tutorial

Monitoring Pgrok with Vigilmon

Pgrok is your self-hosted ngrok alternative — but running your own tunnel infrastructure means owning its uptime. Here's how to monitor every critical component of a Pgrok server, from the dashboard to SSH tunnel health and TLS certificates, with Vigilmon.

Pgrok is a self-hosted, multi-tenant HTTP and TCP reverse tunneling server — think ngrok but entirely on your own infrastructure. Teams use it to expose local services through stable public URLs without paying per-seat SaaS fees. But when you run Pgrok yourself, you own the reliability of the entire tunnel stack: the dashboard, the SSH endpoint that clients connect through, the HTTP proxy that routes traffic into active tunnels, and the TLS certificates protecting those tunnels. Vigilmon gives you a monitoring layer across all of it, so tunnel failures surface as alerts rather than as silent unavailability reports from your end users.

What You'll Set Up

  • Dashboard web server uptime monitor (port 3000)
  • SSH tunnel server health check (port 2222)
  • HTTP/HTTPS tunnel proxy availability monitor (port 80/443)
  • Tunnel registration API health check
  • PostgreSQL/SQLite database connectivity monitor
  • TLS certificate expiry alerts for the wildcard tunnel domain
  • Cron heartbeat for active tunnel connection health

Prerequisites

  • Pgrok installed and running on a VPS or dedicated server
  • Dashboard accessible at https://pgrok.yourdomain.com (port 3000)
  • SSH tunnel endpoint reachable on port 2222
  • A free Vigilmon account

Step 1: Monitor the Pgrok Dashboard (Port 3000)

The Pgrok admin dashboard is the control plane — it's where users manage accounts, view active tunnels, and inspect connection logs. If it's down, no new tunnels can be registered.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter your dashboard URL: https://pgrok.yourdomain.com (or http://your-server-ip:3000 if you haven't set up a domain yet).
  4. Set Check interval to 1 minute.
  5. Set Expected HTTP status to 200.
  6. Click Save.

If Pgrok exposes a dedicated health or status endpoint (check your version's documentation at /healthz or /status), prefer that over the root path — it typically validates internal state rather than just returning the HTML shell.

Step 2: Monitor the SSH Tunnel Server (Port 2222)

Clients connect to Pgrok by opening an SSH reverse tunnel to port 2222. If this port is unreachable, all tunnel registrations fail silently from the client's perspective.

  1. Click Add Monitor → set Type to TCP Port.
  2. Enter your server's hostname or IP and set Port to 2222.
  3. Set Check interval to 1 minute.
  4. Click Save.

A TCP monitor simply verifies that the port is open and accepting connections — it doesn't complete the SSH handshake. This is the right level of check here: you want to know the SSH daemon is up, not simulate a full tunnel registration on every probe.

For deeper validation, you can optionally use Vigilmon's cron heartbeat approach: run a periodic test tunnel connection from a monitoring host and have it ping a heartbeat URL on success. That gives you end-to-end tunnel registration confirmation.

Step 3: Monitor the HTTP/HTTPS Tunnel Proxy (Ports 80 and 443)

Pgrok's reverse proxy receives inbound HTTP/HTTPS traffic and routes it through active tunnels to client services. This is the component your end users hit directly.

Add two monitors — one for HTTP redirect and one for HTTPS termination:

HTTP monitor (port 80):

  1. Click Add Monitor → TCP Port.
  2. Hostname: your Pgrok server's public domain or IP.
  3. Port: 80.
  4. Interval: 1 minute.
  5. Save.

HTTPS monitor (port 443):

  1. Click Add Monitor → HTTP / HTTPS.
  2. URL: https://pgrok.yourdomain.com (or any active tunnel subdomain like https://test.pgrok.yourdomain.com).
  3. Expected status: 200 or 404 (a 404 on the root with no active tunnel is still a healthy proxy response).
  4. Enable Monitor SSL certificate and set the expiry alert to 21 days.
  5. Save.

The HTTPS monitor doubles as your TLS certificate check — see Step 6 for more on certificate alerting.

Step 4: Monitor the Tunnel Registration API

When a Pgrok client runs pgrok http 3000, it calls Pgrok's internal API to register the tunnel and claim a subdomain. If this API is degraded, clients get errors during tunnel setup even though the SSH port appears open.

  1. Click Add Monitor → HTTP / HTTPS.
  2. URL: https://pgrok.yourdomain.com/api/v1/tunnels (adjust to your actual API route — check Pgrok's documentation for the registration endpoint).
  3. Expected status: 200 or 401 (an authentication challenge on a protected endpoint still confirms the API is responding).
  4. Interval: 2 minutes.
  5. Save.

If Pgrok doesn't expose a publicly reachable API health route, fall back to monitoring the dashboard root and watching for error responses from the HTTP proxy as your proxy-health proxy signal.

Step 5: Monitor Database Connectivity

Pgrok stores user accounts, tunnel configurations, and connection logs in either PostgreSQL or SQLite. A database failure means Pgrok can't authenticate users, register new tunnels, or write logs — tunnels in flight may continue briefly, but nothing new will work.

For PostgreSQL-backed Pgrok:

Add a Vigilmon TCP monitor for your database server:

  1. Add Monitor → TCP Port.
  2. Host: your PostgreSQL server (often localhost or a private IP if co-located).
  3. Port: 5432.
  4. Interval: 2 minutes.
  5. Save.

If your PostgreSQL server is on a private network not reachable by Vigilmon's probes, add a lightweight health endpoint to your Pgrok instance or use a Vigilmon cron heartbeat:

#!/bin/bash
# Check Pgrok's database by exercising an authenticated API call
RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" \
  -H "Authorization: Bearer $PGROK_ADMIN_TOKEN" \
  https://pgrok.yourdomain.com/api/v1/admin/users)

if [ "$RESPONSE" = "200" ]; then
  curl -s https://vigilmon.online/heartbeat/YOUR_HEARTBEAT_TOKEN
fi

Schedule this with cron every 5 minutes. If the admin user list call succeeds, the database is reachable.

For SQLite-backed Pgrok:

SQLite is file-local, so a TCP port check doesn't apply. Instead, use a cron heartbeat that validates an admin API endpoint as above — any authenticated call that reads from the database serves as your connectivity check.

Step 6: TLS Certificate Expiry Monitoring

Pgrok typically terminates TLS for tunnel subdomains using a wildcard certificate (e.g., *.pgrok.yourdomain.com). If the certificate expires, every tunnel's HTTPS endpoint stops working simultaneously — a wide-blast failure that's easy to miss until users start reporting broken connections.

The HTTPS monitor you created in Step 3 already covers this. Verify the SSL settings:

  1. Open the HTTPS monitor for https://pgrok.yourdomain.com.
  2. Confirm Monitor SSL certificate is enabled.
  3. Set Alert when certificate expires in less than 21 days.
  4. Save.

If you have additional wildcard domains (e.g., a staging tunnel domain), add a separate HTTPS monitor for each:

https://any-tunnel.staging.pgrok.yourdomain.com

A 21-day alert window is appropriate for Let's Encrypt certificates (90-day lifetime) — it gives you three weeks to investigate auto-renewal failures and re-issue manually if needed.

Step 7: Configure Alert Channels

  1. Go to Alert Channels in Vigilmon and add your preferred notification target: Slack, email, PagerDuty, or a webhook.
  2. For the SSH port monitor, set Consecutive failures before alert to 2 — brief TCP hiccups during Pgrok restarts or kernel updates can cause a single failure without a real outage.
  3. For the TLS certificate monitor, set Consecutive failures before alert to 1 — certificate expiry is a hard failure with no transient case.

For teams using Pgrok in production, route the SSH tunnel monitor and the HTTP proxy monitor to an on-call rotation. Route the dashboard monitor and API monitor to a lower-urgency channel — they're high priority but typically not wake-at-3am emergencies.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP uptime | https://pgrok.yourdomain.com | Dashboard down, web server crash | | TCP port 2222 | SSH tunnel endpoint | SSH daemon down, client registration blocked | | TCP port 80 | HTTP proxy | Reverse proxy down | | HTTPS + SSL | https://pgrok.yourdomain.com | Proxy down, wildcard cert expiry | | Tunnel registration API | /api/v1/tunnels | API degraded, new tunnels fail | | TCP port 5432 | PostgreSQL | Database unreachable | | Cron heartbeat | Heartbeat URL | End-to-end tunnel registration failure |

Pgrok gives your team a self-hosted tunnel infrastructure without per-seat costs — but the reliability of that infrastructure is yours to own. With Vigilmon checking each layer, from the SSH handshake endpoint to the TLS certificate protecting your wildcard domain, tunnel failures show up as alerts on your phone before your users notice them.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles