Matmon Cloud

Reach without giving anything away

Your instance connects outbound to Matmon Cloud – no open port, no VPN. It adds what a monitor on site cannot do for itself. Entirely optional: without it, Matmon runs fully offline.

Sign in to Cloud Plans
Matmon Cloud

Primary → Matmon Cloud: outbound only

Heartbeat every 30 s over HTTPS 443. No inbound connections – remote access runs through a tunnel opened by the Primary.

Monitored networks

Matmon PrimaryDocker (ghcr.io/real-ttx/matmon) or Windows service
Primary – TCP 8099
  • Web UI and REST API
  • Sensor scheduler
  • Alerting and escalation
  • History and reports
  • Syslog / trap receiver
  • Backups

All state in one data volume (/app/data). No cloud dependency.

Users and services

connectionopt-ininitiatorresponse
Probe → Primary · HTTP(S), TCP 8099 · outbound only

Transmitted

  • Heartbeat every 30 s
  • Polls its sensor assignments, run-now and discovery jobs
  • Measurement results

Not transmitted

  • No inbound connection to the probe site
  • No connection to Matmon Cloud

Details

  • Auth: X-Matmon-Probe-Token
  • Primary unreachable: results buffered on disk (7 days / 100,000), replayed with original timestamps
Agent → Primary · HTTP(S), TCP 8099 · outbound only

Transmitted

  • Same protocol as a probe: heartbeat, assignments, results
  • Local metrics: CPU, memory, disks
  • Update check against the Primary (hourly)

Not transmitted

  • No inbound port, no WinRM or SSH required
  • No connection to Matmon Cloud

Details

  • Enrolment: matmon-agent enroll --url … --code … (one-time code); plain HTTP to a public host is refused
  • Windows service (LocalSystem), systemd, launchd
  • Self-contained binary: win-x64, linux-x64, linux-arm64, macOS
Primary or probe → device · syslog / traps → Matmon

Transmitted

  • Polling: ICMP, HTTP(S), DNS, TCP, SNMP, vendor APIs (Proxmox, Hyper-V, Synology …)
  • Inbound: syslog UDP/TCP 514, SNMP traps UDP 162 – only with the receiver enabled

Not transmitted

  • No software on the device
  • Credentials not stored in plaintext – DataProtection-encrypted, also in backups

Details

  • Devices in a remote network are polled by the probe in that network
  • Receivers run on the Primary, a probe or an agent
Browser → Primary · HTTP, TCP 8099

Transmitted

  • Web UI, REST API, wallboards (read-only links)
  • Web push to the installed PWA

Not transmitted

  • No external identity provider required – local accounts work offline

Details

  • No built-in TLS: terminate HTTPS at a reverse proxy (Matmon__TrustedProxies)
  • Access from outside without port forwarding: Full Access via Matmon Cloud
Primary → SMTP server / webhook URL · direct

Transmitted

  • Alert messages via SMTP
  • Webhooks: ntfy, Pushover, Gotify, Telegram, Teams, Slack, Discord, custom

Not transmitted

  • No relay through Matmon servers – except the “Matmon Cloud” sender

Details

  • SMS and voice only via the Matmon Cloud sender, critical alerts only
Primary → cloud.matmon.eu · HTTPS 443 · outbound, opt-in

Transmitted

  • Heartbeat every 30 s: version, host name, counts (sensors, probes, maps, alerts), probe name / version / state
  • Cloud sender: recipient and alert text; SMS / voice: summary only
  • Backups (manual or scheduled): configuration, secrets encrypted; history optional
  • Full Access: UI proxied through a WebSocket tunnel (wss) opened by the Primary

Not transmitted

  • Measurement values in the heartbeat
  • Credentials in plaintext
  • Inbound connections to the Primary
  • Traffic from probes or agents

Details

  • Auth: X-Matmon-Instance-Token after a PKCE claim
  • Separate switches: alert relay, Full Access, backup target
  • Link off: monitoring continues; SMS / voice, remote access and cloud backups unavailable

More: how Matmon works →

Dead-man switch

When an instance stops reporting, you hear about it – by e-mail and as a browser notification. The one alarm a monitor cannot raise about itself.

Remote access

Open an instance behind NAT straight from the browser. Switch it on in the setup wizard – or let your partner connect it for you.

SMS and phone calls

Critical alerts by text message or as a call that reads the alert out, with limits per instance so a flapping sensor cannot run up a bill.

Notification gateway

E-mail delivered on behalf of your instance – no mail server of your own needed.

Status pages

A public page per instance with the aggregated state only – never your telemetry.

Set up with the cloud

A fresh instance can be set up with your cloud account in the first-start wizard, with a recovery file for the day you need it.

For partners

Look after your customers' monitoring

IT service providers manage their customers' instances in the partner portal: connect them, see their state at a glance, carry their own branding – and appear on the partner list of matmon.eu with their company profile and contact if they like.

  • Customer instances connected and watched in one place
  • Remote access to an instance without a VPN
  • Your own branding
  • A public profile with logo, e-mail and phone

Start with the cloud

Install Matmon, then connect it to Matmon Cloud in the setup wizard – or later under System.

Get started Sign in to Cloud