Configuration¶

Gatus reads one file, /etc/gatus/config.yaml. This page shows what is in it, how to add your own endpoints, and how to apply changes.

Where things live¶

Path	What it is
`/etc/gatus/config.yaml`	The Gatus configuration
`/var/lib/gatus/data/gatus.db`	SQLite history
`/var/lib/gatus/tls/cert.pem`, `key.pem`	This instance's TLS certificate and key
`/var/lib/gatus/admin.password`	The first-boot `admin` password (root only, mode 0600)
`/usr/local/bin/gatus`	The Gatus binary

First boot writes config.yaml only if it does not exist yet, so your edits are kept across reboots.

The default configuration¶

The file sets:

storage: SQLite at /var/lib/gatus/data/gatus.db.
web: address 127.0.0.1, port 8443, with this instance's certificate and key.
security.basic: user admin, with a bcrypt hash of the first-boot password.
ui: title Software Sushi Gatus and header Private status page.
metrics: false.
endpoints: three checks against the instance itself, every 10 seconds.

Add an endpoint¶

Edit the file:

sudo nano /etc/gatus/config.yaml

Add an entry under endpoints:. For example, an HTTPS check:

  - name: my-website
    group: production
    url: "https://<your-site>/"
    interval: 60s
    conditions:
      - "[STATUS] == 200"

And a TCP check:

  - name: my-database-port
    group: production
    url: "tcp://<host>:<port>"
    interval: 60s
    conditions:
      - "[CONNECTED] == true"

You can remove the three starter checks once your own endpoints are in place. Make sure the instance can reach your targets through its VPC routes and security group egress rules.

Apply changes¶

sudo systemctl restart gatus
systemctl is-active gatus

If the service does not come back, check the log for the error:

sudo journalctl -u gatus -n 50 --no-pager

Change the page title¶

Edit title and header under ui:, then restart Gatus.

Change the admin password¶

The config file holds a base64-encoded bcrypt hash, not the password. To set a new password, generate a hash. The command asks for the password without showing it:

python3 -c 'import base64, bcrypt, getpass; print(base64.urlsafe_b64encode(bcrypt.hashpw(getpass.getpass().encode(), bcrypt.gensalt(rounds=12))).decode())'

Put the output in security.basic.password-bcrypt-base64 and restart Gatus. /var/lib/gatus/admin.password is not updated, so it then holds the old password.

Keep basic authentication on

Do not remove the security block. Without it, anyone who can reach the port can read the statuses API.

Reach the page from other hosts¶

The page listens on 127.0.0.1 only. To publish it inside your VPC, either leave Gatus on loopback and put a reverse proxy you control in front of it, or set web.address to a private address and allow only your own network in the security group. Opening the page to 0.0.0.0 and the internet is a change you make on purpose.

The walkthrough checks the defaults

demo.sh and the self-test it runs check the image's default settings. After you change the configuration, they can report a failure even when your setup works. Run them on a fresh instance, before you make changes.

Next: Operations.