PrivateBin is a self-hosted, zero-knowledge encrypted pastebin — pastes are encrypted in the browser before being sent to the server, so even you as the operator can't read them. Teams use it for sharing sensitive snippets, API keys, and confidential notes. But "zero-knowledge" only holds when the service is actually up and the SSL certificate is valid: if TLS breaks, the encryption guarantees break with it. Vigilmon monitors PrivateBin's availability, paste endpoint health, and SSL certificate so you catch failures before users resort to unencrypted alternatives.
What You'll Build
- A web UI availability monitor for the PrivateBin interface
- A paste creation endpoint check to verify write operations work
- SSL certificate monitoring (critical for encrypted content)
- Response time tracking for paste delivery performance
- An alerting setup tailored to PrivateBin's security requirements
Prerequisites
- PrivateBin running (typically via PHP and a web server, often port 80/443)
- A domain with HTTPS configured (strongly recommended — encryption depends on it)
- A free account at vigilmon.online
Step 1: Verify PrivateBin's Web UI Availability
PrivateBin doesn't have a dedicated /health endpoint, but the main page is a reliable availability signal. A successful response confirms PHP is running, your web server is serving the application, and the data directory is accessible:
curl -o /dev/null -w "%{http_code}" https://paste.yourdomain.com/
# 200
PrivateBin's main page includes a recognizable HTML structure you can keyword-match.
Step 2: Create the Web UI Monitor in Vigilmon
- Log in to Vigilmon → Add Monitor → HTTP.
- URL:
https://paste.yourdomain.com/ - Check interval: 60 seconds.
- Response timeout: 15 seconds.
- Expected status:
200. - Keyword:
PrivateBin(appears in the page title and meta description). - Click Save.
This monitor catches:
- PHP-FPM crashes or misconfigurations
- Web server (nginx/Apache/Caddy) failures
- Data directory permission errors (PrivateBin writes paste files to disk)
- DNS resolution failures
Step 3: Monitor the Paste API Endpoint
The web UI loading confirms the frontend works, but paste creation requires the API to function correctly. PrivateBin exposes a JSON API at the root URL with a Content-Type: application/json request. For monitoring purposes, a simpler check is to verify the API responds to a GET with the correct headers:
curl -I https://paste.yourdomain.com/
The response should include Content-Security-Policy headers (PrivateBin sets strict CSP by default). You can also probe the API endpoint directly:
curl -X POST https://paste.yourdomain.com/ \
-H "Content-Type: application/json" \
-d '{"v":2,"ct":"dGVzdA==","adata":[["AAAA","AAAA",100000,256,128,"aes","gcm","zlib"],1,0,0],"meta":{"expire":"5min"}}' \
-o /dev/null -w "%{http_code}"
# 200
For automated monitoring, use a heartbeat script (see Step 5) rather than posting real pastes from an external service.
Step 4: Monitor the SSL Certificate — Critical for PrivateBin
SSL monitoring is more important for PrivateBin than for most services. PrivateBin's zero-knowledge design encrypts content in the browser using SJCL (Stanford JavaScript Crypto Library) before sending it to the server. If your SSL certificate expires:
- Users see browser certificate warnings and can't paste
- Users bypass warnings and send data over potentially compromised connections
- The entire privacy guarantee of the service breaks
Add SSL monitoring immediately:
- Add Monitor → SSL Certificate.
- Domain:
paste.yourdomain.com - Alert when expiry is within: 30 days.
- Alert again: 21 days, 14 days, 7 days, 3 days, 1 day.
Use more alert thresholds than you would for a typical service. A PrivateBin with an expired certificate is worse than no service — it creates a false sense of security.
Multiple alert stages ensure that even if you're traveling and miss the 30-day alert, you get another chance at 7 days and again at 3 days before the certificate fully expires.
Step 5: Set Up a Heartbeat for Paste Write Verification
The most complete check for PrivateBin is verifying that pastes can actually be created and retrieved. Set this up as a server-side heartbeat to avoid sending real HTTP(S) requests from Vigilmon's infrastructure that create test pastes on your server:
#!/bin/bash
# /etc/cron.d/privatebin-heartbeat
# Runs every 5 minutes
# Create a test paste via localhost (no external HTTP)
RESPONSE=$(curl -s -X POST http://localhost/ \
-H "Content-Type: application/json" \
-H "X-Requested-With: JSONHttpRequest" \
-d '{"v":2,"ct":"dGVzdA==","adata":[["AAAAAAAAAAAAAAAAAAAAAA==","AAAAAAAAAAAAAAAAAAAAAA==",100000,256,128,"aes","gcm","zlib"],1,0,0],"meta":{"expire":"5min"}}' \
2>/dev/null)
if echo "$RESPONSE" | grep -q '"status":0'; then
curl -fsS -X POST https://vigilmon.online/api/heartbeat/YOUR-HEARTBEAT-ID
fi
Create a Heartbeat monitor in Vigilmon:
- Add Monitor → Heartbeat.
- Expected interval: 5 minutes.
- Grace period: 10 minutes.
A "status":0 in PrivateBin's API response indicates a successful paste creation. If the heartbeat stops, paste write operations are failing — often caused by a full disk, PHP errors, or permission issues on the data directory.
Step 6: Track Response Time for Paste Delivery
PrivateBin decrypts content in the browser, but it still needs to serve the paste data quickly. Slow response times hurt the user experience even if the service is technically "up." In your web UI monitor:
- Open the monitor → Response time alerts.
- Warn at: 3 seconds.
- Critical at: 8 seconds.
A spike in paste retrieval time usually indicates disk I/O issues (the paste directory has too many files) or the PHP process pool is exhausted. PrivateBin stores each paste as an individual file — on busy instances with thousands of pastes, directory listing operations can become slow.
Step 7: Configure Alerting
In Vigilmon under Settings → Notifications, set up your alert channels:
| Monitor | Trigger | First action |
|---|---|---|
| Web UI availability | Non-200 or keyword missing | Check web server logs; systemctl status php-fpm; verify disk space |
| SSL certificate | < 30 days to expiry | certbot renew or check ACME logs; treat as urgent for PrivateBin |
| Paste write heartbeat | Missed > 10 min | Check PHP error logs; verify /srv/privatebin permissions; check disk space |
| Response time | > 3 s | Check disk I/O; consider running php bin/purge.php to clean expired pastes |
Alert immediately (1 consecutive failure) for the SSL certificate — there is no acceptable grace period for certificate warnings on an encryption service. Use 2 consecutive failures for HTTP availability (to absorb brief blips).
Common PrivateBin Failure Modes and What Vigilmon Catches
| Scenario | Vigilmon monitor | |---|---| | PHP-FPM pool exhausted | Web UI returns 502/503; availability monitor fires | | Disk full → paste writes fail | Heartbeat stops; web UI may still load | | SSL certificate expires | SSL monitor alerts at 30 days; treat as critical | | Data directory permissions change | Heartbeat stops (can't write); web UI may still load | | nginx/Apache crash | Web UI monitor fires immediately | | Too many paste files → slow directory ops | Response time alert fires before full outage | | Config file error after update | Web UI returns PHP error; keyword check fails |
PrivateBin's zero-knowledge design is a meaningful privacy improvement over cloud pastebins, but it places the reliability burden entirely on you. Vigilmon handles the monitoring so you can focus on keeping the service available — watching the web UI, verifying paste creation works, and most importantly, ensuring your SSL certificate never lapses on a service where expired TLS isn't just inconvenient, it's a security failure.
Start monitoring PrivateBin in under 5 minutes — register free at vigilmon.online.