NocMate
On the Checkmk server run curl -fsSL https://nocmate.app/downloads/install_nocmate_checkmk.sh | sudo bash
— it drops the push plugin into your OMD site and reloads Checkmk. Then create a notification
rule with the “NocMate Push” method and set two parameters (see below).
All you need is the 40-character user key from the app — no Connect, no agent.
Setup documentation at /en/docs/checkmk-setup.html. Push installer (standard) at /downloads/install_nocmate_checkmk.sh, standalone push plugin (manual drop) at /downloads/nocmate_push.sh. The full Connect wizard (optional) lives at api.nocmate.app/install/connect.sh.
Method NocMate Push (nocmate_push),
parameter 1 = https://api.nocmate.app,
parameter 2 = user key from the app
(Settings → Push Notifications).
Optional parameter 3 = sender key, if the relay runs with enforced sender authentication.
(The optional Connect wizard can also create the rule automatically.)
Yes. Multiple devices can be registered under the same user key and will then receive the same alerts simultaneously.
One notification rule per person, each with the user key from their own NocMate app — the plugin itself is installed only once. Each person gets their user key from their own app. For app access (hosts/services) on a non-public Checkmk site, see the Connect FAQ below and the team setup.
First check API health
(api.nocmate.app/api/v1/health),
then verify rule conditions and the user key. Disable bulking. In the Checkmk web UI, use
Setup → Notifications → Test Notification to fire the rule
independent of real events.
NocMate Connect is an optional tunnel that forwards app requests through our relay to a small agent on your Checkmk server. With it, Checkmk does not need to be publicly reachable. Below the most common questions about security, privacy and operations.
App → relay → agent → local Checkmk → back along the same path. The app does not know
any direct URL of your Checkmk server; it talks exclusively to
api.nocmate.app. The agent opens
an outbound HTTPS connection to the relay and fetches requests via long polling.
No. Requests and responses are only passed through in the relay's RAM and discarded after delivery. There are no snapshots, no cache, no body logging. Only the routing metadata is persisted (user-key binding, token hash, last-seen timestamp).
Transport encryption: yes, every connection is TLS (HTTPS). Strictly technically it is not classic end-to-end, because the relay sees requests in RAM during forwarding — that is the same trust model as Cloudflare Tunnel, ngrok or Tailscale Funnel. We do not log content and cache nothing. True end-to-end with ECDH key exchange between app and agent is planned as a phase-2 extension; the relay would then only see routing headers and opaque ciphertext.
X-User-Access-Key; the server resolves the user key from itinstance_id belong to the authenticated user?The relay runs on a server in Germany (EU). Access is restricted to the controller at DIGIFLO (see Privacy). For Connect, the relay's SQLite database contains exclusively: user key, instance ID, instance name (free-form), agent token hash and timestamps. No hostnames, no service data, no plugin outputs.
Only outbound to api.nocmate.app:443
(HTTPS). No inbound ports, no reverse proxy, no DNS entry, no VPN required.
The agent can be stopped at any time — the connection drops and the app shows the
connector as offline.
The agent uses the locally configured Checkmk credentials (by default the
automation secret from the OMD site).
It therefore only has the permissions you have granted to the corresponding Checkmk user.
You can create a dedicated, narrow automation user for NocMate and grant the agent only
the necessary permissions.
Yes. A single connector can serve multiple NocMate identities in parallel — each with its own
tunnel credentials and its own Checkmk user. Add additional people with
curl -fsSL https://api.nocmate.app/install/connect.sh | sudo bash -s -- pair --add;
no reinstall, no downtime.
Because each identity authenticates against Checkmk as its own user, native Checkmk permissions
(contact groups, roles) apply through the tunnel. What a teammate cannot see in the web UI, she
won't see in NocMate either. Acknowledgements show up in the audit log under the correct user
name — no shared automation account required.
See team setup for details.
The app shows the connector as offline and continues to display the last successfully loaded data. The agent retries to register with the relay at short intervals. As soon as the relay is reachable again, everything resumes automatically. Push notifications run independently of the tunnel; Checkmk continues to send them directly to the push API.
In the app: Settings → Sites delete
the Connect site (the token is invalidated server-side immediately). In a team setup with multiple
identities, this only removes your own — your colleagues' identities keep working.
To remove an identity centrally on the server:
sudo bash -c "$(curl -fsSL https://api.nocmate.app/install/connect.sh)" -- pair --remove <name>.
Once no identity remains and you want to remove the service entirely:
sudo systemctl disable --now nocmate-connector and
sudo rm /usr/local/bin/nocmate-connector /etc/systemd/system/nocmate-connector.service /etc/nocmate/connector.conf.
NocMate displays Checkmk hosts and services on Apple devices and receives push notifications for failures and recovery. You can acknowledge problems and schedule downtimes from the app.
No. The Checkmk notification script sends events to the NocMate Push API. For live data and actions on a private Checkmk instance, you can also use NocMate Connect. Its agent establishes an outbound connection.
The free tier includes 30 push notifications per month. Small includes 500 per month; Unlimited includes unlimited push notifications and one Connect site. Current prices, subscription periods and additional Connect packages are available in the App Store and the app.
The App Store listing specifies iOS and iPadOS 17 or later and macOS 14 or later on Apple Silicon M1 or newer. NocMate supports Checkmk REST API and Multisite, plus Nagios Core, Icinga and Thruk through Classic CGI. The setup guide covers Checkmk integration.
Yes. Demo mode provides sample data without requiring an account or a configured monitoring instance.
Multiple devices can use the same User Key and receive alerts in parallel. For multiple people, create separate Checkmk notification rules using their respective User Keys. Install the push script only once per site.