How to Monitor Spacelift Infrastructure Deployments with Vigilmon

Spacelift is a policy-driven CI/CD platform built specifically for infrastructure-as-code — it orchestrates Terraform, OpenTofu, Pulumi, Ansible, and Kubernetes runs with fine-grained access controls, drift detection, and GitOps workflows. But once Spacelift finishes a run, it hands off to the infrastructure. Whether the infrastructure it provisioned is actually healthy and reachable is a question Spacelift itself doesn't answer.

In this tutorial you'll add external uptime monitoring to the services and endpoints your Spacelift stacks deploy, using Vigilmon — free tier, no credit card required.

Why Spacelift deployments need external monitoring

Spacelift shows you that a deployment run succeeded. It does not show you whether the resulting infrastructure is working:

Terraform apply success ≠ healthy service — a Terraform run can apply cleanly while provisioning a misconfigured load balancer that returns 502, a security group that blocks all inbound traffic, or a DNS record pointing to a decommissioned IP
Drift detection runs on a schedule — Spacelift's drift detection tells you when state diverges from code, but it doesn't tell you whether the live endpoint is serving users between drift checks
Policy enforcement can't catch runtime failures — OPA policies validate configuration before apply; they can't catch a service that crashes 30 seconds after the load balancer registers it as healthy
Module outputs don't guarantee availability — a Spacelift stack might output an ALB DNS name that's perfectly valid in Terraform state but points to a target group with no healthy targets
Multi-stack dependencies — when one stack's output feeds another stack's input, a failure in the deployed service isn't visible in either stack's run history

Vigilmon monitors the endpoints your Spacelift stacks create, continuously and from external vantage points. You get alerted the moment a service goes down — not when a developer notices or when the next Spacelift drift check runs.

What you'll need

A Spacelift account with at least one active stack
A deployed service with an accessible HTTP/HTTPS endpoint
A free Vigilmon account (sign up takes 30 seconds)

Step 1: Identify the endpoints your stacks deploy

Start by inventorying what each Spacelift stack actually creates. The most common outputs to monitor are:

# terraform outputs — typically in outputs.tf
output "api_url" {
  value = "https://${aws_lb.api.dns_name}"
}

output "app_url" {
  value = "https://${cloudflare_record.app.hostname}"
}

output "health_endpoint" {
  value = "https://${aws_lb.api.dns_name}/health"
}

In Spacelift, you can view these outputs in the stack's Resources and Outputs tabs after a successful run.

Add a health check endpoint to your application if it doesn't already have one:

# FastAPI example
@app.get("/health")
def health_check():
    return {
        "status": "ok",
        "version": os.getenv("APP_VERSION", "unknown"),
        "stack": os.getenv("SPACELIFT_STACK_ID", "unknown")
    }

Verify your endpoint responds before adding it to Vigilmon:

curl -f https://your-stack-output.example.com/health
# {"status":"ok","version":"1.2.3","stack":"my-api-stack"}

Step 2: Set up HTTP monitoring in Vigilmon

Log in to vigilmon.online and go to Monitors → New Monitor
Choose HTTP / HTTPS
Set the URL to your stack's output endpoint (e.g., https://api.yourcompany.com/health)
Set the check interval to 1 minute
Under Expected response:
- Status code: 200
- (Optional) Response body contains: "status":"ok"
Save the monitor

Organizing monitors by Spacelift stack

Name your monitors to mirror your Spacelift stack hierarchy, so you can correlate a Vigilmon alert with a specific stack at a glance:

| Stack | Endpoint | Vigilmon monitor name | |-------|----------|-----------------------| | prod/api | https://api.yourcompany.com/health | spacelift/prod/api | | prod/web | https://app.yourcompany.com/health | spacelift/prod/web | | staging/api | https://api-staging.yourcompany.com/health | spacelift/staging/api |

Step 3: Automate monitor creation with the Vigilmon API

Manually adding a Vigilmon monitor after every Spacelift deployment doesn't scale. Use a Spacelift Notification Policy and a small webhook handler to automate it.

Spacelift notification policy (OPA/Rego):

# notification-policy.rego
package spacelift

# Notify on successful finished runs for tracked stacks
notify[run] {
  run := input.run_updated
  run.state == "FINISHED"
  run.type == "TRACKED"
}

Webhook handler (Node.js/Express) that creates a Vigilmon monitor on deploy:

const express = require('express');
const app = express();
app.use(express.json());

const VIGILMON_API = 'https://vigilmon.online/api/v1';
const VIGILMON_KEY = process.env.VIGILMON_API_KEY;

app.post('/spacelift/webhook', async (req, res) => {
  const { state, stack_id, outputs } = req.body;

  if (state !== 'FINISHED') return res.sendStatus(200);

  const healthUrl = outputs?.health_endpoint || outputs?.api_url;
  if (!healthUrl) return res.sendStatus(200);

  // Create a Vigilmon HTTP monitor for the deployed endpoint
  await fetch(`${VIGILMON_API}/monitors`, {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${VIGILMON_KEY}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      name: `spacelift/${stack_id}`,
      type: 'http',
      url: healthUrl,
      interval: 60,
      expected_status: 200
    })
  });

  res.sendStatus(201);
});

app.listen(3000);

Step 4: Heartbeat monitoring for Spacelift scheduled tasks

Many Spacelift stacks include scheduled runs — drift detection, cost optimization scripts, or periodic data pipeline triggers. These are jobs, not services, and you need to know if they stop running.

Use Vigilmon's heartbeat monitors for these:

In Vigilmon, go to Monitors → New Monitor
Choose Heartbeat
Set the expected interval to match your Spacelift scheduled run cadence
Copy the heartbeat URL

Add a heartbeat ping to your Spacelift stack's after-run hook:

# Spacelift runtime hook — after run completes
#!/bin/bash

if [ "$TF_VAR_environment" = "production" ]; then
  curl -fsS --retry 3 "https://hb.vigilmon.online/your-heartbeat-id" > /dev/null
  echo "Vigilmon heartbeat sent for production drift check"
fi

Configure the hook in your Spacelift stack settings under Hooks → After-run.

If a scheduled Spacelift run fails, errors out, or gets blocked waiting for approval, the heartbeat stops. Vigilmon alerts you within one missed interval.

Step 5: Configure alert channels

When a service goes down after a Spacelift deployment, you want to know immediately — and know which stack to investigate.

Email alerts

In Vigilmon, go to Alert Channels → Add Channel → Email
Add your platform engineering distribution list
Assign the channel to your Spacelift-related monitors

Webhook alerts for Slack

Go to Alert Channels → Add Channel → Webhook
Enter your Slack incoming webhook URL
Assign the channel to your monitors

Vigilmon sends a structured payload on failure:

{
  "monitor_name": "spacelift/prod/api",
  "status": "down",
  "url": "https://api.yourcompany.com/health",
  "started_at": "2024-01-15T10:23:00Z",
  "duration_seconds": 180
}

You can wire this back into Spacelift — a webhook handler that triggers a Spacelift run to re-apply the stack or roll it back:

# Trigger a Spacelift re-run via API when Vigilmon fires
curl -X POST "https://app.spacelift.io/graphql" \
  -H "Authorization: Bearer $SPACELIFT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "mutation { runTrigger(stack: \"my-api-stack\") { id } }"}'

Correlating Vigilmon alerts with Spacelift runs

When an alert fires, check the Spacelift run timeline to see if a recent deployment correlates with the outage:

Open the affected Spacelift stack
Go to Runs and look for a run that finished in the 10–30 minutes before Vigilmon detected the failure
Review the Terraform plan diff for changes that could affect availability — security group modifications, load balancer listener changes, DNS record updates

Step 6: SSL certificate monitoring

Spacelift often manages TLS certificates through ACM, Let's Encrypt, or Vault PKI. Vigilmon monitors certificate expiry automatically for HTTPS monitors. You receive alerts:

30 days before expiry — time to renew before impact
7 days before expiry — urgent
On expiry — monitor reports down

If your Spacelift stack uses Terraform to provision certificates but certificate rotation happens out-of-band, Vigilmon provides the safety net your IaC can't.

Step 7: Status page for deployed infrastructure

Give your team and stakeholders a single view of all infrastructure deployed by Spacelift stacks.

In Vigilmon, go to Status Pages → New Status Page
Name it: "Platform Infrastructure"
Add monitors organized by environment:
- Production: API, web app, data pipeline
- Staging: API, web app
Publish the page

Use the status page URL in your Slack #incidents channel pinned message so engineers check it first before escalating.

Putting it all together

| Monitor | Type | Maps to | |---------|------|---------| | https://api.yourcompany.com/health | HTTP | prod/api stack | | https://app.yourcompany.com/health | HTTP | prod/web stack | | api.yourcompany.com:443 | TCP | Load balancer port binding | | Drift check heartbeat | Heartbeat | Scheduled drift detection run | | https://api.yourcompany.com | SSL | Certificate expiry |

What's next

Stack-level status pages — create a separate Vigilmon status page per Spacelift space (team or environment) so each team owns their uptime view
Deployment window pausing — during Spacelift planned deployment windows, pause Vigilmon monitors to suppress false alerts; resume them automatically when the run finishes via webhook
Cost and drift correlation — combine Spacelift cost estimation with Vigilmon downtime data to understand the business impact of infrastructure failures

Get started free at vigilmon.online — no credit card, monitors start running in under a minute.