CheckCle on Ubuntu 24.04 on Azure User Guide

Overview

CheckCle is an open source, self-hosted monitoring platform for uptime and infrastructure. It watches servers, HTTP and TCP services, SSL certificates, ping targets and scheduled jobs, tracks incidents, sends alerts, and publishes public operational status pages - all from one dashboard. Its backend is PocketBase (a single Go binary with an embedded SQLite database and a realtime API), and it ships as a single Docker image that also bundles the CheckCle web frontend and a Go monitoring worker.

The cloudimg image installs Docker CE from the official Docker repository and runs CheckCle 1.6.0 as a container (managed by Docker with a restart policy), bound to the loopback connector 127.0.0.1:8090 behind an nginx reverse proxy on port 80. nginx is configured with the WebSocket/SSE upgrade CheckCle's realtime dashboards use. CheckCle's data lives on a dedicated Azure data disk, and the factory admin that the upstream image seeds is rotated to a unique, strong password on the first boot of every VM - before the port 80 proxy is opened - so no instance is ever reachable with a known default login. Backed by 24/7 cloudimg support.

What is included:

• CheckCle 1.6.0 running as a container managed by Docker
• Docker CE preinstalled from the official Docker apt repository
• The CheckCle web UI on :80, fronted by nginx with the WebSocket/SSE upgrade proxied
• A unique admin password generated on first boot and recorded in a root-only file, with the well-known factory login rotated away
• A dedicated Azure data disk at /opt/checkcle/pb_data holding the SQLite database, monitoring history and file storage
• docker.service + nginx.service as systemd units, enabled and active
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting point; size up for many monitored services or shorter check intervals. NSG inbound: allow 22/tcp from your management network and 80/tcp. CheckCle serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for CheckCle by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name checkcle \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name checkcle --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active docker.service nginx.service

Both report active. Docker manages the CheckCle container (bound to the loopback connector 127.0.0.1:8090), and nginx fronts it on port 80 with the WebSocket/SSE upgrade CheckCle's realtime dashboards require. CheckCle's SQLite database, monitoring history and file storage live on the dedicated Azure data disk mounted at /opt/checkcle/pb_data.

Step 5 - Retrieve your admin password

CheckCle signs in with an email and password. On first boot the well-known factory admin is rotated to a unique password for your VM, written to a root-only file:

sudo cat /root/checkcle-credentials.txt

The file contains CHECKCLE_ADMIN_EMAIL (admin@example.com), the generated checkcle.admin.pass, and the URL to open. Store the password somewhere safe.

Step 6 - Confirm the health endpoints

nginx serves an unauthenticated static health endpoint for load balancers and probes, and CheckCle's PocketBase backend exposes its own health API:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires authentication, so it is safe for an Azure Load Balancer health probe.

Step 7 - Confirm access is protected

The upstream image ships a well-known factory login (admin@example.com / Admin123456). On first boot cloudimg rotates that password to the unique per-VM value from Step 5 before nginx opens port 80, so the default login never works on your instance. You can confirm that a superuser-only resource refuses an unauthenticated request:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8090/api/collections/_superusers/records

It prints 403 - the resource is protected. The screenshot below shows the full proof captured on a live VM: the health probe returns ok, the unauthenticated superuser request is refused with 403, the factory password is rejected with 400, and only the per-VM password issues an authentication token.

Step 8 - Sign in to the console

Browse to http://<vm-public-ip>/. CheckCle shows a sign-in page; enter admin@example.com and the password from Step 5.

Step 9 - Explore the monitoring dashboard

Once signed in, the Overview dashboard is your home page. It summarises up, down, paused and warning services, lists everything you are currently monitoring, and gives you a New Service button to add an uptime check for an HTTP endpoint, TCP port, ping target or scheduled job.

Step 10 - Monitor SSL certificates and domains

Open SSL & Domain in the sidebar to track certificate validity across your domains. CheckCle groups certificates into valid, expiring-soon and expired, and can alert you before a certificate lapses. Click Add Domain to start monitoring one.

Step 11 - Plan maintenance and track incidents

Open Schedule & Incident to record planned maintenance windows and manage incidents. Scheduled maintenance is grouped into upcoming, ongoing and completed, and incidents you open here can be surfaced on your public operational status page.

Step 12 - Confirm data lives on the dedicated disk

CheckCle's SQLite database, monitoring history and file storage are stored under /opt/checkcle/pb_data on the dedicated Azure data disk (bind-mounted into the container as /mnt/pb_data), so they survive OS changes and can be resized independently:

findmnt /opt/checkcle/pb_data

The mount is backed by a separate Azure data disk captured into the image and re-provisioned on every VM.

Maintenance

• Admin password: the admin password is rotated on first boot. To change it again, sign in and use the account menu, or update the superuser with sudo docker exec checkcle /app/pocketbase superuser update admin@example.com '<new-password>' --dir /mnt/pb_data.
• Add monitors: use New Service on the dashboard to add HTTP, TCP, ping and scheduled-job checks; configure per-service intervals, thresholds and notifications.
• Notifications: configure alert channels (email, Telegram, Slack, Discord, webhooks) under the settings panel, then attach them to services and incidents.
• Status pages: publish a public operational status page from Operational Page to share uptime with your users.
• Upgrades: CheckCle runs as the checkcle container from the pinned operacle/checkcle:v1.6.0 image; to upgrade, pull a newer tag, remove the container and re-run it with the same -v /opt/checkcle/pb_data:/mnt/pb_data mount so your data is preserved.
• Storage: all CheckCle state lives under /opt/checkcle/pb_data on the data disk; back up that volume to protect your monitoring history.
• TLS: CheckCle serves plain HTTP on port 80; front it with TLS (e.g. certbot with your own domain) before production use.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.