How to Monitor Waypoint with Vigilmon

HashiCorp Waypoint provides a consistent workflow — build, deploy, release — across Kubernetes, Nomad, ECS, and other platforms. The Waypoint server coordinates all deployments; its UI and API are the single pane of glass for your team's delivery pipeline. When Waypoint's server goes unhealthy, deployments stall, the URL service stops routing preview URLs, and teams lose visibility into what's running where. Vigilmon gives you external monitoring of the Waypoint server, your deployed application endpoints, and the URL service that Waypoint manages — so you know about failures before your next deployment attempt.

What You'll Build

• A health monitor on the Waypoint server's gRPC-web HTTP endpoint
• Monitors on application endpoints Waypoint has deployed and manages
• A check on the Waypoint URL service for preview URL routing
• SSL certificate monitoring for your Waypoint server and application domains
• An alerting setup tuned to deployment pipeline severity

Prerequisites

• A running HashiCorp Waypoint 0.11+ server accessible over HTTPS
• At least one application deployed via Waypoint
• A free account at vigilmon.online

Step 1: Understand Waypoint's Architecture and What to Monitor

Waypoint has three layers worth monitoring:

1. Waypoint server: The central coordination component. Hosts the API (gRPC), the web UI, and manages runner state. If the server is down, waypoint up and waypoint deploy fail.
2. Deployed application endpoints: HTTP endpoints Waypoint deployed to your target platform (Kubernetes, ECS, Nomad). Waypoint doesn't monitor these for you — it just deploys them.
3. Waypoint URL service: Waypoint provisions preview URLs (e.g., https://app--v5.waypoint.run) for deployed versions. This service is a reverse proxy managed by HashiCorp. If it's degraded, preview links in your CD pipeline return errors.

Step 2: Monitor the Waypoint Server HTTP Endpoint

The Waypoint server exposes an HTTP interface (default port 9702) that serves both the web UI and gRPC-web calls. Check that it's reachable and returning the expected response:

curl -I https://waypoint.example.com:9702/

The Waypoint UI returns a 200 with an HTML response when the server is healthy.

Add a Vigilmon monitor:

1. Log in to Vigilmon → Add Monitor → HTTP.
2. URL: https://waypoint.example.com:9702/.
3. Check interval: 60 seconds.
4. Response timeout: 10 seconds.
5. Expected status: 200.
6. Label: Waypoint server UI.
7. Click Save.

Port note: If you've placed Waypoint behind a reverse proxy (nginx, Caddy, or a cloud load balancer), use the proxied URL instead of the raw port. This also exercises your proxy config, which is worth monitoring independently.

Step 3: Monitor the Waypoint API Health

Waypoint exposes a simple status endpoint through its HTTP gateway. Check it directly:

curl https://waypoint.example.com:9702/v1/status

If your Waypoint version exposes a dedicated health path, use it:

curl https://waypoint.example.com:9702/healthz

Add a Vigilmon monitor:

1. Add Monitor → HTTP.
2. URL: https://waypoint.example.com:9702/healthz.
3. Check interval: 60 seconds.
4. Expected status: 200.
5. Label: Waypoint API health.
6. Click Save.

Alert after: 1 consecutive failure. An unhealthy Waypoint API means zero deployments can proceed.

Step 4: Monitor Your Deployed Application Endpoints

Waypoint manages the deployment lifecycle, but it doesn't continuously verify that the applications it deployed are serving traffic. Add Vigilmon monitors to the actual endpoints Waypoint has released:

For each application Waypoint manages, add a monitor on the release URL:

1. Add Monitor → HTTP.
2. URL: https://your-app.example.com/health (the application's own health endpoint).
3. Check interval: 60 seconds.
4. Expected status: 200.
5. Keyword: "status":"ok" (if your app returns a JSON health body).
6. Label: [App name] (Waypoint-managed).
7. Click Save.

Multiple deployments: If Waypoint manages multiple apps across platforms (Kubernetes + ECS, for example), create one monitor per release URL. Label them clearly with the platform so alerts route to the right team.

Step 5: Monitor the Waypoint URL Service

Waypoint's URL service provisions stable preview URLs for each deployment — useful for QA reviews and PR-based workflows. The URL service is hosted by HashiCorp and routes traffic to your runners. Add a check to detect when this routing layer is degraded:

Test a known preview URL from a recent deployment:

curl -I https://app--v5.waypoint.run/

Or monitor the URL service root to verify routing infrastructure is alive:

1. Add Monitor → HTTP.
2. URL: A recent preview URL from waypoint ui or the Waypoint dashboard.
3. Check interval: 5 minutes.
4. Expected status: 200.
5. Label: Waypoint URL service (preview).
6. Click Save.

Rotating preview URLs: Preview URLs change with each deployment. For CI/CD integration, parse the URL from waypoint deploy output and update your monitor via the Vigilmon API:

PREVIEW_URL=$(waypoint deploy -plain | grep 'URL:' | awk '{print $2}')
curl -X PATCH https://api.vigilmon.online/monitors/YOUR_MONITOR_ID \
  -H "Authorization: Bearer $VIGILMON_TOKEN" \
  -d "{\"url\": \"$PREVIEW_URL\"}"

Step 6: Monitor SSL Certificates

Waypoint serves its API and UI over TLS. Expiry of the Waypoint server's certificate causes the Waypoint CLI to fail all API calls:

openssl s_client -connect waypoint.example.com:9702 2>/dev/null | openssl x509 -noout -dates

Add certificate monitors:

1. Add Monitor → SSL Certificate.
2. Domain: waypoint.example.com.
3. Alert when expiry is within: 30 days.
4. Alert again: 14 days, 7 days, 3 days, 1 day.
5. Click Save.

Repeat for each application domain Waypoint has released.

Step 7: Integrate Monitoring into Your Waypoint Pipeline

Add Vigilmon health checks as a step in your Waypoint CI/CD workflow:

# .github/workflows/deploy.yml
- name: Deploy with Waypoint
  run: waypoint up -plain

- name: Verify deployment health
  run: |
    sleep 30  # allow the deployment to stabilize
    STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://your-app.example.com/health)
    if [ "$STATUS" != "200" ]; then
      echo "Health check failed with status $STATUS"
      exit 1
    fi

This catches deployment-level failures (the app deployed but is unhealthy) that Waypoint's release step doesn't verify.

Step 8: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels:

| Monitor | Trigger | Action | |---|---|---| | Waypoint server UI | Non-200 or timeout | Check Waypoint server process; review server logs | | Waypoint API health | Non-200 | Check gRPC server health; restart Waypoint server if needed | | Application endpoint | Non-200 or keyword missing | Inspect Waypoint deployment logs; roll back with waypoint release | | URL service preview | Non-200 | Check Waypoint status page; verify runner connectivity | | SSL certificates | < 30 days to expiry | Renew TLS cert; check Waypoint server TLS configuration |

Alert after: 1 failure for the Waypoint server (no CLI operations will work); 2 failures for application endpoints (transient during rolling updates).

Common Waypoint Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Waypoint server process crash | Server UI monitor fires; all waypoint CLI calls fail | | gRPC API degraded | API health monitor fires; deploys hang at the API call | | Application deployment failed or unhealthy | App endpoint monitor fires independently of Waypoint's view | | URL service routing degraded | Preview URL monitor fires; PR review links stop working | | TLS cert expired on Waypoint server | SSL monitor alerts at 30-day threshold; CLI fails with cert errors | | Application TLS cert expired | App SSL monitor fires; browser shows security error | | Rolling deploy causes transient 502 | App endpoint monitor fires briefly; use 2-failure threshold |

HashiCorp Waypoint unifies your deployment workflow across platforms — but when the Waypoint server itself goes down, or the applications it deploys go unhealthy, your team loses both the delivery tool and the running service at the same time. Vigilmon adds the external layer that Waypoint lacks: continuous verification that the server is reachable, the deployed apps are healthy, and the URL service routing preview links is working — all with alerts before anyone tries to run the next deployment.

Start monitoring Waypoint in under 5 minutes — register free at vigilmon.online.