tutorial

Psono Monitoring with Vigilmon

"Learn how to monitor Psono, the open-source enterprise password manager, with Vigilmon — covering API server health, login flow readiness, database connectivity, SSL certificate alerts, and vault backup heartbeats for self-hosted deployments."

Psono Monitoring with Vigilmon

Psono is an open-source enterprise password and secrets manager that gives teams end-to-end encrypted credential sharing, role-based access control, audit logging, and LDAP/SAML SSO integration — all self-hosted. Because Psono is a security-critical piece of infrastructure (it holds every team credential), its availability must be monitored continuously. A down API server, a broken database connection, or an expired SSL certificate can lock out your entire team from every service credential simultaneously.

This guide covers how to monitor a self-hosted Psono deployment using Vigilmon.

Why Psono Needs Monitoring

Psono failures are high-impact and often silent:

  • Gunicorn/Django API server crash — the Psono REST API stops responding; all browser extensions, mobile apps, and web client sessions fail with network errors
  • PostgreSQL connectivity failure — the API process is running but cannot reach the database; login attempts return 500 errors while the health endpoint may still appear up
  • Nginx frontend outage — the Angular SPA cannot be served; users see a blank page and cannot reach the login screen
  • SSL certificate expiry — an expired certificate on the Psono server exposes authentication tokens to interception and blocks all browser clients with TLS errors
  • Backup failure — a missed pg_dump backup means encrypted vault data is not protected; a server failure would cause permanent credential loss
  • Export pipeline failure — the export API stops working, meaning decryption keys or vault data may be silently corrupted

Vigilmon monitors each of these failure modes proactively so you get alerted before your team loses access to credentials.

Psono Architecture Overview

| Component | Default Port | Role | Monitoring Priority | |-----------|-------------|------|---------------------| | Django/Gunicorn API | 10100 (HTTP) or 443 (HTTPS via proxy) | REST API backend | Critical | | PostgreSQL | 5432 | Vault data store | Critical | | Nginx frontend | 80/443 | Angular SPA server | High | | Backup pipeline | — | pg_dump to object storage | High | | Export API | — | Vault export and key verification | Medium |

Monitor 1: Psono API Server Health

The /server/info/ endpoint confirms the Django/Gunicorn application server is running:

  1. Log in to Vigilmon → Monitors → New Monitor
  2. Type: HTTP
  3. Name: Psono - API Server Health
  4. URL: http://your-psono-host:10100/server/info/ (or https://psono.your-domain.com/server/info/ if behind a reverse proxy)
  5. Method: GET
  6. Expected status: 200
  7. Keyword check: info
  8. Interval: 1 minute

Test your endpoint first:

curl -s http://your-psono-host:10100/server/info/
# Expected: {"info": {"version": "...", "type": "CE"}}

Monitor 2: Psono Login Flow and Database Connectivity

The /authentication/info/ endpoint loads authentication configuration from PostgreSQL. A 200 response confirms both the API server and the database are accessible:

  1. Type: HTTP
  2. Name: Psono - Login Flow / DB Connectivity
  3. URL: https://psono.your-domain.com/authentication/info/
  4. Method: GET
  5. Expected status: 200
  6. Interval: 2 minutes

A 500 response from this endpoint specifically indicates a database connectivity failure — the API process is running but PostgreSQL is unreachable. Monitoring this endpoint separately from /server/info/ catches database failures that the basic API health check misses.

curl -s https://psono.your-domain.com/authentication/info/
# Expected: JSON object with MFA and LDAP configuration fields

Monitor 3: Psono Web Client (Nginx Frontend)

Monitor the Angular SPA served by the Nginx frontend:

  1. Type: HTTP
  2. Name: Psono - Web Client
  3. URL: https://psono.your-domain.com/
  4. Method: GET
  5. Expected status: 200
  6. Keyword check: Psono
  7. Interval: 2 minutes

This monitor confirms that Nginx is serving the Angular SPA correctly. If the web client is down but the API is up, users cannot reach the login screen at all.

Monitor 4: SSL Certificate Alert

Psono stores team credentials. An expired SSL certificate on the Psono server exposes authentication tokens to potential interception and immediately blocks all browser clients with TLS errors:

  1. Type: HTTP
  2. Name: Psono - SSL Certificate
  3. URL: https://psono.your-domain.com/server/info/
  4. SSL certificate expiry alert: 30 days before expiry
  5. Interval: 1 hour

A 30-day lead time gives you sufficient runway to renew the certificate (e.g., via Let's Encrypt or your CA) before any client is affected. For a password manager, do not use a shorter lead time.

Monitor 5: Vault Backup Heartbeat

The Psono PostgreSQL database contains all encrypted password vault data. A failed backup means a server failure would cause permanent credential loss. Use a heartbeat monitor to verify that daily backups complete successfully:

Backup Script

#!/bin/bash
# psono-backup.sh — run daily via cron
set -euo pipefail

TIMESTAMP=$(date +%Y%m%d_%H%M%S)
BACKUP_FILE="/tmp/psono_backup_${TIMESTAMP}.sql.gz"
BUCKET="your-backup-bucket"
VIGILMON_BACKUP_HEARTBEAT="YOUR_HEARTBEAT_ID"

# Dump the Psono database
PGPASSWORD="$PSONO_DB_PASSWORD" pg_dump \
  -h localhost \
  -U psono \
  -d psono \
  | gzip > "$BACKUP_FILE"

# Upload to object storage (example: AWS S3)
aws s3 cp "$BACKUP_FILE" "s3://${BUCKET}/psono/$(basename "$BACKUP_FILE")"

# Clean up local file
rm -f "$BACKUP_FILE"

# Signal successful backup to Vigilmon
curl -s "https://heartbeat.vigilmon.online/$VIGILMON_BACKUP_HEARTBEAT"

echo "[psono-backup] Backup completed: $TIMESTAMP"

Add to cron:

# /etc/cron.d/psono-backup
0 2 * * * psono /opt/psono/psono-backup.sh >> /var/log/psono-backup.log 2>&1

In Vigilmon:

  • Type: Heartbeat
  • Name: Psono - Vault Backup
  • Expected interval: 24 hours
  • Grace period: 2 hours

A missed heartbeat means encrypted vault data has not been backed up and any hardware failure would cause permanent credential loss — alert immediately via email and PagerDuty.

Monitor 6: Export Pipeline Health (Weekly)

Schedule a weekly authenticated export API call to verify the export pipeline is functional and decryption keys are intact:

#!/bin/bash
# psono-export-health.sh — run weekly via cron
set -euo pipefail

PSONO_API="https://psono.your-domain.com"
PSONO_TOKEN="$PSONO_SERVICE_ACCOUNT_TOKEN"
VIGILMON_EXPORT_HEARTBEAT="YOUR_EXPORT_HEARTBEAT_ID"

# Request an export token
HTTP_STATUS=$(curl -s -o /tmp/psono_export_response.json -w "%{http_code}" \
  -H "Authorization: Token $PSONO_TOKEN" \
  "${PSONO_API}/exporttoken/")

if [ "$HTTP_STATUS" -ne 200 ]; then
  echo "[psono-export] Export API returned $HTTP_STATUS — export pipeline may be broken"
  exit 1
fi

# Verify the response contains an export token
if ! grep -q "token" /tmp/psono_export_response.json; then
  echo "[psono-export] Export response did not contain expected token field"
  exit 1
fi

rm -f /tmp/psono_export_response.json
curl -s "https://heartbeat.vigilmon.online/$VIGILMON_EXPORT_HEARTBEAT"
echo "[psono-export] Export pipeline healthy"

In Vigilmon:

  • Type: Heartbeat
  • Name: Psono - Export Pipeline Health
  • Expected interval: 7 days
  • Grace period: 12 hours

Alert Configuration

| Monitor | Type | Interval | Alert Channel | |---------|------|----------|---------------| | API server health | HTTP | 1 min | PagerDuty + Slack | | Login flow / DB connectivity | HTTP | 2 min | PagerDuty + Slack | | Web client (Nginx) | HTTP | 2 min | Slack | | SSL certificate | HTTP | 1 hour | Email + Slack (30-day lead) | | Vault backup | Heartbeat | 24 hours | PagerDuty + Email | | Export pipeline | Heartbeat | 7 days | Email + Slack |

Configure PagerDuty or phone alerts for the API, database, and backup monitors — a Psono outage or backup failure is a security incident, not a routine availability issue.

Status Page

  1. Status Pages → New Page → name it "Psono Password Manager"
  2. Add all monitors above
  3. Share with your IT and security team

During an incident, this page gives every stakeholder an instant view of which Psono component has failed without them needing Vigilmon access.

Summary

Psono is security-critical infrastructure — it holds every team credential. Vigilmon ensures it stays healthy:

  • HTTP monitors for API server health, database connectivity via the login endpoint, and Nginx frontend availability
  • SSL certificate monitoring with a mandatory 30-day lead time to protect authentication token security
  • Heartbeat monitors for daily vault backups and weekly export pipeline verification
  • PagerDuty alerting for the API, database, and backup monitors — these failures are security incidents

Get started at vigilmon.online.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles