Why one more monitor
Uptime services watch your site from outside, so they see a dead page but not the reason: a full disk, a crashed worker, a certificate that renewal quietly stopped updating. Uptime Kuma can check from inside, but it wants Docker or Node and a web dashboard to look after. certwatch is the small thing in between: one file, run by cron, that checks the four failures that take small servers down most often.
Certificates that renewal forgot
Let's Encrypt certificates last 90 days and renew themselves, until a Python upgrade, a DNS change or a moved web root stops the renewal without telling anyone. certwatch connects to each host the way a browser does and reads the real expiry date, so it catches a broken renewal while there are still weeks left. It also flags a certificate that is already invalid or does not match the name.
Disks that fill at night
Logs, backups and uploads fill disks slowly and then all at once. A full disk stops databases from writing and can corrupt them. The default alert is at 90% full; change it with disk_max.
Services that died quietly
With units = yes, certwatch asks systemd for every failed unit, including timers and one-shot jobs like backups, which no outside monitor can see.
Frequently asked questions
Does certwatch need Docker or Node?
No. It is one Python file that uses only the standard library, so it runs on any Linux server with Python 3.8 or newer, which includes every current Ubuntu, Debian and Fedora release.
Will it spam me every time cron runs?
No. It remembers what was wrong last time and only speaks when something changes: a new problem, or a problem that cleared. A disk going from 91% to 92% full is not a new alert.
How do alerts reach my phone?
Install the free ntfy app, subscribe to a topic name nobody can guess, and pass that topic URL with --ntfy. certwatch also posts to Slack or Discord with --webhook, and prints to stdout so cron can email you.
Does it send anything to raidandev?
No. It talks only to the hosts and URLs you list and to the alert address you give it. There is no telemetry and no update check. Read the file before you run it; it is short.
What if the alert itself cannot be sent?
certwatch prints the error, exits with code 2 and keeps its old state, so the same alert is tried again on the next run instead of being lost.