Reach your Checkmate from anywhere
Checkmate Connect is an optional cloud service for self-hosted Checkmate. It gives your server a web address and an encrypted off-site backup. It also tells you when Checkmate itself goes down.
Open your dashboard from anywhere
Turn on remote access in Settings and Checkmate connects out to Connect. You get an HTTPS address that works from any browser, with no port forwarding, dynamic DNS or certificates to manage.
- Stays off until you turn it on
- Gives each server its own random address
- Keeps your Checkmate login in front of the dashboard
Keep a copy off your server
Checkmate encrypts each backup on your server before it uploads. The recovery key is created there too, so we can't open your backups. Run one when you need it or schedule them hourly up to weekly.
- Back up the full database or configuration only
- Verifies the checksum and key before a restore touches your data
- Restores from Settings without a command line
| Created | Type | Size |
|---|---|---|
| Nov 8, 03:00 | Full database | 25.9 MB |
| Nov 7, 15:00 | Configuration only | 4.9 MB |
Find out when Checkmate goes down
A monitoring tool can't report its own outage. Checkmate sends Connect a heartbeat each minute. After 3 minutes of silence we email you, then email again when it comes back.
- Runs outside your network
- Stops the heartbeat if Checkmate loses its database
- Turns on separately for each server
- Checkmate watchdog: homelab is not responding02:14
- Checkmate watchdog: homelab recovered02:31
Connect a server from the Settings page
Connect is part of Checkmate. There's no extra container to run or admin token to set.
CONNECT_URL=wss://relay.checkmate.so/api/tunnel CONNECT_AGENT=inst-a41f07c29e CONNECT_TOKEN=cmk_•••••••••••••••••••••••• CONNECT_API=https://connect.checkmate.so
- Create a Connect accountSign up with an email address and a password.
- Add your serverName it on the dashboard to get a credential block. It's shown once.
- Paste it into CheckmateOpen Settings, choose Checkmate Connect and paste the block.
- Turn on remote accessYour address goes live once the tunnel connects.
Check what passes through Connect
Connect sits between your browser and your server. This is what it handles along the way.
- Remote access trafficEncrypted in transit on both sides of our relay. The relay decrypts each request to route it, so remote access is not end-to-end encrypted. It doesn't save request or response bodies.
- Cloud backupsWe store ciphertext only. Encryption happens on your server with AES-256-GCM.
- Recovery keyStays on your server and is shown to you once. Without it nobody can restore your backups, including us.
- HeartbeatsCarry your installation ID, Checkmate version and tunnel state. They contain no monitors or results.
- Checkmate accountsYour users and password hashes stay in your own database. Your Connect account is separate.
Read the code that runs on your server
The Connect client ships inside Checkmate under AGPL-3.0. Until you enroll it makes no Connect network calls. We run the relay and dashboard as a closed-source service.
Use Connect free during the beta
Paid plans come later. Custom domains are planned for those plans.
Create an account- Remote access for one server
- An automatic HTTPS address
- 1 GB of encrypted cloud backup
- Your latest full backup and latest configuration backup
- Watchdog email alerts
FAQ
The questions people ask before connecting a server.
Do I need Checkmate Connect to use Checkmate?
No. Checkmate stays free, open source and self-hosted without it. Connect is an optional service for people who want remote access, off-site backups or an outside check.
Which version of Checkmate do I need?
The first Checkmate release with Connect built in is on its way. Version 3.13.1 and earlier don't include it.
Do I have to open a port on my router?
No. Checkmate makes an outbound connection to Connect, so your firewall needs no inbound rules.
Is remote access end-to-end encrypted?
No. Traffic is encrypted between your browser and our relay, then between our relay and your server. The relay decrypts requests to route them and doesn't save their bodies.
Who can open my Connect address?
Anyone with the address reaches your Checkmate login page, so your Checkmate password protects the dashboard. Addresses are random and each one has its own browser origin.
What happens if I lose my backup recovery key?
Your cloud backups can't be restored. We don't have a copy of the key and can't decrypt them for you.
Does monitoring stop if Connect has an outage?
No. Checkmate runs its checks on your own server. An outage would interrupt remote access and backups until Connect returns.
Can I use my own domain?
Not yet. Custom domains are planned for paid plans.
How do I stop using Connect?
Turn off remote access or remove the enrollment in Settings. You can also revoke the server from your Connect dashboard, which stops it reconnecting.
Connect your first server
Create an account and paste one credential block into Checkmate. It's free during the beta.