Monitoring Teampass with Vigilmon

Teampass is an open-source collaborative password manager built for teams that need to share operational credentials — server passwords, WiFi keys, API tokens, and database passwords — with granular role-based access control. Unlike personal password managers, Teampass is the single source of truth for your entire ops team's shared secrets. That makes its availability directly tied to your incident response capability: when an alert fires at 2 AM and your team needs the database password, Teampass being down is not just inconvenient — it's blocking. Vigilmon monitors Teampass availability, database connectivity through the login page, SSL certificate health (critical for any credential store), and vault accessibility via heartbeat checks so you know immediately if the team's password vault goes dark.

What You'll Set Up

• HTTP uptime monitor for the Teampass web application (port 80/443)
• Login page health check that validates both app and database connectivity
• API health check for teams using the Teampass REST API
• SSL certificate expiry alerts with a 30-day lead time (essential for credential stores)
• Cron heartbeat that confirms the vault is accessible and serving credentials

Prerequisites

• Teampass running on a LAMP or LEMP stack (Apache or nginx with PHP)
• Teampass accessible over HTTP or HTTPS from a monitoring vantage point
• A free Vigilmon account

Step 1: Monitor Teampass Web Application Availability

Teampass serves its web interface on port 80 (HTTP) or 443 (HTTPS). Add a Vigilmon HTTP monitor:

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter the URL: https://your-teampass-host/ (or http:// if not yet on HTTPS — though see Step 4 on why HTTPS is essential for a credential store).
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Under Keyword check, enter Teampass to confirm the application is running.
7. Click Save.

The request to / redirects to /index.php. A 200 response confirms the web server (Apache or nginx) and PHP are running. The keyword check for Teampass validates you're hitting the actual password manager and not a placeholder page.

Step 2: Monitor the Login Page for Database Health

The Teampass login page at /index.php requires a working MySQL/MariaDB connection to render the login form. PHP errors such as "Database connection failed" or a blank page appear when the database is unreachable — even while the web server returns HTTP 200. The login page keyword check is therefore a combined app + database health signal.

1. Click Add Monitor → HTTP / HTTPS.
2. Enter the URL: https://your-teampass-host/index.php
3. Set Check interval to 1 minute.
4. Set Expected HTTP status to 200.
5. Under Keyword check, enter Login (appears in the login button or form label when MySQL is connected and the form renders correctly).
6. Optionally add a Keyword (must be absent) check for Database connection to catch MySQL error messages that appear inline.
7. Click Save.

This monitor gives you three signals in one probe:

• 200 + Login keyword present → Web server, PHP, and MySQL all healthy.
• 200 + Login keyword absent → PHP running but database error — MySQL is down.
• Non-200 → Web server or PHP crashed.

Step 3: Monitor the Teampass API (If Enabled)

Teampass includes a REST API for programmatic credential retrieval. If your team uses the API for automation or integrations, add an API health monitor:

1. Click Add Monitor → HTTP / HTTPS.
2. Enter the URL: https://your-teampass-host/api/index.php/authenticate
3. Set Method to GET.
4. Set Expected HTTP status to 400 or 200 — an unauthenticated request returns a structured error response when the API module is loaded and working.
5. Under Keyword check, enter error or token to confirm a JSON response is being returned (not a PHP error page).
6. Set Check interval to 5 minutes.
7. Click Save.

If the API returns a PHP fatal error or an HTTP 500 instead of a JSON error response, it indicates the API module is broken or misconfigured — even if the web UI appears functional.

If the Teampass API is not enabled in your configuration, skip this step and rely on the login page monitor from Step 2 as your primary app health signal.

Step 4: SSL Certificate Alerts — Critical for Credential Stores

SSL certificate monitoring is mandatory for Teampass. Unlike most web applications, Teampass transmits shared team credentials — server passwords, API keys, private certificates — over every session. An expired SSL certificate exposes password transmission to potential interception and, critically, causes modern browsers to block access entirely with a certificate error page. Your team cannot access credentials during an incident if the SSL cert has expired.

1. Open the HTTPS monitor created in Step 1.
2. Enable Monitor SSL certificate under the SSL section.
3. Set Alert when certificate expires in less than 30 days.
4. Click Save.

Strongly recommended: Use a 30-day alert window for Teampass — longer than the typical 14-21 days used for general web applications. Certificate renewal failure on a credential store leaves your entire operations team locked out. A 30-day lead time gives your security team time to escalate if automated Let's Encrypt renewal fails.

If Teampass is deployed on a custom domain (e.g. vault.yourdomain.com), verify the certificate is issued for that domain and not just the host's bare IP.

Step 5: Heartbeat Monitoring for Vault Accessibility

Knowing the web server responds with 200 is good. Knowing the vault is actually accessible — that a session can be established and the folder tree loads — is better. Set up a Vigilmon heartbeat to confirm end-to-end vault accessibility on a schedule:

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set the expected ping interval to 70 minutes.
3. Copy the heartbeat URL: https://vigilmon.online/heartbeat/YOUR_TOKEN

Then set up a scheduled health check script on your server:

#!/bin/bash
# Teampass vault availability heartbeat
set -euo pipefail

TEAMPASS_URL="https://your-teampass-host"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/YOUR_TOKEN"
API_KEY="your-teampass-api-key"  # Set in Teampass admin → API

# Authenticate via API and confirm a valid token is returned
RESPONSE=$(curl -s "${TEAMPASS_URL}/api/index.php/authenticate?login=${API_KEY}")

# Check that the response contains a session token (indicates DB + auth working)
if echo "${RESPONSE}" | grep -q '"key"'; then
  curl -s "${HEARTBEAT_URL}"
else
  echo "Teampass vault check failed: ${RESPONSE}" >&2
  exit 1
fi

Add to cron for hourly execution:

30 * * * * /usr/local/bin/teampass_heartbeat.sh

If the API is not enabled or you prefer not to use an API key in a script, use the login page keyword check from Step 2 as your primary vault health signal — the heartbeat then confirms the monitoring chain itself is running rather than the vault content.

A missed heartbeat means the vault accessibility check failed — exactly when your team is likely to need it (during an incident that triggered the alert that sent them to Teampass in the first place).

Step 6: Configure Alert Channels and Escalation

1. Go to Alert Channels in Vigilmon and add email, Slack, PagerDuty, or a webhook.
2. Set Consecutive failures before alert to 1 for all Teampass monitors — credential store downtime is always a priority incident, not something to de-noise.
3. Route Teampass alerts to your security team and on-call rotation separately — this is not just an ops issue, it's a security posture issue if the vault is inaccessible during an incident.

For the SSL certificate alert, add a second notification recipient beyond your standard on-call: your security officer or compliance team. Certificate expiry on a credential store is a security compliance event, not just a service degradation.

Summary

| Monitor | Target | What It Catches | |---|---|---| | Web app availability | https://host/ + keyword Teampass | Web server, PHP runtime down | | Login page + DB | https://host/index.php + keyword Login | MySQL/MariaDB connection failure | | API health | GET /api/index.php/authenticate | API module broken | | SSL certificate | HTTPS cert (30-day alert) | Certificate expiry locking out team | | Cron heartbeat | Hourly authenticated vault check | End-to-end vault inaccessibility |

Teampass is the infrastructure your team depends on when everything else is on fire — it needs to be the most reliably monitored service in your stack, not an afterthought. With Vigilmon watching the web interface, validating MySQL health through the login page keyword, monitoring the SSL certificate with a generous lead time, and confirming vault accessibility via hourly heartbeat, you have the assurance that when the pager goes off at 2 AM, the shared credentials your team needs are actually there.