Monitoring Private Servers

Some servers can run a job but cannot open a connection to the public internet. You can still monitor them by running a narrow proxy on a peer machine that can reach the Cronitor Telemetry API.

This page is about outbound pings: the private host sends a heartbeat or job event to Cronitor. It does not let Cronitor request a URL inside the private network. For that, run the check on a host that can already see the URL and report the result as a job. See Monitoring Private Endpoints and APIs.

Configuring your Nginx proxy

Any proxy can do this. The example uses Nginx as a reverse proxy from the private network to cronitor.link. The paths below match the Debian and Ubuntu package layout (sites-available and sites-enabled). On other distributions, put the same server block in the include directory your package uses, often /etc/nginx/conf.d/.

1. Install Nginx with your package manager, or from the Nginx download page.
2. On Debian or Ubuntu, disable the default site:

sudo unlink /etc/nginx/sites-enabled/default

1. Create /etc/nginx/sites-available/cronitor-proxy. Use the proxy host's address, and allow only the subnet that should send pings. The sample host is 192.168.50.5, so the allow is 192.168.50.0/24. That is a private subnet. Do not allow a wide public block such as 192.0.0.0/8.

server {
    listen 80;

    # The proxy host, in this example 192.168.50.5
    server_name 192.168.50.5;

    location / {
        resolver 8.8.8.8;
        proxy_pass https://cronitor.link:443$request_uri;

        # Subnet of the hosts that send pings
        allow 192.168.50.0/24;
        deny all;
    }
}

1. Enable the site and reload Nginx:

sudo ln -s /etc/nginx/sites-available/cronitor-proxy /etc/nginx/sites-enabled/cronitor-proxy
sudo service nginx restart

The proxy accepts requests from that subnet on port 80 and forwards them to cronitor.link over TLS. It is not a general web proxy: deny all rejects every other client, and proxy_pass only targets cronitor.link. The proxy host itself must be able to resolve and reach cronitor.link.

This config is a reverse proxy. It does not implement HTTP CONNECT, so it will not tunnel an https:// client request. Clients should call the proxy with http://.

Using your proxy server with Curl

Curl uses http_proxy for http:// URLs and https_proxy for https:// URLs. Because this proxy listens on port 80 and does not handle CONNECT, set http_proxy and ping with http://. The proxy opens the TLS connection to Cronitor.

Crontab can set the variable for the jobs below it. Crontab runs /bin/sh, so variables from your shell profile are not visible there.

http_proxy=192.168.50.5:80

# m h dom mon dow   command
0 1 * * * /path/to/job.sh && curl -fsS -m 10 "http://cronitor.link/p/YOUR_TELEMETRY_KEY/nightly-job?state=complete"

Replace YOUR_TELEMETRY_KEY with a telemetry key from API settings. A code-only URL such as http://cronitor.link/d3x0c1/complete still works when anonymous events are enabled. Accounts created after January 11, 2021 have to turn that on. The /p/YOUR_TELEMETRY_KEY/... form does not need it.

Outside crontab, you can export the variable in a shell profile:

echo 'export http_proxy=192.168.50.5:80' >> ~/.bash_profile
source ~/.bash_profile

The example reports complete only when job.sh exits 0. To report a failure, send state=fail from the other branch, or wrap the command with cronitor exec as described in Using Cronitor CLI. The rest of the telemetry API applies. Use http:// in front of cronitor.link so the request hits this proxy.

Using your proxy server with other HTTP clients

Most HTTP clients can use a proxy. If yours cannot, send the ping to the proxy host and keep the path. http://cronitor.link/p/YOUR_TELEMETRY_KEY/nightly-job?state=run becomes http://192.168.50.5/p/YOUR_TELEMETRY_KEY/nightly-job?state=run.