Filament Uptime Monitor Laravel Package

Product Decisions This Supports

• Build vs. buy for uptime monitoring. This is a UI layer (Filament resources/widgets) over spatie/laravel-uptime-monitor, not a monitoring engine. If you already run a Filament admin panel, it replaces a per-monitor SaaS line item (UptimeRobot/Pingdom/Better Stack seats) with self-hosted checks. The decision to evaluate is "do we want our own checker with our own alerting," not "do we want a new monitoring vendor."
• Where monitoring lives in the product. Puts uptime status, "check now," and scheduler health in the panel your ops/support team already uses — supports decisions about who owns incident triage and whether you need a separate status page.
• Agency / multi-client use cases. Fits client-site portfolios inside one admin: many monitors, bulk-check with a documented cap and per-user rate limit (both now stated explicitly in the README in v1.0.1 — usable for capacity planning and abuse expectations).
• Security sign-off as a rollout gate. v1.0.1 is a security release: "Check now" now resolves the host once, refuses private addresses, and pins the connection to the vetted IP via CURLOPT_RESOLVE, closing a DNS-rebinding/SSRF path where an admin-panel button could be used to probe internal networks. If your release checklist has an SSRF question, this release is the answer to it — and its stated coverage boundaries are the follow-up question.
• Roadmap signal on alarm quality. The scheduler hint now uses the shortest interval among enabled monitors, so long-interval monitors stop producing false "scheduler isn't running" warnings. Fewer false pages translates directly into less on-call noise and more trust in the dashboard.
• Scope boundary to plan around. HTTP uptime checks only — not APM, not log/trace observability, not synthetic user journeys, not multi-region probes. Treat it as a complement to, not a replacement for, your observability stack.

When to Consider This Package

Adopt when:

• You already run Filament 4 or 5, Laravel 12 or 13, PHP 8.2+, and can accept spatie/laravel-uptime-monitor ^4.7 (which brings a Guzzle 7 requirement). v1.0.1 hard-requires ^4.7 — the redirect guard extends a request action that only exists from 4.7.0, and on 4.6 it silently did nothing.
• You want checks running on infrastructure you control, with no per-monitor pricing and no third-party data-sharing.
• Your targets are public endpoints, and your admin users are trusted staff.
• You want a security-reviewed baseline: the private-address refusal and DNS pinning are tested (the headless-Chrome UI suite now includes a pinned check of a public site with private hosts blocked).

Look elsewhere — or scope carefully — when:

• You need to monitor internal/private addresses. The package now refuses them by design. That is correct security behavior and simultaneously a hard product limitation.
• The address guard's coverage matters to your threat model. Per the README, it does not cover custom request actions or the certificate check's own connection. If admins are semi-trusted or your egress policy is strict, pair this with network-level egress filtering rather than relying on the plugin alone.
• You need multi-region or out-of-band vantage points. A single self-hosted checker reports your network's view; a partition between you and the target reads as downtime.
• You need escalation, on-call rotation, SMS/phone alerting, or a public status page. None of that ships here.
• You are not on Filament, or you cannot take the Guzzle 7 / Spatie 4.7 constraint (e.g. another package pins 4.6).
• You want zero maintenance on the monitoring path. This is a small upstream-tracking dependency; you own the upgrade cadence.

How to Pitch It (Stakeholders)

For executives (one paragraph): We can put uptime monitoring for our public sites directly inside the admin panel we already pay for, removing a recurring SaaS subscription and keeping check data in-house. The v1.0.1 release is the version we'd ship: it fixes a server-side request forgery issue in the manual "check now" action, so an admin button can no longer be abused to probe our internal network — this clears a security-review item that would otherwise have blocked adoption. The trade-offs are that it monitors only public endpoints from a single location, and that we take on routine dependency upgrades ourselves.

For engineering (the short version):

• Thin Filament UI over spatie/laravel-uptime-monitor; we own upgrade cadence, not the check engine.
• v1.0.1: DNS resolved once, private addresses refused, connection pinned via CURLOPT_RESOLVE; unresolvable hosts are marked down ("Could not resolve host") instead of being requested.
• Requires Spatie ^4.7 (redirect guard is a no-op on 4.6) and Guzzle 7.
• Upgrade: composer update amjadiqbal/filament-uptime-monitor; on Laravel 13 add -W, as for install.
• Verification: 82 Pest tests across PHP 8.2–8.5 × Laravel 12/13 × Filament 4/5, Pint, PHPStan level 5 (moderate depth — treat as a floor, not a guarantee), plus a 45-check headless-Chrome UI pass in light and dark on Laravel 12.70.1 + Filament 4.15.3 and Laravel 13.38.0 + Filament 5.10.3, and a clean Packagist install with an empty Composer cache.
• Pin the version, and add egress filtering if any part of the threat model depends on the address guard — custom request actions and the certificate check's own connection are outside it.