Monitoring Etebase with Vigilmon

Etebase is an open source, end-to-end encrypted server that stores your calendars, contacts, and tasks — a privacy-first alternative to Google or iCloud sync. Running your own Etebase server (built on Python/Django, default port 8001) means every sync request from your clients hits infrastructure you control. But that ownership also means uptime is your responsibility. Vigilmon monitors your Etebase server's API health, storage sync availability, WebSocket connections, and client reachability so you know the moment anything breaks.

What You'll Set Up

• HTTP monitor for the Etebase API health endpoint (port 8001)
• Storage sync availability check via the /api/v1/ endpoint
• TCP monitor for low-level port liveness
• SSL certificate expiry alerts for your Etebase domain
• WebSocket connectivity check using a heartbeat pattern

Prerequisites

• Etebase Server running (default port 8001) with a PostgreSQL or SQLite backend
• A domain with HTTPS configured (recommended: nginx reverse proxy + Let's Encrypt)
• A free Vigilmon account

Step 1: Monitor the Etebase API Endpoint

Etebase exposes its API at /api/v1/. A successful GET returns a structured JSON response confirming the API layer is healthy. This is your primary liveness check.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. URL: https://etebase.yourdomain.com/api/v1/
4. Set Expected HTTP status to 200.
5. Set Check interval to 1 minute.
6. Optionally enable Keyword match and enter "allowed_methods" — Etebase returns this key in the API root response, confirming it's the real API and not a proxy error page.
7. Click Save.

If you're running Etebase without a reverse proxy during development:

http://your-server-ip:8001/api/v1/

Step 2: Check Storage Sync Availability

Etebase clients sync collections (calendars, contacts, tasks) through the collections API. Even if the root API responds, collection sync can fail if the database or storage backend is unavailable. Add a second monitor targeting the collections endpoint:

1. Click Add Monitor → HTTP / HTTPS.
2. URL: https://etebase.yourdomain.com/api/v1/collection/
3. Set Expected HTTP status to 401 — Etebase returns 401 Unauthorized on unauthenticated requests, which confirms the collection endpoint is live and the auth layer is functioning.
4. Set Check interval to 2 minutes.
5. Click Save.

A 401 response is the correct "healthy unauthenticated" signal here — a 500 or connection timeout indicates a real problem.

To add a richer health check to your Etebase deployment, create a simple Django management command:

# myapp/management/commands/healthcheck.py
from django.core.management.base import BaseCommand
from django.db import connection

class Command(BaseCommand):
    def handle(self, *args, **options):
        connection.ensure_connection()
        self.stdout.write('ok')

Then expose it via a lightweight view:

# urls.py
from django.http import HttpResponse
from django.db import connection

def health(request):
    connection.ensure_connection()
    return HttpResponse('ok')

urlpatterns = [
    path('health/', health),
    # ... existing patterns
]

Monitor https://etebase.yourdomain.com/health/ with Expected HTTP status 200 and Keyword match ok for a database-backed health signal.

Step 3: TCP Port Monitor

Add a TCP monitor that checks the port independently of the application layer:

1. Click Add Monitor → TCP Port.
2. Set Host to your Etebase server hostname.
3. Set Port to 443 (or 8001 if not behind a proxy).
4. Set Check interval to 1 minute.
5. Click Save.

A typical nginx reverse proxy configuration for Etebase:

server {
    listen 443 ssl;
    server_name etebase.yourdomain.com;

    location / {
        proxy_pass http://localhost:8001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Required for WebSocket connections
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Note the WebSocket headers — Etebase clients may use WebSocket for real-time sync notifications, so the proxy must support protocol upgrades.

Step 4: WebSocket Connectivity Heartbeat

Etebase can push sync notifications to clients over WebSocket. If the WebSocket path breaks (common when nginx is misconfigured after an update), clients stop receiving real-time updates even though the HTTP API looks healthy.

Use a heartbeat monitor to verify WebSocket-dependent sync paths are working:

1. Create a small watchdog script on your server that establishes a WebSocket connection and pings Vigilmon on success:

#!/usr/bin/env python3
# /opt/etebase/ws-watchdog.py
import asyncio
import aiohttp
import requests

HEARTBEAT_URL = "https://vigilmon.online/heartbeat/YOUR_HEARTBEAT_ID"
ETEBASE_WS = "wss://etebase.yourdomain.com/ws/"

async def check_websocket():
    try:
        async with aiohttp.ClientSession() as session:
            async with session.ws_connect(ETEBASE_WS, timeout=10) as ws:
                # Connection established — ping Vigilmon
                requests.get(HEARTBEAT_URL, timeout=5)
    except Exception as e:
        print(f"WebSocket check failed: {e}")
        # No ping = Vigilmon alert after interval

asyncio.run(check_websocket())

2. In Vigilmon, create a Push / Heartbeat monitor with a 10 minute expected interval.
3. Run the script on a cron schedule:

# crontab -e
*/10 * * * * /usr/bin/python3 /opt/etebase/ws-watchdog.py

If the WebSocket connection fails, the cron runs but doesn't ping Vigilmon — and Vigilmon alerts after 10 minutes of silence.

Step 5: SSL Certificate Expiry Alerts

Etebase clients enforce TLS verification. An expired certificate immediately blocks all sync for every client.

1. Open the HTTP monitor from Step 1.
2. Enable Monitor SSL certificate.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

Check your Let's Encrypt renewal pipeline:

# Test renewal without actually renewing
certbot renew --dry-run

# Check renewal timer
systemctl status certbot.timer

# Verify certificate expiry manually
echo | openssl s_client -connect etebase.yourdomain.com:443 2>/dev/null | \
  openssl x509 -noout -dates

Step 6: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add Slack, email, or a webhook.
2. For the API and TCP monitors, set Consecutive failures before alert to 2 — Django restarts and Gunicorn worker recycling can cause brief gaps.
3. For the SSL and WebSocket monitors, alert on the first failure.
4. Use Vigilmon's maintenance window API to suppress alerts during Etebase upgrades:

# Pause before upgrading
curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"monitor_id": "YOUR_MONITOR_ID", "duration_minutes": 15}'

# Upgrade Etebase
pip install --upgrade etebase-server
python manage.py migrate
systemctl restart etebase

# Window expires automatically

Summary

| Monitor | Target | What It Catches | |---|---|---| | API root | /api/v1/ | Server crash, Django errors | | Collections sync | /api/v1/collection/ | Storage or auth layer failure | | TCP port | :443 or :8001 | Proxy or process down | | SSL certificate | Etebase domain | TLS expiry blocking all clients | | WebSocket heartbeat | Heartbeat URL | Real-time sync push failure |

Self-hosting Etebase keeps your calendars, contacts, and tasks under your control with strong end-to-end encryption. Vigilmon makes sure that infrastructure stays healthy — so your clients sync reliably and you hear about failures before your data does.