
  4. Check interval: 2 minutes.
  5. Click Save.

A 404 for an unknown email confirms the authentication service is live and returning expected errors. A 502 or 503 means museum is down or the auth subsystem has failed.

Step 5: Monitor the Photo Upload API

The /files endpoint accepts encrypted photo uploads from Ente clients. If it goes down, apps silently stop syncing.

  1. Click Add Monitor → HTTP / HTTPS.
  2. URL: https://your-ente-server.example.com/files
  3. Expected status: 401 (an unauthenticated request should return 401, confirming the endpoint is active and enforcing auth).
  4. Check interval: 2 minutes.
  5. Click Save.

Getting a 401 from an unauthenticated probe is the expected healthy response — it means the endpoint is up and correctly rejecting anonymous requests.

Step 6: TLS Certificate Expiry Monitoring

Ente clients enforce HTTPS and will refuse to connect if your certificate is expired or invalid.

Enable SSL monitoring on your museum server HTTP check:

  1. Open the museum /ping monitor created in Step 1.
  2. Enable Monitor SSL certificate.
  3. Set Alert when certificate expires in less than 21 days.
  4. Click Save.

Also add TLS monitoring for your MinIO endpoint separately:

  1. Open the MinIO health monitor from Step 3.
  2. Enable Monitor SSL certificate → alert at 21 days.

A 21-day warning gives you enough time to renew via Let's Encrypt before clients start rejecting connections.

Step 7: Disk Space Heartbeat for Object Storage

Photos consume significant storage. A full disk on your MinIO data volume causes uploads to fail silently.

Create a cron heartbeat that reports disk usage and only pings if usage is below a threshold:

#!/bin/bash
THRESHOLD=90  # alert if disk is more than 90% full
USAGE=$(df /mnt/minio-data | awk 'NR==2 {print $5}' | tr -d '%')

if [ "$USAGE" -lt "$THRESHOLD" ]; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_DISK_HEARTBEAT_ID
fi
# If disk is over threshold, don't ping — Vigilmon alerts on missed heartbeat

Set the heartbeat interval in Vigilmon to match your cron frequency (e.g., 5 minutes). If the script detects >90% usage, it skips the ping and Vigilmon triggers an alert after one missed interval.

  1. Click Add Monitor → Cron Heartbeat.
  2. Set the expected ping interval to 5 minutes.
  3. Copy the heartbeat URL and paste it into the script above.

Step 8: Configure Alert Channels

  1. Go to Alert Channels in Vigilmon → Add Channel.
  2. Add Slack, Discord, email, or a webhook to your on-call system.
  3. For database and object storage monitors, set Consecutive failures before alert to 2 to absorb brief network blips.
  4. For the authentication and upload API monitors, set consecutive failures to 1 — these are user-facing and should alert immediately.

Summary

| Monitor | Type | Target | What It Catches | |---------|------|--------|-----------------| | Museum liveness | HTTP | /ping | Server crash, port failure | | PostgreSQL | TCP | :5432 | Database unreachable | | MinIO liveness | HTTP | /minio/health/live | Object storage down | | MinIO readiness | HTTP | /minio/health/ready | Quorum lost, drives unavailable | | Auth API | HTTP | /users/getSrpAttributes | Authentication service failure | | Upload API | HTTP | /files | Photo sync broken | | Museum TLS | SSL | Port 443 | Certificate expiry | | MinIO TLS | SSL | MinIO port 443 | Certificate expiry | | Disk space | Heartbeat | Cron script | Storage capacity exceeded |

Self-hosting Ente Photos gives you end-to-end encrypted, fully private photo storage — but that privacy comes with the responsibility of keeping every layer healthy. With Vigilmon watching your museum server, database, object storage, and key API endpoints, you'll know immediately when something goes wrong, before your clients start silently failing to sync.

Get started free at vigilmon.online — no credit card required.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles