webwatch

What it is

webwatch is a website availability monitor, in the style of upptime, which MEREBA runs in production to watch its own sites. It checks each website at the frequency you assign, measures the HTTP status code, latency, the expected text and the days left before the TLS certificate expires, and alerts by Telegram, email and push notifications only when a site goes down, recovers or its certificate is about to expire. It includes a progressive web app (PWA) that installs on your phone and, if the monitor itself stops responding, detects it and probes the websites directly from the phone. Today it is a private-use tool and it is not for sale: MEREBA builds a custom version for your company, hosted and maintained by MEREBA.

Features

• Websites are added through a form, each with its own frequency (from 1 to 1440 minutes), GET or HEAD method, accepted HTTP codes, expected text, timeout and TLS validation.
• Measures the HTTP status code, latency, the presence of the expected text and the days left before the certificate expires.
• No false alarms from micro-outages: after a failure it rechecks a minute later and only declares the site down after two failures in a row.
• Alerts only on a change of state: down, recovered (with the outage duration) and certificate expiry thresholds at 14, 7, 3 and 1 days. It never repeats the same alert.
• Three alert channels: Telegram, email and push notifications on your phone.
• Dashboard with an overall traffic light; uptime over 24 hours, 7, 30 and 90 days; 90 days of daily bars and a sparkline; a page per site with a latency chart, incidents and history.
• PWA that installs on your phone and opens offline with the last known status.
• Who watches the watcher: if the monitor does not respond, the PWA detects it in about 6 seconds, alerts on the device and probes the websites directly from the phone.
• Thresholds can be changed without redeploying: failures before declaring an outage, recheck interval, slow latency, TLS warnings and history retention.
• Very lightweight: in production it runs on a Raspberry Pi and each check cycle takes about 3 seconds.

Security

• Google-only sign-in (OpenID Connect with state, nonce and PKCE) for a closed list of accounts: there is no registration and no passwords to steal.
• SSRF protection: it does not follow redirects into the internal network when the monitored website is public, and only accepts http and https.
• The PWA does not store authenticated pages and wipes the device data on sign-out.
• Sessions can be revoked instantly (for example, if a phone is lost), strict CSP and HSTS.
• Access logs with the user pseudonymised, and the checker runs as a hardened system service.
• Push notifications implemented by hand on the standards (VAPID and aes128gcm encryption), with no new dependencies.

Who it is for

Companies and professionals who depend on their websites and want to find out before their customers when one stops working.

Platform

Web, PWA

Version

1.0.1

Technology

Python, py4web, PWA, Web Push, systemd

Markdown version of this page