Sold by: Penni Tech LLC
Deployed on AWS
This is a repackaged open source software product wherein additional charges apply for security hardening of the operating system and deployment, HTTPS enabled by default with a certificate generated on each instance, per-instance secret generation with a one-time first-login credential that you change on first sign-in, automatic operating system security updates, and a set of operator commands for status, logs, backup, restore and upgrade.
Overview
Healthchecks is an open source monitor for cron jobs and scheduled tasks. Every job gets its own ping URL; if a ping does not arrive on schedule, the check is flagged late and then down. It is the dead man's switch for the batch jobs, backups and scheduled scripts a business depends on but rarely watches.
Healthchecks itself is open source software under the BSD-3-Clause licence. This image adds the following engineering by Penni Tech LLC:
SECURITY HARDENING. SSH password authentication is disabled, password-based root login is disabled and the root account is locked. The image contains no authorized keys, no default passwords and no hardcoded secrets of any kind. PostgreSQL listens on no network interface at all; the application reaches it over a local Unix socket and itself binds only to localhost. Exactly three ports listen externally: 22, 80 and 443.
HTTPS BY DEFAULT. An nginx reverse proxy, installed from the Amazon Linux 2023 repository, terminates TLS on port 443 and redirects port 80 to it. A self-signed certificate is generated on your own instance at first boot. Modern security headers, including HSTS, are set by the proxy, and the proxy does not advertise its version.
PER-INSTANCE SECRETS. At first boot, and only at first boot, the instance generates its own Django secret key, database password and administrator password from the kernel random source. Every value is unique to your instance; none of them exist in the image. The administrator credential is written to a root-only file for you to retrieve over SSH, is intended to be used exactly once, and should be changed by you at first sign-in. Self-registration is disabled, so no one can create an account on your instance.
AUTOMATIC OPERATING SYSTEM SECURITY UPDATES. The image applies security updates to Amazon Linux 2023 automatically, and because nginx and PostgreSQL are Amazon Linux packages rather than containers, those updates cover them too. The application container is deliberately NOT auto-updated: it is built from the upstream image pinned by SHA256 digest plus a layer of Debian and Python security updates, so your deployment cannot silently change underneath you. You rebuild or move versions when you choose, with the included upgrade command.
OPERATOR TOOLING. Six commands are installed and documented: healthchecks-status, healthchecks-logs, healthchecks-backup, healthchecks-restore, healthchecks-upgrade and healthchecks-passwd. Backup produces a single archive containing a database dump, the application data and the instance environment; restore reverses it; upgrade takes a backup first and keeps the previous configuration so you can roll back.
REPRODUCIBLE, SCANNED BUILD. The image is built with Packer from the Amazon Linux 2023 base image published by AWS. nginx, PostgreSQL and Docker come from the signed Amazon Linux repository; every other bundled binary is verified against its published SHA256 checksum. The build is scanned with Trivy and will not produce an image if the host operating system, including nginx and PostgreSQL, has any critical or high severity vulnerability for which a fix exists, or if the application container has a critical or high severity vulnerability for which a fix exists. The licence and copyright notices of all bundled software are preserved under /usr/share/licenses.
This is an independent repackaging. Penni Tech LLC is not affiliated with the Healthchecks project.
Highlights
- HTTPS on port 443 by default, using a self-signed certificate generated on your own instance at first boot, with HTTP redirected to HTTPS.
- Every secret is generated on your instance at first boot and is unique to it. The image contains no hardcoded credentials, no default passwords and no authorized SSH keys.
- Six documented operator commands for status, logs, backup, restore, upgrade and password change, with the application container built from an upstream image pinned by SHA256 digest.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
AmazonLinux 2023
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.medium Recommended | $0.05 |
t3.large | $0.05 |
t3.xlarge | $0.05 |
m6i.large | $0.05 |
m6i.xlarge | $0.05 |
Dimensions summary
You pay an hourly software rate that stays the same across all five options. The five dimensions are EC2 instance sizes, not feature tiers. They cover two instance families: t3.medium, t3.large, and t3.xlarge in one family, plus m6i.large and m6i.xlarge in another. You pick the size that fits your compute and memory needs. On top of the software rate, you pay AWS separately for the EC2 instance and storage at standard rates for the size you choose. The vendor recommends t3.medium.
Top-of-mind questions for buyers
The hourly rate covers the software license for the running instance. On top of that, you pay AWS directly for the EC2 instance and storage at standard rates for the size you pick. These are two separate charges on your bill.
The software rate meters running time, so a stopped instance does not accrue the hourly software charge. You may still pay AWS for attached storage while the instance is stopped. Charges resume when you start the instance again.
The hourly software rate is the same across all five instance sizes. Your total cost difference comes from the AWS instance and storage charges, which vary by size. Larger instances cost more from AWS, but the software license fee stays flat.
penni-tech.com
Helpful?
Vendor refund policy
No refunds. Subscriptions can be cancelled at any time.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Initial release. Healthchecks 4.4 on Amazon Linux 2023, hardened by Penni Tech LLC. HTTPS enabled by default with a certificate generated on each instance at first boot. All per-instance secrets generated at first boot. Automatic operating system security updates enabled. Operator commands for status, logs, backup, restore, upgrade and password change. nginx and PostgreSQL are Amazon Linux packages covered by automatic security updates; the application container is built from the upstream image pinned by SHA256 digest with current Debian and Python security updates applied.
Additional details
Usage instructions
LAUNCH
- Subscribe, then launch from the AWS Marketplace website or EC2 console. t3.medium is recommended.
- Choose an EC2 key pair; you need it to retrieve your first-login password over SSH.
- Security group: 443/tcp required (the application); 80/tcp optional (redirects to HTTPS); 22/tcp needed once to retrieve the credential, restrict it to your own address. No other port is needed; PostgreSQL has no network listener.
- Wait about two minutes for first-boot configuration.
FIRST LOGIN (CREDENTIAL CHANGE REQUIRED) SSH in as ec2-user and run: sudo cat /root/healthchecks-credentials.txt It holds the URL, admin email and a password generated on your instance at first boot (root-only file). Browse to https://<instance-public-dns>/ and sign in; the certificate is self-signed, so expect a browser warning. Change the password immediately: Account > Settings > Change password, or sudo healthchecks-passwd. Self-registration is disabled.
YOUR OWN TLS CERTIFICATE sudo install -m 0644 fullchain.pem /etc/pki/nginx/server.crt sudo install -m 0600 privkey.pem /etc/pki/nginx/private/server.key sudo systemctl reload nginx
COMMANDS healthchecks-status: services, container, database, listening ports, certificate, disk. healthchecks-logs [-f] [nginx|postgres|--system]: logs. sudo healthchecks-backup [dir]: one tar.gz with database dump, app data and env file (contains secrets, mode 0600; default /var/backups/healthchecks). sudo healthchecks-restore <archive> [--keep-env]: restore; destructive, prompts first. sudo healthchecks-upgrade [image:tag@sha256:...]: backs up, then rebuilds the app image with current security updates or moves to a new pinned release; keeps the previous Dockerfile for rollback. sudo healthchecks-passwd [email]: change the admin password.
WHERE DATA LIVES /etc/healthchecks/healthchecks.env: per-instance secrets (root-only, SENSITIVE) /var/lib/pgsql/data: PostgreSQL data /var/lib/healthchecks/data: application data /opt/healthchecks: container definition and Dockerfile /etc/nginx/nginx.conf: proxy and TLS config /etc/pki/nginx: TLS certificate and private key (key SENSITIVE) /usr/share/doc/healthchecks/README.md: full documentation on the instance
ENCRYPTION AND KEYS The root EBS volume is unencrypted, as Marketplace requires; enable EBS encryption at launch if needed. The only cryptographic material is the self-signed TLS key and certificate in /etc/pki/nginx, generated at first boot. To rotate: delete both files and /var/lib/healthchecks/.firstboot-complete, run sudo systemctl start healthchecks-firstboot, then sudo systemctl reload nginx.
EMAIL NEEDS YOUR SMTP SERVER No external service is needed to run. Webhook and chat alerts work as is; email alerts need an SMTP server you supply. Add EMAIL_HOST, EMAIL_PORT, EMAIL_HOST_USER, EMAIL_HOST_PASSWORD and EMAIL_USE_TLS to the env file, then sudo systemctl restart healthchecks.
HEALTH, QUOTAS, COST Run healthchecks-status, and check the instance's Status checks tab in the EC2 console. The product uses one EC2 instance and its 20 GB gp3 volume and creates no other AWS resources; raise EC2 quotas in the Service Quotas console if needed. Costs: EC2, EBS, data transfer and the hourly software fee.
UPGRADING In place: sudo healthchecks-upgrade. To a new instance: healthchecks-backup on the old one, then healthchecks-restore <archive> --keep-env on the new one.
BUNDLED SOFTWARE Healthchecks 4.4 (BSD-3-Clause); nginx 1.30.5 (BSD-2-Clause); PostgreSQL 17.11 (PostgreSQL Licence); Docker Compose 5.6.0 (Apache-2.0); Docker Engine; Amazon Linux 2023. nginx, PostgreSQL and Docker are Amazon Linux packages. Licences are in /usr/share/licenses.
SUPPORT info@penni-tech.com , best effort within 2 business days.
Resources
Vendor resources
Support
Vendor support
Email support at info@penni-tech.com , best effort response within 2 business days.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
This is a repackaged open source software product wherein additional charges apply for security hardening of the operating system and deployment, HTTPS enabled by default with a certificate generated on each instance, per-instance secret generation with a one-time first-login credential that you change on first sign-in, automatic operating system security updates, and a set of operator commands for status, logs, backup, restore and upgrade.
Automated backup and instant recovery for SaaS applications: GitHub, GitLab, Jira, Confluence, Trello, Notion, and Shopify. Setup in minutes with no scripting. Daily automated backups, 256-bit AES encryption, data residency options (US/UK/EU/AU). ISO 27001, SOC2, GDPR & HIPAA compliant. Built on AWS.
Palo Alto Remote Health Check.
Our health-checks are a quick and convenient way of identifying whether your customers have any configuration or security issues on their systems. You can ensure your customers get the most from solutions they already have, identify new opportunities and increase customer satisfaction and retention.
PNW´s Tenable Health Check is designed to ensure optimal performance on your Tenable environment.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.