Skip to content

Operations

How the instance is secured, how to manage Gatus, and how to back up, update and get help.

Security model

  • Loopback only. Gatus listens on 127.0.0.1:8443. Nothing listens on a public interface.
  • Per-instance secrets. First boot creates the TLS key and the admin password on the instance. They are not in the image.
  • Authentication. The statuses API needs the admin user. /health does not. The status page itself loads without a password, as it does upstream, but needs the credentials to show status data.
  • File permissions. The state and TLS directories are owned by root, group gatus, mode 0750. The password file is root only, mode 0600. Gatus can write only to /var/lib/gatus/data/.
  • Dedicated user. Gatus runs as the gatus system user.
  • SSH. Password login and root login are disabled. Use Session Manager, or SSH with a key pair from your administrative network only.
  • No AWS permissions needed. The default checks call no AWS APIs. Attach an IAM role only if you add something Gatus itself calls in AWS, such as SES alerting, and scope it to those actions and resources.

Services

Unit What it does
sushi-gatus-firstboot.service Creates the TLS material, password and config. Runs before Gatus.
gatus.service Gatus itself 
systemctl status gatus
sudo systemctl restart gatus

Health check

sudo curl --cacert /var/lib/gatus/tls/cert.pem https://127.0.0.1:8443/health

Logs

sudo journalctl -u gatus -n 100 --no-pager

Backups

Back up /var/lib/gatus/ and /etc/gatus/ together. For a clean copy of the SQLite history, stop Gatus first:

sudo systemctl stop gatus
sudo tar -czf /var/backups/gatus-backup.tar.gz /var/lib/gatus /etc/gatus
sudo systemctl start gatus

When you restore, keep the database files owned by the gatus user, and put regular files at the expected paths. First boot refuses identity files that are symbolic links or hard links.

Updates

  • Ubuntu security updates install automatically through unattended upgrades.
  • Gatus stays on the version in the image. New versions ship as new image versions.

A new image version does not update a running instance. To move to it, launch the new version, copy the config, TLS files and database across with Gatus stopped, and point your DNS name or proxy at the new instance. Try the move on a test instance first.

Support

Software Sushi provides packaging and setup guidance for this image. Email info@softwaresushi.com with your instance ID and a description of the problem. Do not send passwords or private keys. This offer does not include support from TwiN or the Gatus project.