dev3 ·
DEV3 Watchmoor is a multi-tenant uptime monitoring and status page platform on Laravel 12 and Filament 4.
Decisions that mattered
- A probe client that cannot be pointed inward: every outbound check resolves the host once, validates all addresses against refused ranges (including mapped IPv6 and metadata names), then connects to that exact address. Redirects are validated again, bodies are capped and the Host header is rebuilt.
- Confirmation by vote: a state change is decided once per time slot after a lock, and n of m regions must agree (default 2 of 3). Flapping monitors are damped and maintenance windows respected.
- The scheduler claims due monitors with row locks that skip rows other workers hold, each slot is unique, and a stalled install records a gap and catches up instead of firing a burst.
- Status pages are rendered on the server and cached for 30 seconds, with day bars computed in a few bulk queries.
- Every tenant model is scoped by workspace, and a generated test walks the API as another workspace and expects 404.
Limits: it has no mobile apps, and the listing's checks run on a sync queue for small installs, bounded per run.
Note: a security review of the probe client, state machine and scheduler found eleven issues, all fixed before release.
Questions about SSRF defences are welcome.
#laravel#filament#monitoring#case-study
0