Monitoring Padloc with Vigilmon

Padloc is an open source, end-to-end encrypted password manager that you can self-host on your own infrastructure. Your team gets full control over credential storage with zero vendor lock-in — but that control means you own the uptime too. Vigilmon gives your Padloc server the same level of observability you'd expect from a hosted service: HTTP health checks, sync API availability monitoring, storage backend verification, and instant alerts when authentication fails or the service goes down.

What You'll Set Up

• HTTP uptime monitor for the Padloc server health endpoint (port 3000)
• Sync API availability check to detect broken vaults
• TCP port monitor as a low-level liveness signal
• SSL certificate expiry alerts for your Padloc domain
• Alert channels with tuned failure thresholds

Prerequisites

• Padloc Server running and accessible (default port 3000)
• A domain or subdomain pointing at your Padloc instance with HTTPS
• A free Vigilmon account

Step 1: Monitor the Padloc Server Health Endpoint

Padloc Server exposes a health route at /healthcheck that returns 200 OK when the service is running. This is your primary liveness check.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter your Padloc health URL: https://padloc.yourdomain.com/healthcheck
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Click Save.

If you're running Padloc on a non-standard port without a reverse proxy, use the port directly:

http://your-server-ip:3000/healthcheck

For production deployments, always place Padloc behind a reverse proxy (nginx, Caddy) so HTTPS and port 443 are the public entry points.

Step 2: Check the Sync API Endpoint

The sync API is the critical path for Padloc clients — if it's unavailable, users can't load or update their vaults even if the server process is running. Add a dedicated monitor for the API base:

1. Click Add Monitor → HTTP / HTTPS.
2. URL: https://padloc.yourdomain.com/api
3. Set Expected HTTP status to 200 or 404 — the API responds with a structured error on unknown routes, which still confirms the service is reachable.
4. Optionally add a Keyword match: set it to "Content-Type": "application/json" in the response headers to confirm the API layer is responding, not a proxy error page.
5. Set Check interval to 2 minutes.
6. Click Save.

A synthetic health endpoint in your Padloc deployment (if you control the server code) gives a cleaner signal:

// server/src/routes/health.ts
router.get('/api/health', async (ctx) => {
  ctx.body = { status: 'ok', version: pkg.version };
});

Step 3: TCP Port Monitor for Low-Level Liveness

An HTTP monitor confirms the app is responding; a TCP monitor confirms the port is open at the network level. If nginx crashes but the Node.js process is still running, the HTTP monitor may pass while the TCP monitor on port 443 fails — giving you a clearer picture of what broke.

1. Click Add Monitor → TCP Port.
2. Set Host to your Padloc server hostname or IP.
3. Set Port to 443 (or 3000 if not behind a proxy).
4. Set Check interval to 1 minute.
5. Click Save.

For Padloc deployments behind nginx:

server {
    listen 443 ssl;
    server_name padloc.yourdomain.com;

    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Monitor both port 443 (nginx) and — from inside your network — port 3000 (Node.js) so you can distinguish proxy failures from application failures.

Step 4: SSL Certificate Expiry Alerts

Padloc clients verify TLS certificates before connecting. An expired certificate blocks every user immediately — no graceful degradation. Get ahead of expiry with certificate monitoring:

1. Open the HTTP monitor you created in Step 1.
2. Enable Monitor SSL certificate under the SSL section.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

If you're using Let's Encrypt with Certbot or Caddy auto-TLS, the auto-renewal cron may silently fail when port 80 is blocked. A 21-day alert window gives you three weeks to diagnose and fix renewal before clients start seeing certificate errors.

Check your renewal configuration:

# Certbot
certbot renew --dry-run

# Caddy
journalctl -u caddy --since "1 hour ago" | grep -i cert

Step 5: Alerting for Auth Failures (Webhook Integration)

Padloc Server logs authentication events to stdout. You can pipe these logs through a small script that pings a Vigilmon webhook monitor when repeated auth failures occur — a signal of either a brute-force attempt or a misconfigured client.

First, create a Push (Webhook) monitor in Vigilmon:

1. Click Add Monitor → Push / Heartbeat.
2. Set the expected ping interval to 5 minutes.
3. Copy the heartbeat URL: https://vigilmon.online/heartbeat/abc123.

Then create a log-watcher script:

#!/bin/bash
# /opt/padloc/auth-watchdog.sh
# Run as: journalctl -u padloc -f | bash /opt/padloc/auth-watchdog.sh

HEARTBEAT_URL="https://vigilmon.online/heartbeat/abc123"
FAILURE_THRESHOLD=10
count=0

while IFS= read -r line; do
  if echo "$line" | grep -q "authentication failed\|invalid token\|unauthorized"; then
    count=$((count + 1))
    if [ "$count" -ge "$FAILURE_THRESHOLD" ]; then
      # Stop pinging — Vigilmon will alert on missed heartbeat
      echo "Auth failure threshold reached: $count failures"
      count=0
      sleep 300
    fi
  else
    # Healthy traffic — ping the heartbeat
    curl -s "$HEARTBEAT_URL" > /dev/null
  fi
done

Run this as a systemd service alongside Padloc. When authentication failures accumulate beyond your threshold, the script stops pinging and Vigilmon alerts on a missed heartbeat.

Step 6: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and connect Slack, email, PagerDuty, or a webhook.
2. For the health endpoint monitor, set Consecutive failures before alert to 2 — this avoids single-probe false positives during Node.js garbage collection pauses.
3. For the SSL monitor, use the default (alert on first failure) because certificate expiry is deterministic, not transient.
4. Set up a Maintenance window in Vigilmon for planned Padloc updates:

# Pause monitoring before a Padloc upgrade
curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"monitor_id": "YOUR_MONITOR_ID", "duration_minutes": 10}'

# Upgrade Padloc
docker pull padloc/server:latest
docker-compose up -d

# Maintenance window expires automatically

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP health | /healthcheck | Server crash, app errors | | Sync API | /api | API layer failure, vault unavailability | | TCP port | :443 or :3000 | Proxy or process down | | SSL certificate | Padloc domain | TLS expiry before clients break | | Heartbeat watchdog | Heartbeat URL | Auth failure spike, brute-force attempts |

Self-hosting Padloc gives your team full control over credentials without trusting a third-party vault. Vigilmon closes the observability gap — so when something goes wrong with your password manager infrastructure, you know before your users do.