Deployment guide

CheckCle

Overview

CheckCle is an open-source, self-hosted monitoring platform for uptime and infrastructure. It watches servers, HTTP and TCP services, SSL certificates, ping targets and scheduled jobs, tracks incidents, sends alerts, and publishes public operational status pages, all from one dashboard.

Its backend is PocketBase, a single Go binary with an embedded SQLite database and a realtime API. CheckCle ships as a single Docker image that also bundles the CheckCle web frontend and a Go monitoring worker.

The SecureAnyCloud image installs Docker CE from the official Docker repository and runs CheckCle 1.6.0 as a container, managed by Docker with a restart policy. The container is bound to the loopback connector 127.0.0.1:8090, behind an nginx reverse proxy on port 80. nginx is configured with the WebSocket/SSE upgrade that CheckCle's realtime dashboards use.

CheckCle's data lives on a dedicated Azure data disk. The factory admin that the upstream image seeds is rotated to a unique, strong password on the first boot of every VM, before the port 80 proxy is opened. No instance is ever reachable with a known default login.

What you get:

CheckCle 1.6.0 running as a container managed by Docker
Docker CE preinstalled from the official Docker apt repository
The CheckCle web UI on :80, fronted by nginx with the WebSocket/SSE upgrade proxied
A unique admin password generated on first boot and recorded in a root-only file, with the well-known factory login rotated away
A dedicated Azure data disk at /opt/checkcle/pb_data that holds the SQLite database, monitoring history and file storage
docker.service and nginx.service as systemd units, enabled and active
An unauthenticated /healthz endpoint for Azure Load Balancer health probes
24/7 SecureAnyCloud support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.
Standard_B2s (2 vCPU, 4 GiB RAM) is a reasonable starting size. Size up for many monitored services or shorter check intervals.
NSG inbound rules that allow 22/tcp from your management network and 80/tcp.

CheckCle serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for CheckCle by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:checkcle-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name checkcle \
  --image sac1647283583153:checkcle-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name checkcle --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active docker.service nginx.service

Both report active. Docker manages the CheckCle container, which is bound to the loopback connector 127.0.0.1:8090. nginx fronts it on port 80 with the WebSocket/SSE upgrade that CheckCle's realtime dashboards require.

CheckCle's SQLite database, monitoring history and file storage live on the dedicated Azure data disk mounted at /opt/checkcle/pb_data.

Step 5 - Retrieve your admin password

CheckCle signs in with an email and password. On first boot, the well-known factory admin is rotated to a unique password for your VM, and the password is written to a root-only file:

sudo cat /root/checkcle-credentials.txt

The file contains CHECKCLE_ADMIN_EMAIL (admin@example.com), the generated checkcle.admin.pass, and the URL to open.

Store the password somewhere safe.

Step 6 - Confirm the health endpoints

nginx serves an unauthenticated static health endpoint for load balancers and probes. CheckCle's PocketBase backend exposes its own health API:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires authentication, so you can use it for an Azure Load Balancer health probe.

Step 7 - Confirm access is protected

The upstream image ships a well-known factory login (admin@example.com / Admin123456). On first boot, SecureAnyCloud rotates that password to the unique per-VM value from Step 5 before nginx opens port 80, so the default login never works on your instance.

Confirm that a superuser-only resource refuses an unauthenticated request:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8090/api/collections/_superusers/records

It prints 403, which means the resource is protected.

The screenshot below shows the full proof captured on a live VM. The health probe returns ok, the unauthenticated superuser request is refused with 403, and the factory password is rejected with 400. Only the per-VM password issues an authentication token.

Step 8 - Sign in to the console

Browse to http://<vm-public-ip>/. CheckCle shows a sign-in page. Enter admin@example.com and the password from Step 5.

Step 9 - Explore the monitoring dashboard

Once you are signed in, the Overview dashboard is your home page. It summarises up, down, paused and warning services and lists everything you are currently monitoring.

Select New Service to add an uptime check for an HTTP endpoint, TCP port, ping target or scheduled job.

Step 10 - Monitor SSL certificates and domains

Open SSL & Domain in the sidebar to track certificate validity across your domains. CheckCle groups certificates into valid, expiring-soon and expired, and can alert you before a certificate lapses.

Select Add Domain to start monitoring one.

Step 11 - Plan maintenance and track incidents

Open Schedule & Incident to record planned maintenance windows and manage incidents. Scheduled maintenance is grouped into upcoming, ongoing and completed. Incidents that you open here can be surfaced on your public operational status page.

Step 12 - Confirm data lives on the dedicated disk

CheckCle's SQLite database, monitoring history and file storage are stored under /opt/checkcle/pb_data on the dedicated Azure data disk, which is bind-mounted into the container as /mnt/pb_data. The data survives OS changes, and the disk can be resized independently:

findmnt /opt/checkcle/pb_data

The mount is backed by a separate Azure data disk that is captured into the image and re-provisioned on every VM.

Maintenance

Admin password: the admin password is rotated on first boot. To change it again, sign in and use the account menu, or update the superuser with sudo docker exec checkcle /app/pocketbase superuser update admin@example.com '<new-password>' --dir /mnt/pb_data.
Add monitors: use New Service on the dashboard to add HTTP, TCP, ping and scheduled-job checks. Configure per-service intervals, thresholds and notifications.
Notifications: configure alert channels (email, Telegram, Slack, Discord and webhooks) under the settings panel, then attach them to services and incidents.
Status pages: publish a public operational status page from Operational Page to share uptime with your users.
Upgrades: CheckCle runs as the checkcle container from the pinned operacle/checkcle:v1.6.0 image. To upgrade, pull a newer tag, remove the container, and re-run it with the same -v /opt/checkcle/pb_data:/mnt/pb_data mount so that your data is preserved.
Storage: all CheckCle state lives under /opt/checkcle/pb_data on the data disk. Back up that volume to protect your monitoring history.
TLS: CheckCle serves plain HTTP on port 80. Front it with TLS (for example, certbot with your own domain) before running it in production.
Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch CheckCle on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs CheckCle, the open-source, self-hosted uptime and infrastructure monitoring platform. CheckCle watches uptime, SSL certificates, servers and services, with incident tracking, alerting and public status pages, all from a clean realtime web dashboard. It is deployable entirely within your own VPC.

CheckCle is distributed as a single Docker container. The container bundles a PocketBase backend (an embedded SQLite datastore with a REST and realtime API and an admin dashboard), the CheckCle web frontend, and a monitoring worker. nginx runs in front as a reverse proxy. The container listens on 127.0.0.1:8090 and is reached through nginx on port 80 (and 443 once you add TLS).

On the first boot of every deployed instance, a one-shot service creates the container, rotates the administrator to a unique per-instance password, and only then opens port 80. The login is written to /root/checkcle-credentials.txt with mode 0600. No default administrator and no shared credential ships in the image, and the well-known upstream default is never reachable off-box.

What you get:

CheckCle running as a single Docker container behind an nginx reverse proxy
A dedicated, independently resizable EBS data volume mounted at /opt/checkcle/pb_data, which holds the monitoring history and database and is kept separate from the operating system disk
A unique per-instance administrator password, generated on first boot before port 80 opens
24/7 SecureAnyCloud support

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users will reach CheckCle on
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for CheckCle. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger. The CheckCle data volume is attached automatically.

Select Launch instance. First-boot initialisation takes about a minute after the instance state becomes Running and the status checks pass.

Launch the instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud CheckCle Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <sub-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <sub-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=checkcle-01}]'

The command prints a JSON document on success. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and retrieve the administrator login

Connect over SSH with the key pair you selected and the public IP address from step 2. The SSH login user depends on the operating system of the AMI variant you launched:

AMI variant SSH login user

Ubuntu 24.04 ubuntu

Open an SSH session, replacing <your-key.pem> with your private key file and <public-ip> with the instance address:

ssh -i <your-key.pem> ubuntu@<public-ip>

CheckCle has no default administrator. On first boot, a per-instance administrator password is generated and written to a root-only file. Retrieve the sign-in details:

sudo cat /root/checkcle-credentials.txt

The file lists the dashboard URL, the administrator email (admin@example.com), and the generated password:

CHECKCLE_URL=http://<public-ip>/ CHECKCLE_ADMIN_EMAIL=admin@example.com checkcle.admin.pass=<generated-per-instance>

Confirm the services are running

CheckCle runs as a Docker container fronted by nginx. Confirm that both system services are active:

systemctl is-active docker.service nginx.service

Both report active:

active active

Confirm that the CheckCle container is running the pinned image:

sudo docker ps --filter name=checkcle --format '{{.Names}} {{.Image}} {{.Status}}'

checkcle operacle/checkcle:v1.6.0 Up 8 minutes

The backend exposes an unauthenticated health endpoint through nginx. It returns 200:

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/api/health

nginx listens on port 80, and the CheckCle container is bound to the loopback interface on port 8090. The backend is never exposed directly:

sudo ss -tln | grep -E ':80 |:8090 '

LISTEN 0 4096 127.0.0.1:8090 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 511 [::]:80 [::]:*

Sign in to the web dashboard

Browse to http://<public-ip>/ and sign in as admin@example.com with the password from step 3. You land on the monitoring overview, which summarises up, down, paused and warning services and lists everything you are currently monitoring.

For production use, change the administrator email and password, or create additional users, under the Setting Panel. CheckCle serves plain HTTP on port 80 out of the box, so put it behind TLS (step 8) before you expose it to the internet.

Create your first monitor

From the overview, select NewService. Give the service a name, choose a service type (HTTP, ping, TCP, DNS and others are supported), enter the target URL or host, and set a check interval. Then select Create Service.

CheckCle begins checking immediately. Within one interval, the service appears on the overview with a live Up or Down status, response time and uptime percentage. Select a monitor to open its detail view with response-time history.

You can verify the backend and the per-instance credential from the instance itself. The following commands read the generated password from the root-only file and authenticate against the PocketBase superuser API, which returns an authentication token:

PW=$(sudo grep '^checkcle.admin.pass=' /root/checkcle-credentials.txt | cut -d= -f2-)
RESP=$(curl -s -X POST -H 'Content-Type: application/json' \
  -d "{\"identity\":\"admin@example.com\",\"password\":\"$PW\"}" \
  http://localhost:8090/api/collections/_superusers/auth-with-password)
echo "$RESP" | grep -q '"token"' && echo "AUTH OK (superuser token issued)" || echo "AUTH FAILED"

AUTH OK (superuser token issued)

Configure alerting and status pages

Open the Schedule & Incident and Operational Page areas to configure incident handling and to publish a public status page for your monitored services.

Notification channels and alert templates are configured per service when you create or edit a monitor, so an on-call engineer is notified the moment a check fails.

SSL & Domain adds certificate expiry monitoring for your domains. Regional Monitoring lets you run checks from distributed agents.

Configure HTTPS

CheckCle is served over plain HTTP on port 80 by default. To serve it over HTTPS, point a DNS record at the instance, make sure inbound port 443 is open in the security group, and use the packaged nginx with Certbot.

Replace <your-domain> with your fully qualified domain name and <your-email> with your contact email:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> -m <your-email> --agree-tos --redirect -n

Certbot obtains a certificate, edits the nginx site to serve TLS on port 443, and sets up automatic renewal. After it completes, browse to https://<your-domain>/.

Back up and maintain

All CheckCle state lives under /opt/checkcle/pb_data on the dedicated data volume. This includes the SQLite database, monitoring history and file storage. Confirm the mount and its free space:

df -h /opt/checkcle/pb_data | tail -1

Back up the monitoring data by snapshotting the EBS data volume, or by archiving the directory to a location of your choice. Replace <backup-dir> with your target path:

sudo tar -czf <backup-dir>/checkcle-pb_data-$(date +%F).tgz -C /opt/checkcle pb_data

Review the container and service logs when troubleshooting:

sudo docker logs checkcle --tail 50
sudo journalctl -u nginx.service --no-pager | tail -20

To upgrade CheckCle, contact SecureAnyCloud support. SecureAnyCloud validates each new release against this image and publishes updated AMIs.

Support

SecureAnyCloud provides 24/7 technical support for this product via email and live chat. Support covers initial deployment, upgrades to new CheckCle releases, configuring uptime, SSL, server and service monitors, alerting, notifications and public status pages, TLS termination, and performance tuning.

Email: sales@secureanycloud.com
Live chat: available 24/7 on secureanycloud.com

For refund requests or billing inquiries, contact us via email and we will respond within one business day.

Deploy on AWS

Launch CheckCle on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS