NocMate
Set up Checkmk push alerts and Connect
The standard path is Push: one command installs the notification plugin, then two parameters in the rule — done. Connect is optional and only needed when the app must reach a Checkmk instance behind the firewall.
Before you begin
Install NocMate from the App Store. Push needs outbound HTTPS access from the Checkmk site to the NocMate API and a notification rule. Live views require a Checkmk user with suitable permissions. For a private instance, configure optional Connect separately.
Push in one command
For plain alerts on iPhone and Mac you need neither Connect nor an agent. The script auto-detects
your OMD site, drops the nocmate_push
notification plugin and reloads Checkmk. Then just create the notification rule with two parameters (steps below).
curl -fsSL https://nocmate.app/downloads/install_nocmate_checkmk.sh | sudo bash
Prefer not to pipe to a shell? Drop nocmate_push.sh
manually into ~/local/share/check_mk/notifications/ and make it executable.
- OMD site (also on multi-site hosts)
- The site's notifications directory
- Reload via
cmk -R
- Just one plugin script, no daemon
- No systemd service, no agent
- No inbound, no reverse proxy needed
- Only for app access behind a firewall
- Full wizard:
install/connect.sh - See the tunnel quickstart below
Direct paths (scripts & power users)
Don't need the wizard? Skip ahead to one of the two quickstarts.
Push Notifications
When your Checkmk site can send notifications directly to our API (typical via reverse proxy / DMZ).
- ✓ Push to iPhone & Mac
- ✓ Notification rule auto-created via REST
- ✓ 3 steps, no web UI clicking
NocMate Connect
When Checkmk is behind a firewall and there should be no public endpoint. Outbound-only HTTPS, no VPN, no reverse proxy.
- ✓ App accesses hosts & services
- ✓ Multi-user with native Checkmk permissions
- ✓ 3 steps via QR pairing
Push Quickstart
~2 min · 3 stepsPlugin and notification rule are set up automatically. No Checkmk web UI clicking required.
-
Get your user key from the app
In NocMate:
Settings → Push Notifications→ copy the 40-character user key. -
Run on the Checkmk server
The wizard auto-detects the OMD site and Checkmk user, asks only for the user key, and creates both the push plugin and the notification rule via the Checkmk REST API. No web UI needed.
curl -fsSL https://api.nocmate.app/install/connect.sh | sudo bash
In the menu pick
[1] Push notifications. For multiple recipients: one rule per person (each with their own user key from the app).Scripted variant (after first run the CLI is local):
sudo nocmate-cli push --push-user-key <KEY> --push-cmk-user cmkadmin -
Test
Trigger WARNING / CRITICAL / Recovery and verify on iPhone or Mac. If nothing arrives: check API health (api.nocmate.app/api/v1/health), disable bulking, verify rule conditions.
Tunnel Quickstart
An agent (Python, systemd service) keeps an outbound TLS connection to the relay open and runs app requests locally against Checkmk. No inbound port, no VPN, no snapshot storage at the relay.
-
Run the Connect installer
Detects the OMD site, fetches the
automationsecret automatically, installs the systemd service. The same command later also adds another teammate.curl -fsSL https://api.nocmate.app/install/connect.sh | sudo bash -s -- pair --add
-
Scan the QR with the app
The terminal shows a QR code + a 6-digit pairing code (5 min, single-use). In NocMate:
Settings → Add Connect Site. -
Done
Hosts, services, acknowledge, recheck, downtime and master control work just like in REST API mode. The connector status (online / last seen) shows up per site in the app.
Advanced
Details to expand — everything else is optional.
▸
Connect
Team setup (multi-user)
One connector can serve multiple NocMate identities in parallel. Each identity has its own tunnel credentials and its own Checkmk user — so native Checkmk permissions (contact groups, roles) apply through the tunnel.
curl -fsSL https://api.nocmate.app/install/connect.sh | sudo bash -s -- pair --add
Same command as for the initial install — it auto-detects whether an identity already exists and just appends another one (no service restart). The second person scans the QR with their own iPhone, iPad or Mac. After the initial install a local CLI wrapper is also available:
sudo nocmate-cli pair --list
sudo nocmate-cli pair --remove <name>
Prerequisite: each person needs their own Checkmk user
(Setup → Users → Automation secret). Recommended: role
monitoring_user + appropriate contact group, no admin user.
Acknowledgements appear in the audit log under the correct user name — no shared
automation account required.
▸
Operations
Manage, logs & revoke
systemctl status nocmate-connector journalctl -u nocmate-connector -f
In the app under Settings → Sites delete the Connect site.
The token is invalidated server-side immediately. Once no identity remains, the service can be uninstalled:
sudo systemctl disable --now nocmate-connector sudo rm /usr/local/bin/nocmate-connector \ /etc/systemd/system/nocmate-connector.service \ /etc/nocmate/connector.conf
▸
Push
Manual installation & downloads
If you'd rather not use the wizard (air-gapped systems, image builds, custom pipelines) you can drop the push
plugin directly at ~/local/share/check_mk/notifications/nocmate_push
and make it executable — then create a notification rule with method
NocMate Push (nocmate_push) manually in
Setup → Events → Notifications.
Manual rule parameters: Parameter 1 = https://api.nocmate.app,
Parameter 2 = user key from the app.
Recommended: events Problem + Recovery,
state type HARD, bulking off.
Security, troubleshooting and background
Security properties, data flow, firewall rules, push problems and everything else around the tunnel are bundled compactly in the FAQ — one short answer per question.