Monitoring KeeWeb with Vigilmon

KeeWeb is an open-source, KeePass-compatible password manager that runs as a web application or PWA — you self-host it as a static site behind nginx or Caddy, and it syncs KeePass .kdbx database files via WebDAV, Dropbox, or Google Drive. Because it's your password manager, any downtime is immediately critical: you can't log in anywhere else until KeeWeb is back up. Vigilmon watches your web server, WebDAV backend, TLS certificate, static files, and sync connectivity so you know the moment anything in the chain breaks.

What You'll Set Up

• HTTP uptime monitor for the KeeWeb static web app
• WebDAV server connectivity probe (for remote database sync)
• TLS/HTTPS certificate expiry alert
• Static file serving latency checks
• Sync backend reachability monitoring (Dropbox/Google Drive/WebDAV)
• Security header validation

Prerequisites

• KeeWeb deployed and accessible (nginx or Caddy serving the static JS bundle, port 80/443)
• A WebDAV server or cloud sync backend configured for .kdbx file storage (optional)
• A free Vigilmon account

Step 1: Monitor the KeeWeb Web Server

KeeWeb is a static web application — nginx or Caddy serves the JavaScript bundle, and all KeePass operations happen in the browser. If the web server goes down, you cannot access your passwords.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter your KeeWeb URL: https://keeweb.yourdomain.com.
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Click Save.

This is the highest-priority monitor in your KeeWeb setup — a failed check here means your password manager is inaccessible.

Step 2: Monitor Static File Serving Latency

KeeWeb's entire application is a JavaScript bundle (app.js). A slow or missing bundle means the app won't load in the browser even if the web server is technically up.

Add a monitor targeting the KeeWeb app bundle directly:

1. Click Add Monitor → HTTP / HTTPS.
2. URL: https://keeweb.yourdomain.com/app.js.
3. Set Expected HTTP status to 200.
4. Set Check interval to 5 minutes.
5. Click Save.

If app.js returns a 404 or takes more than a few seconds, the KeeWeb interface will be broken for users even though the web server root responds 200.

For a lightweight canary that survives bundle renames across KeeWeb upgrades:

https://keeweb.yourdomain.com/favicon.png

Step 3: WebDAV Server Connectivity

If you sync your KeePass .kdbx database via WebDAV (e.g. through Nextcloud, a dedicated WebDAV server, or nginx with the dav_module), the WebDAV endpoint must be reachable for KeeWeb to open the database file.

Add a TCP port monitor for your WebDAV server:

1. Click Add Monitor → TCP Port.
2. Host: your WebDAV server IP or hostname.
3. Port: 443 (HTTPS WebDAV) or 80.
4. Check interval: 1 minute.
5. Click Save.

For a deeper probe, add an HTTP monitor that performs a WebDAV PROPFIND request:

1. Click Add Monitor → HTTP / HTTPS.
2. URL: https://dav.yourdomain.com/keeweb/ (your WebDAV path).
3. Set Method to HEAD or GET.
4. Set Expected HTTP status to 200, 207 (Multi-Status — the correct WebDAV success code), or 401 (authentication required — confirms the endpoint is alive).
5. Check interval: 5 minutes.

A 404 here means the WebDAV path is misconfigured; a connection timeout means the WebDAV server process is down.

Step 4: KeePass Database File Accessibility

If you serve the .kdbx file over a file server or directly via nginx, the file itself needs to be accessible. Monitor the file URL to confirm it's served correctly:

1. Click Add Monitor → HTTP / HTTPS.
2. URL: https://dav.yourdomain.com/keeweb/passwords.kdbx (your database file path).
3. Set Expected HTTP status to 200 or 401 — a 401 confirms the file server is running and authentication is required (expected behaviour).
4. Check interval: 5 minutes.

Do not set Expected body contains for a .kdbx file — the binary content will not match a text string, and you only need to confirm HTTP-level accessibility, not file integrity.

Step 5: TLS/HTTPS Certificate Expiry

KeeWeb is a password manager — browsers enforce the strictest HTTPS policies on password-related sites, and some browsers will block access entirely on a mixed-content or certificate error. A lapsed certificate is a complete lockout.

1. Open the HTTP monitor created in Step 1.
2. Enable Monitor SSL certificate.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

If you use multiple domains (one for the KeeWeb app, one for the WebDAV server), add a certificate monitor for each. Also add one for your WebDAV host:

1. Open the WebDAV HTTP monitor from Step 3.
2. Enable Monitor SSL certificate with the same 21-day threshold.

Step 6: Sync Backend Reachability (Dropbox / Google Drive)

If users sync their KeePass database via Dropbox or Google Drive instead of a self-hosted WebDAV server, those cloud APIs need to be reachable from your network. Monitor their HTTPS endpoints:

Dropbox:

1. Click Add Monitor → HTTP / HTTPS.
2. URL: https://api.dropboxapi.com.
3. Expected status: 200 or 400 (any response confirms connectivity).
4. Check interval: 10 minutes.

Google Drive:

1. URL: https://www.googleapis.com.
2. Same settings.

These monitors tell you whether a sync failure is caused by your infrastructure or a third-party cloud outage — useful for triaging user reports before escalating to Dropbox/Google support.

Step 7: Security Header Validation

KeeWeb handles passwords in the browser — Content-Security-Policy (CSP) headers are critical for preventing cross-site scripting attacks that could exfiltrate credentials. A missing or broken CSP header is a security regression.

Add a header check to your nginx configuration monitoring:

1. Add a monitor that checks the KeeWeb root URL (same as Step 1).
2. Set Expected response header contains to Content-Security-Policy (if Vigilmon supports header matching).

Alternatively, run a periodic curl command and alert on missing headers:

#!/bin/bash
# /opt/keeweb/bin/csp-check.sh
HEADERS=$(curl -sI https://keeweb.yourdomain.com)
if echo "$HEADERS" | grep -qi "content-security-policy"; then
    curl -s https://vigilmon.online/heartbeat/YOUR_CSP_TOKEN
fi

Schedule via cron and use a Vigilmon heartbeat to alert when the CSP check stops passing.

Step 8: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add Slack, email, or a webhook.
2. On the web server monitor (Step 1), set Consecutive failures before alert to 1 — password manager downtime is always urgent. Do not wait for two consecutive failures.
3. On the WebDAV monitor, set Consecutive failures to 2 — a transient network glitch should not page you at 2 AM.
4. Route TLS certificate alerts to email with a 21-day lead so you have time to renew before any browser blocks access.
5. Route sync backend (Dropbox/Google) monitors to a low-urgency channel — these are upstream failures, not your infrastructure.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP — web server | https://keeweb.yourdomain.com | nginx/Caddy crash | | HTTP — app bundle | /app.js | Static bundle missing or corrupt | | TCP — WebDAV | :443 on WebDAV host | WebDAV server process down | | HTTP — WebDAV path | /keeweb/ (PROPFIND/HEAD) | WebDAV path misconfiguration | | HTTP — database file | /keeweb/passwords.kdbx | KeePass file inaccessible | | SSL — KeeWeb domain | keeweb.yourdomain.com | TLS renewal failure (app) | | SSL — WebDAV domain | dav.yourdomain.com | TLS renewal failure (sync) | | HTTP — Dropbox API | api.dropboxapi.com | Cloud sync connectivity | | Cron heartbeat | CSP check script | Security header regression |

KeeWeb's self-hosted model gives you full control over your password database — but that control comes with the responsibility of keeping the web server, WebDAV backend, and TLS certificates healthy. With Vigilmon watching each layer, you know immediately when nginx goes down, when the WebDAV sync path breaks, or when a certificate is approaching expiry — before you or your team is locked out of your credentials.