Addons — the probe agent

Your logs see the inside. Addons watch from outside.

A single Go binary on any box beyond your infrastructure. It runs HTTP, TCP, DNS, certificate-expiry, and ping checks on a schedule and reports every measurement through the same ingest plane your logs use — so an outage your app can't log is still an alert that finds a human.

Download Run one check

The addons

Nine checks. One agent.

httpcheck

DNS, connect, TLS, and first-byte timed separately — "the port is slow" and "your resolver is slow" wake different people. Asserts status and body.

tcpcheck

Is the port answering, and how fast? Connect and DNS timings for anything that speaks a socket.

dnscheck

Resolution time and answers, checked against what the record is supposed to say. Catches hijacks and expired zones.

tlscert

Reports days_until_expiry on every run, so the warning threshold lives in a tower rule. An untrusted certificate is reported down — with issuer, subject, and expiry as the diagnosis.

icmpping

Round-trip min/avg/max and packet loss. "We lack permission" and "the host is unreachable" are opposite conclusions — it never confuses them.

sshcheck opt-in

Log in, run a command, assert its exit code and output — with connect, handshake, and auth timed separately.

portscan opt-in

Scans against a baseline: a port that opened without being declared can page you before someone else finds it.

traceroute opt-in

Hop count, per-hop RTTs, and a path_change signal when the route to your box quietly rewires itself.

logwatch opt-in

Tails a host log for a pattern, rotation-aware — for the one machine whose software will never POST to a tower itself.

The four marked opt-in need a credential, an external binary, or host file access — each is off until the agent's own config lists it in enable_addons, and a config naming one without that fails at startup instead of silently running.

No new concepts

Measurements are just events. Rules do the rest.

Every metric travels as a JSON number on a normal ingest event. Thresholds live in your tower rules — not in agent config — so changing "page me at 500 ms" never means touching a probe box.

  • Down at level 400 — critical if it should page
  • Flapping collapses into one alert with a count
  • Quiet when healthy, spools through outages
  • Same against hosted and self-hosted towers
a working latency alert
curl -s $PT/v1/projects/probes/rules \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "name": "slow-ttfb",
    "match": { "tags": ["addon:httpcheck"] },
    "conditions": [
      { "key": "ttfb_ms", "op": "gte", "value": 500 }
    ]
  }'

Download

Version 0.1.1. Releases are signed with the addons release key (addons-release.pub — a different key than the daemon's, so either can rotate without invalidating the other): one signed SHA256SUMS (.minisig) covers every tarball.

ArtifactArchSizeSHA-256
addons_0.1.1_linux_amd64.tar.gzamd643.5 MB032c28bb958448cee00d5fb50751fc7a5a75d6aa7efcaebaf0b5f6586b31d0ff
addons_0.1.1_linux_arm64.tar.gzarm643.2 MB30a6f8f45ee6820f950fe13ad15f68c6bcf3b914954400437d23ed8e0bd2c91c

Verify before unpacking — the first command checks the sums file was signed by this project, the second checks your tarball matches it. Skipping either lets a tampered tarball and a tampered checksum file agree with each other:

minisign -Vm SHA256SUMS -p addons-release.pub
sha256sum --ignore-missing -c SHA256SUMS

Install

tar xzf addons_<version>_linux_<arch>.tar.gz
cd addons_<version>_linux_<arch>
sudo ./install.sh

The installer creates a dedicated addons system user, installs the binary to /usr/local/bin/addons, and sets up /etc/addons and a systemd unit. Each tarball's contents are covered by a signed manifest that install.sh verifies before it runs anything as root.

Run one check first

addons check runs a single check once and prints the event it would send. Add --report to send it — the ingest token comes from the environment, never a flag, so it stays out of shell history:

export PINGTOWER_INGEST_TOKEN=pti_<tenant>_…
export PINGTOWER_URL=https://api.pingtower.com   # or your own box
addons check httpcheck --param url=https://example.com --report

Then let addons agent run a whole config on a schedule — spooling through outages, heartbeating on itself:

# /etc/addons/agent.yaml
agent:
  id: probe-fra-01
  heartbeat: 5m
  tower:
    url: https://api.pingtower.com
    token_env: PINGTOWER_INGEST_TOKEN

defaults:
  interval: 60s
  timeout: 10s
  report: on_change

checks:
  - id: site
    addon: httpcheck
    params: { url: "https://example.com", expect_status: 200 }
  - id: cert
    addon: tlscert
    params: { address: "example.com:443" }

The agent-readable version of this page lives at /addons/index.md — hand it to your AI agent along with the setup guide and it can do all of the above for you.