CVE
CVE-2026-44774
active — Traefik REST provider allows low-privilege tenant to overwrite live config.
Patch to v2.11.46+ / v3.6.17+ / v3.7.1+.
Advisory →
Verdict
The only candidate where the complete monitor set lives in a committed
config.yaml —
no GUI clicks, no SQLite state escaping git, no separate database process.
Config auto-reloads on file change; rollback is git revert.
Every change is a pull request; every state is version-controlled. IaC Level 4.
What you give up:
No container liveness monitor (workaround: HTTP
HEALTHCHECK on each Dockerfile, or point at Traefik /ping).
Alert providers drop from Kuma's 90+ to Gatus's 20+ — Discord, ntfy, Telegram, and email cover every realistic homelab path.
Uptime history does not transfer; enable storage: type: sqlite to accumulate history across restarts.
Candidate Assessment
Service
Git-native
RAM
Containers
Stars
Verdict
✗ GUI
—
2+
—
✗ REJECTED
△ partial
80 MB
1
—
⚠ RISKY
✓ config
—
4+
—
○ OVERKILL
Decision Axes & Winner Metrics
Gitops Suitability Checks — Gatus
✓
Full monitor config in
config.yaml — committed to git
✓
Auto-reloads on file change — no restart needed
✓
Single container — no DB process
✓
Secrets injected via env vars — never committed
✓
Rollback =
git revert
✗
No container liveness monitor
workaround: /healthcheck or Traefik /ping
△
Uptime Kuma — star gap reflects GUI-adoption, not gitops fit
⭐ 87k vs 11k
Gatus — Runtime Metrics
40
MB RAM
@ 50 endpoints, Raspberry Pi 4
1
Container
no separate DB process
20+
Alert providers
Discord · ntfy · Telegram · email
11.2k
⭐ GitHub stars
vs ⭐ 87.8k for Kuma
Research Sub-Topics
survey
Migration from Kuma + winner sample config
No automated migrator exists — dump Kuma's SQLite or use the Python API, then remap to Gatus endpoint format. Full sample config for HTTP, ICMP, TCP, TLS, DNS, Discord/ntfy alerts, and Homepage widget.
recon
Status page exposure via Traefik
Never expose Traefik's API/dashboard publicly without authentication. Default endpoints leak full configuration; use middleware, network isolation, and recent patches (CVE-2026-44774).
survey
Config-as-code completeness
Most teams reach IaC for compute but leave secrets, policy, database schema, runtime config, and SaaS posture unmanaged. Covering all 8 domains separates Level 3 from Level 5.
survey
Project health & bus-factor
Measure bus factor from git history, which frameworks track project health, practical strategies to raise a dangerously low number — with lessons from the XZ Utils supply chain attack.
survey
Operational weight & backup story
Operational weight is the % of engineering time lost to manual reactive work — target below 50%. 71% of teams do no failover testing. The modern floor is 3-2-1-1-0: one immutable copy required.
survey
Feature coverage matrix
A feature coverage matrix maps requirements to test cases — revealing which features have no automated safety net and where defect risk concentrates.