Self-hosting
How do you know it's running?
Self-hosting stalls on a boring question — who notices when it breaks? The answer worth having is one URL any monitor can read, probed where it cannot be faked, reporting the one thing everyone forgets to check.
4 min read
The question the demo never gets
When a firm considers running software on its own machines, the conversation is always about install day: how hard, how long, whose weekend. Install day is the easy part. The question that should decide the deal is day 200 — the Tuesday the database stops answering, or the disk fills, or a deploy half-lands. Who notices? In most self-hosted setups the honest answer is: the first user who complains.
That is not an argument against self-hosting. It is an argument for demanding one specific thing from the software: that the box can be asked, cheaply and constantly, whether it is actually well — by a machine, not by a person remembering to look.
One URL, five facts
PulseUp answers that with a single unauthenticated health endpoint. It reports whether the database answers, whether the job broker answers, which migration the schema is actually on, and how old the last backup is — and it returns healthy only when the database and the job broker both respond. Anything less is a plain failure code any uptime checker ever written knows how to alarm on.
The migration field matters more than it looks: a container that booted but never migrated is a machine that seems alive and corrupts quietly. Here it is distinguishable from a healthy one by a monitor, not by a support ticket three weeks later.
Watch the origin, not the CDN
A subtlety that costs real incidents: if your monitor checks the public address, and the public address sits behind a CDN, then the CDN answering proves nothing about your box. A cached page smiles at the monitor while the server behind it is dead.
So the probe goes to the origin itself, asking for the right hostname on the way in. It is one line of configuration, and it is the difference between monitoring the product and monitoring somebody else's cache.
A backup that cannot pretend
The most dangerous state in operations is the backup everyone believes in and nobody has seen. The design here is built around refusing that state: a backup run marks itself complete only after every artifact of the run actually exists, the health endpoint reports the age of that mark, and a backup that has never run reads as stale — never as fine. The archives live outside any directory a broken deploy could sweep, and keeping an off-box copy of the encryption passphrase is stated as part of the operator's contract, because an encrypted backup whose key lived on the dead disk is a ceremony, not a backup.
Notice what this does not promise: it does not say "relax, you are backed up." It says the system will not let a backup claim to exist when it does not — which is the promise that actually survives an audit.
The rest of the envelope
Boring on purpose
None of these demo well. All of them are the difference between software and software you can operate.
- Account lockout counts failures per account, so rotating IP addresses does not reset it
- Uploads stream against a hard ceiling and are refused mid-stream — not after the server buffered the whole file
- Every unhandled error becomes the same small envelope; a stack trace never reaches a browser
- An invitation link can seat an existing account, never sign into it
- A job stuck for two days fails loudly instead of showing a spinner forever
- A crashed view is contained to its route: the shell, navigation and a live meeting stay up
The operational questions
Do we need a monitoring team for this?
No. You need any uptime checker — including free ones — pointed at one URL, alerting on a failure code or a stale backup age. The design goal was exactly that: the whole operational posture readable by the dumbest monitor you have.Why does the health page say so little?
Because it is public by design, so a probe can reach it without credentials. It carries five operational facts and nothing else — no tenant data, no diagnostics, nothing an outsider could learn from.
Bring your own machines
The same product runs in our cloud or entirely inside your network, with an offline licence. The on-premises page carries the honest details.