Gatus 5.36.0

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened Uptime Kuma, Gatus & Uptime and Status Pages AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• Once the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for the full launch wizard. In Version, choose Gatus 5.36.0 on Ubuntu 24.04, then choose your Region.
• Pick an instance type (m5.large recommended) and your key pair. The software charge is $0.04 per vCPU per hour.
• Set the security group. The listing's default group allows SSH (22), HTTP (80) and HTTPS (443). Restrict SSH to your own IP address, and restrict 80/443 to the people who need the status page.
• Choose your VPC and a subnet that gives the instance a public IP. Leave the metadata defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this command on your own workstation. It creates a security group that allows SSH and the dashboard from your management address only, then launches the instance. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and replace the VPC, subnet, key pair and CIDR with your own:

SG=$(aws ec2 create-security-group --group-name gatus \
  --description "Gatus" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 443 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 80 --cidr <your-mgmt-cidr>
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=gatus}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot finishes within a minute of launch. It creates the HTTPS certificate, generates the password and starts nginx, and then Gatus starts its checks. Read your login from a root-only file:

sudo cat /root/gatus-credentials.txt

# Gatus - generated on first boot by gatus-firstboot.service
# These credentials are unique to this instance. Store them somewhere safe. GATUS_URL=https://ec2-3-93-242-11.compute-1.amazonaws.com/ GATUS_USERNAME=admin GATUS_PASSWORD=<GATUS_PASSWORD>
#
# Open GATUS_URL in a browser (self-signed certificate minted on this instance's first boot; port 80 # redirects to https) and sign in with the username and password above. The same credentials protect # the JSON API (/api/v1/endpoints/statuses) and the status badges. # Change the name it is served as:
sudo gatus-set-hostname <your-dns-name>
#
# The default endpoints monitor this instance only. Add your own services to /etc/gatus/config.yaml
# (Gatus reloads it automatically). Restrict 80/443 in the security group to the people who need the page.
# Full deployment guide: https://secureanycloud.com/stacks/gatus-5-36-0/

GATUS_PASSWORD holds your instance's own password.

Confirm that first boot, Gatus and nginx are active, that Gatus runs as the unprivileged gatus user, and that the open health endpoint answers:

systemctl is-active gatus-firstboot.service gatus.service nginx.service ps -o user= -C gatus test "$(curl -sk https://localhost/healthz)" = ok && echo "healthz ok"

active active active gatus healthz ok

/healthz is served by nginx without a login, so you can use it for a load balancer health check over HTTPS. Everything else needs the password.

These are the only ports the instance listens on:

sudo ss -Hltnu | awk '{print $1, $5}' | sort -u

tcp 0.0.0.0:22 tcp 0.0.0.0:443 tcp 0.0.0.0:80 tcp 127.0.0.1:8080 tcp 127.0.0.53%lo:53 tcp 127.0.0.54:53 tcp [::]:22 tcp [::]:443 tcp [::]:80 udp 127.0.0.1:323 udp 127.0.0.53%lo:53 udp 127.0.0.54:53 udp 172.31.83.83%ens5:68 udp [::1]:323

Gatus (8080) listens on loopback only, and nginx publishes it on 443. The loopback port 53 entries are Ubuntu's local stub resolver (systemd-resolved). Port 323 is chrony's local control socket, and port 68 is the DHCP client.

The binary is the reproducible SecureAnyCloud build of the 5.36.0 source. Its record ships with the image:

sha256sum /usr/local/bin/gatus grep -E '^(source|toolchain |binary|govulncheck)' /usr/share/doc/gatus/BUILD-INFO.txt

07676fb59df06f69deb9d1c155c21eff7da6d0bb4e32585ed82d06cc7f982a66 /usr/local/bin/gatus source https://github.com/TwiN/gatus/archive/refs/tags/v5.36.0.tar.gz source sha256 b5543af591e602281406049ee2f822a6529a8f14be0cd54df5a31c210520159a (tag commit ed1107b41a30e22047eecfb6dbc3be5e39829d5a) toolchain go1.27.3 linux/amd64, official tarball https://go.dev/dl/go1.27.3.linux-amd64.tar.gz toolchain sha256 65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 binary sha256 07676fb59df06f69deb9d1c155c21eff7da6d0bb4e32585ed82d06cc7f982a66 (reproducible) govulncheck v1.9.0 -mode=binary and source mode: only GO-2026-5932 (DB updated: 2026-10-21 00:27:29 +0000 UTC)

Browse to the GATUS_URL from Step 2, for example https://ec2-3-93-242-11.compute-1.amazonaws.com/. The certificate is self-signed, so your browser warns once. Accept it, or install your own certificate (Step 8). Without a login, nginx answers 401 and your browser asks for a username and password:

Sign in as admin with the password from Step 2. The Gatus health dashboard lists the three starter endpoints, each with its latest result and a bar per check:

Select an endpoint to open its detail page, which shows the current status, the average and range of response times, the recent checks and a response-time chart:

Port 80 only redirects to the HTTPS address:

curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' http://localhost/

301 https://ec2-3-93-242-11.compute-1.amazonaws.com/

You can check the login from the command line too. These requests go to nginx on the instance itself. The API refuses a request with no password or a wrong one, and the instance's own password returns the endpoint statuses.

The command reads the password from the credentials file and passes it to curl on standard input, never on the command line. It stops with an error if any answer is not the expected one:

H=$(sudo sed -n 's/^set $gatus_host "\(.*\)";$/\1/p' /etc/nginx/gatus-host.conf) AUTH() {
sudo sed -n 's/^GATUS_PASSWORD=\(.*\)$/user = "admin:\1"/p' /root/gatus-credentials.txt; }
U=$(curl -sk --resolve "$H:443:127.0.0.1" -o /dev/null -w '%{http_code}' "https://$H/api/v1/endpoints/statuses")
W=$(printf 'user = "admin:not-the-password"\n' | curl -K - -sk --resolve "$H:443:127.0.0.1" -o /dev/null -w '%{http_code}' "https://$H/api/v1/endpoints/statuses")
A=$(AUTH | curl -K - -sk --resolve "$H:443:127.0.0.1" -o /dev/null -w '%{http_code}' "https://$H/api/v1/endpoints/statuses")
echo "unauth : $U";
echo "wrongpw : $W";
echo "authed : $A" [ "$U" = 401 ] && [ "$W" = 401 ] && [ "$A" = 200 ]

unauth : 401 wrongpw : 401 authed : 200

The dashboard is built on a JSON API that you can use from scripts. This command lists every endpoint with how many results Gatus holds and whether the latest check passed. It fails unless all three starter endpoints are healthy:

H=$(sudo sed -n 's/^set $gatus_host "\(.*\)";$/\1/p' /etc/nginx/gatus-host.conf) AUTH() {
sudo sed -n 's/^GATUS_PASSWORD=\(.*\)$/user = "admin:\1"/p' /root/gatus-credentials.txt; }
J=$(AUTH | curl -K - -sk --resolve "$H:443:127.0.0.1" "https://$H/api/v1/endpoints/statuses")
echo "$J" | jq -r '.[] | "\(.key) results=\(.results|length) last_success=\(.results[-1].success)"' test "$(echo "$J" | jq -r '[.[] | select(.results[-1].success == true) | .name] | sort | join(",")')" = "gatus,nginx-https,ssh"

this-instance_gatus results=8 last_success=true this-instance_nginx-https results=8 last_success=true this-instance_ssh results=8 last_success=true

Each endpoint's key is <group>_<name>. The detail of one check shows each condition and its result:

H=$(sudo sed -n 's/^set $gatus_host "\(.*\)";$/\1/p' /etc/nginx/gatus-host.conf) AUTH() {
sudo sed -n 's/^GATUS_PASSWORD=\(.*\)$/user = "admin:\1"/p' /root/gatus-credentials.txt; } AUTH | curl -K - -sk --resolve "$H:443:127.0.0.1" "https://$H/api/v1/endpoints/this-instance_nginx-https/statuses" \
  | jq -e '.results[-1] | {status, success, conditionResults}'

{ "status": 200, "success": true, "conditionResults": [ { "condition": "[STATUS] == 200", "success": true }, { "condition": "[BODY] == pat(ok*)", "success": true }, { "condition": "[CERTIFICATE_EXPIRATION] > 720h", "success": true } ] }

Status badges live under the same API, for example https://<your-host>/api/v1/endpoints/this-instance_ssh/health/badge.svg, and also need the password.

The configuration is /etc/gatus/config.yaml. Only root and the gatus service account can read it, because the alerting tokens you add will live there. This is the starter file:

sudo stat -c '%a %U:%G %n' /etc/gatus/config.yaml
sudo grep -vE '^\s*#|^$' /etc/gatus/config.yaml

640 root:gatus /etc/gatus/config.yaml storage: type: sqlite path: /var/lib/gatus/data.db web: address: 127.0.0.1 port: 8080 metrics: false ui: title: "Status | Gatus" header: "Service Health" description: "Live health and uptime of the services monitored by this instance." endpoints: - name: nginx-https group: this-instance url: "https://127.0.0.1/healthz" interval: 60s client: insecure: true conditions: - "[STATUS] == 200" - "[BODY] == pat(ok*)" - "[CERTIFICATE_EXPIRATION] > 720h" - name: gatus group: this-instance url: "http://127.0.0.1:8080/health" interval: 60s conditions: - "[STATUS] == 200" - "[BODY].status == UP" - name: ssh group: this-instance url: "tcp://127.0.0.1:22" interval: 60s conditions: - "[CONNECTED] == true"

Edit it with sudoedit, or your editor of choice through sudo, and append your services under endpoints:. This example adds a website with a response-time and certificate check, a database port and a DNS record:

sudoedit /etc/gatus/config.yaml

- name: website group: production url: "https://www.example.com/" interval: 60s conditions: - "[STATUS] == 200" - "[RESPONSE_TIME] < 800" - "[CERTIFICATE_EXPIRATION] > 336h" - name: postgres group: production url: "tcp://10.0.1.20:5432" interval: 30s conditions: - "[CONNECTED] == true" - name: dns-www group: production url: "1.1.1.1" dns: query-name: "www.example.com" query-type: "A" conditions: - "[DNS_RCODE] == NOERROR"

Gatus checks the file for changes every 30 seconds and reloads it on its own, so you do not need to restart it. If an edit does not parse, Gatus logs the error and exits, and systemd keeps restarting it every few seconds. The dashboard is down until you correct the file, and then it comes back by itself. Check the service and the log after each change:

systemctl is-active gatus
sudo journalctl -u gatus -n 20 --no-pager -o cat

To be notified when a check fails, add an alerting: block (for example Slack, email or PagerDuty) and an alerts: list on each endpoint. The Gatus alerting documentation has an example for every provider. Keep the file 0640 root:gatus.

The Gatus log shows each check as it runs:

sudo journalctl -u gatus -n 3 --no-pager -o cat | grep -E 'success=(true|false)'

2026/10/21 13:24:55 [watchdog.executeEndpoint] Monitored group=this-instance; endpoint=nginx-https; key=this-instance_nginx-https; success=true; errors=0; duration=0s 2026/10/21 13:24:55 [watchdog.executeEndpoint] Monitored group=this-instance; endpoint=gatus; key=this-instance_gatus; success=true; errors=0; duration=1ms 2026/10/21 13:24:55 [watchdog.executeEndpoint] Monitored group=this-instance; endpoint=ssh; key=this-instance_ssh; success=true; errors=0; duration=0s

Gatus runs its checks from this instance, so it can watch services that are not on the internet at all: databases, private APIs and load balancers in the same VPC or in peered VPCs. Make sure the security groups of those services allow traffic from this instance's security group.

ICMP (icmp://) checks work too, without giving Gatus any capability. The image allows unprivileged ICMP sockets for the gatus group only (/etc/sysctl.d/60-sac-gatus-ping.conf).

The certificate was created on your instance's first boot for the instance's public DNS name, public IP, private IP and localhost. The key, the password hash and the credentials file are readable only by root, except that nginx's group can read the hash. Inspect the certificate:

sudo openssl x509 -in /etc/ssl/gatus/gatus.crt -noout -subject -dates -ext subjectAltName
sudo stat -c '%a %U:%G %n' /etc/ssl/gatus/gatus.key /etc/ssl/gatus/gatus.crt /etc/nginx/.gatus.htpasswd /root/gatus-credentials.txt

subject=CN = ec2-3-93-242-11.compute-1.amazonaws.com, O = sac notBefore=Oct 21 13:17:50 2026 GMT notAfter=Jan 23 13:17:50 2029 GMT X509v3 Subject Alternative Name: DNS:ec2-3-93-242-11.compute-1.amazonaws.com, IP Address:3.93.242.11, IP Address:172.31.83.83, IP Address:127.0.0.1, DNS:localhost 600 root:root /etc/ssl/gatus/gatus.key 644 root:root /etc/ssl/gatus/gatus.crt 640 root:www-data /etc/nginx/.gatus.htpasswd 600 root:root /root/gatus-credentials.txt

To serve the dashboard under your own DNS name, point the name at this instance (for example status.example.com) and run the helper. It records the name, creates a new self-signed certificate for it, updates nginx and rewrites the URL in the credentials file:

sudo gatus-set-hostname status.example.com

If the instance's public address changes after a stop and start, run the helper again so the certificate names the new address too.

To use a certificate from your own certificate authority, replace /etc/ssl/gatus/gatus.key (keep it 0600 root) and /etc/ssl/gatus/gatus.crt, then run sudo systemctl reload nginx.

gatus.service and nginx.service carry a systemd IPAddressDeny rule for the instance metadata addresses, so no check can reach the metadata service, even if an endpoint's URL points at it. Each entry is a single address, so the Amazon Time Sync Service at 169.254.169.123 keeps working, as chrony shows:

systemctl show -p IPAddressDeny gatus.service nginx.service chronyc -n sources | grep 169.254

IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 ^* 169.254.169.123 3 4 377 10 -4996ns[-5971ns] +/- 619us