Monitoring Yopass with Vigilmon

Yopass is an open-source, self-hosted secure secrets sharing service written in Go with a React frontend. It lets DevOps teams, security teams, and IT helpdesks share sensitive information — passwords, API keys, tokens, private notes — via an encrypted, one-time-use URL that self-destructs after being accessed once or when a TTL expires. The browser performs AES-256 encryption before sending anything to the server; Yopass stores only ciphertext and the decryption key never leaves the URL fragment. Secrets travel over HTTPS and disappear automatically. But when the Go server crashes or the Memcached/Redis backend becomes unavailable, every secret-sharing attempt fails silently — and your team falls back to Slack DMs or email, exactly what Yopass was designed to prevent. Vigilmon keeps continuous watch on the Yopass web UI, API router, backend store, and SSL certificate.

What You'll Set Up

• HTTP monitor for the Yopass web application (port 1337)
• API health monitor via expected-404 probe
• TCP probe for the Memcached or Redis backend
• SSL certificate alerts (required for Yopass security model)
• Cron heartbeat for full-stack secrets creation verification

Prerequisites

• Yopass running (Docker, binary, or systemd)
• Memcached (port 11211) or Redis (port 6379) running as the backend store
• Yopass accessible on port 1337 (default) or behind a reverse proxy
• A free Vigilmon account

Step 1: Monitor the Yopass Web Application

Yopass serves its React SPA from the Go HTTP server on port 1337. A 200 response from GET / confirms the Go server is running and serving the frontend.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter the URL: https://yopass.yourdomain.com/ (or http://your-server:1337/ for internal deployments).
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Under Keyword check, enter Yopass — the page title contains this string.
7. Click Save.

For Docker deployments, Yopass runs on port 1337 by default:

docker run -p 1337:1337 \
  -e MEMCACHED=memcached:11211 \
  jhaals/yopass --database memcached --address 0.0.0.0:1337

Step 2: Monitor the Yopass API via Expected-404 Probe

The Yopass API router at /api/secret/{id} returns HTTP 404 for non-existent secret IDs — this is the expected response for a missing or already-consumed secret. A 404 from this endpoint confirms the Go HTTP server is routing requests and the Memcached/Redis backend is reachable; a 500 error indicates the backend is unavailable.

1. Click Add Monitor → HTTP / HTTPS.
2. Enter the URL: https://yopass.yourdomain.com/api/secret/healthcheck
3. Set Check interval to 2 minutes.
4. Set Expected HTTP status to 404.
5. Leave Keyword check empty (the 404 response body may vary).
6. Click Save.

This probe is elegant because it uses the expected error as a health signal: if Vigilmon receives 404, the API router and backend connection are both working. If it receives 500, 502, or a timeout, the backend is down.

# Manual verification
curl -I https://yopass.yourdomain.com/api/secret/doesnotexist
# HTTP/2 404  ← backend is connected and responding
# HTTP/2 500  ← backend (Memcached/Redis) is unavailable

Step 3: TCP Probe for the Backend Store

Yopass without a working backend cannot store or retrieve any secrets. All creation requests return errors immediately. Add a TCP probe directly to the Memcached or Redis port for fast detection of backend failure.

For Memcached (default Yopass backend):

1. Click Add Monitor → TCP Port.
2. Enter the host and port: your-server:11211
3. Set Check interval to 1 minute.
4. Click Save.

For Redis:

1. Click Add Monitor → TCP Port.
2. Enter the host and port: your-server:6379
3. Set Check interval to 1 minute.
4. Click Save.

A TCP probe failure without a corresponding API failure means the backend is still responding over HTTP (e.g. cached responses) but the store itself is down — you'll see failures in secret creation before the API probe triggers.

If your Memcached or Redis runs in Docker on the same host:

# docker-compose.yml
services:
  yopass:
    image: jhaals/yopass
    ports:
      - "1337:1337"
    command: --database memcached --address 0.0.0.0:1337
    depends_on:
      - memcached
  memcached:
    image: memcached:alpine
    ports:
      - "11211:11211"

Step 4: SSL Certificate Alerts

SSL is not optional for Yopass — it's a fundamental part of the security model. The decryption key is stored in the URL fragment (the part after #), which browsers do not send to the server. But without HTTPS, the full URL including the fragment can be logged by HTTP proxies, intercepted by network observers, or appear in browser history on shared machines. An expired SSL certificate breaks every secret-sharing link in your organization.

1. Open the HTTP monitor for your Yopass URL (created in Step 1).
2. Enable Monitor SSL certificate under the SSL section.
3. Set Alert when certificate expires in less than 30 days — use a longer window than typical for Yopass, since an SSL failure is a security failure, not just an availability failure.
4. Click Save.

Common Yopass reverse proxy with nginx and Let's Encrypt:

server {
    listen 443 ssl;
    server_name yopass.yourdomain.com;
    ssl_certificate /etc/letsencrypt/live/yopass.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yopass.yourdomain.com/privkey.pem;

    location / {
        proxy_pass http://localhost:1337;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

A 30-day alert window gives you two full renewal cycles to address Let's Encrypt renewal failures before the certificate expires.

Step 5: Heartbeat Monitoring for Full-Stack Secrets Creation

The monitors above catch individual component failures, but a heartbeat that creates a real test secret verifies the entire Yopass stack end to end: HTTPS endpoint → Go API → backend storage → TTL configuration.

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set the expected ping interval to 30 minutes.
3. Copy the heartbeat URL.
4. Create a script that creates a test secret and pings the heartbeat on success:

#!/bin/bash
# /usr/local/bin/check-yopass-stack.sh

YOPASS_URL="https://yopass.yourdomain.com"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/your-heartbeat-id"

# Create a test secret with 1-hour TTL
RESPONSE=$(curl -sf -X POST "${YOPASS_URL}/api/secret" \
  -H "Content-Type: application/json" \
  -d '{"message": "healthcheck", "expiration": 3600, "one_time": true}')

# Check that we got a valid secret ID back
SECRET_ID=$(echo "$RESPONSE" | jq -r '.message // empty')

if [ -n "$SECRET_ID" ] && [ "$SECRET_ID" != "null" ]; then
  # Full stack is working — ping heartbeat
  curl -sf "$HEARTBEAT_URL"
else
  echo "$(date): Yopass secret creation failed: $RESPONSE" >> /var/log/yopass-check.log
fi

5. Schedule with cron:

*/30 * * * * /usr/local/bin/check-yopass-stack.sh

The test secret is created with "one_time": true and a 1-hour TTL — it self-destructs whether or not it's consumed, so it doesn't accumulate in your backend store.

Also monitor backend memory usage to prevent Memcached evicting non-expired secrets when memory fills:

# Check Memcached memory usage
echo "stats" | nc localhost 11211 | grep "bytes "
# bytes 12345678  ← current bytes used

If Memcached evicts secrets before their TTL, users will get 404 errors when they try to open a valid link.

Step 6: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add Slack, email, or PagerDuty.
2. Route SSL certificate alerts to your security team channel separately — an SSL failure is a security incident, not just a service availability issue.
3. Set Consecutive failures before alert to 1 for the TCP backend probe — a backend outage immediately breaks all secret creation.
4. For the web UI monitor, set Consecutive failures before alert to 2 — the Go server occasionally takes a few seconds to respond after container restarts.

Summary

| Monitor | Target | What It Catches | |---|---|---| | Web UI | https://yopass.domain.com/ | Go HTTP server down | | API router | https://yopass.domain.com/api/secret/healthcheck (expects 404) | API/backend connectivity | | TCP — Memcached | server:11211 | Memcached store unavailable | | TCP — Redis | server:6379 | Redis store unavailable | | SSL certificate | https://yopass.domain.com | Expired cert breaks security model | | Creation heartbeat | Heartbeat URL | Full-stack creation failure |

Yopass replaces the insecure habit of sharing credentials via Slack or email — but only when it's running. When the Go server or its backend store goes down, your team falls back to exactly the channels Yopass was designed to replace. Vigilmon watches every layer of the stack so a Memcached restart or an expired certificate doesn't silently push sensitive secrets back into your chat logs.