waldson/central-proxy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[004] Add ntfy stack behind Caddy at push.waldson.com.br

Browse source
This commit is contained in:
Waldson Patrício 2026-07-23 14:49:24 -03:00
parent 2d370dc4ae
commit df176d2e4f
3 changed files with 157 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

95
README.md
View file

@ -22,6 +22,8 @@ syncthing/ the Syncthing stack (own compose file); GUI behind Caddy,
sync protocol published on 22000
forgejo/ the Forgejo stack (own compose file); web UI behind Caddy,
git-over-SSH published on 2222
ntfy/ the ntfy stack (own compose file); push server behind Caddy,
nothing published (pure HTTP through the proxy)
```
## Prerequisites
@ -221,6 +223,95 @@ A major bump (editing the tag to the next number) runs one-way database
migrations. Do it one major at a time, back up `forgejo_data` first, and read the
Forgejo release notes before changing the tag.
## ntfy stack
A self-hosted [ntfy](https://ntfy.sh) push-notification server (the owner's
alerts endpoint for scripts, cron, and the Android app) at
`push.waldson.com.br`. It lives in `ntfy/` and deploys to
`/home/waldson/central-proxy/ntfy` on the droplet.
Nothing is published on the host: ntfy is pure HTTP and reached only through
Caddy at `push.waldson.com.br`, so it rides Caddy's existing 80/443 and opens no
new firewall port. Caddy transparently upgrades the long-lived WebSocket
connections the Android app and web UI use for instant delivery. The central
`Caddyfile` carries the `push.waldson.com.br` block.
Access is **deny-all**: `NTFY_AUTH_DEFAULT_ACCESS=deny-all` means no topic can be
published or subscribed without an authenticated user or token, so there is no
open surface for strangers even though the URL is public. The whole instance is
configured from `NTFY_*` environment variables in `compose.yaml` (no
`server.yml`), so the posture is reproduced on every recreate. The container runs
as UID 1000, which cannot bind port 80, so ntfy listens on `:8080` inside the
container and Caddy reverse-proxies to `ntfy-ntfy-1:8080` - the same high-port
shape as Syncthing (`:8384`) and Forgejo (`:3000`).
### Where data lives
The auth database (`user.db`), the message cache (`cache.db`), and uploaded
attachments all live under the host bind mount `ntfy/data` (mounted at
`/var/lib/ntfy` in the container), so state survives container recreation and is
inspectable over plain SSH. The directory is git-ignored via the repo's `data/`
rule. The container runs as `1000:1000`; if the droplet's deploy user has a
different id, adjust `user:` in `compose.yaml` so the db files stay owned by that
user.
### Deploy
From `ntfy/` on the droplet:
```sh
docker compose up -d
```
The container comes up as `ntfy-ntfy-1` on `proxy_net`, which is the name Caddy
reverse-proxies to. A restart preserves users, tokens, and cached messages:
```sh
docker compose restart
```
### First-run setup (CLI)
There is no web installer and no sign-up path. After the container is first up,
create the admin user and (for scripts) a publish token via the CLI:
```sh
# Admin can read/write every topic (prompts for a password).
docker exec -it ntfy-ntfy-1 ntfy user add --role=admin <admin>
# A token for unattended publishing from scripts/cron.
docker exec -it ntfy-ntfy-1 ntfy token add <admin>
```
For a non-admin user, grant per-topic access explicitly (deny-all denies
everything else):
```sh
docker exec -it ntfy-ntfy-1 ntfy user add <name>
docker exec -it ntfy-ntfy-1 ntfy access <name> <topic> rw
```
Publish with the token from anywhere:
```sh
curl -H "Authorization: Bearer <token>" -d "backup finished" \
https://push.waldson.com.br/<topic>
```
In the Android app, add the server `https://push.waldson.com.br`, sign in with
the user (or set the token), and subscribe to the topic.
### Upgrade
The image is pinned to the current ntfy major (`binwiederhier/ntfy:v2`). Patch
and minor updates within that major are safe:
```sh
docker compose pull && docker compose up -d
```
A major bump is a deliberate tag edit; read the ntfy release notes first.
## Droplet groundwork
Baseline host configuration for the droplet (`wloud`, 174.138.36.232,
@ -262,7 +353,8 @@ firewall blocks them. Ports in use:
| 2222 | tcp | Forgejo git-over-SSH |
| 22000 | tcp+udp | Syncthing sync protocol |
If ufw rules are ever tightened, keep the four rows above allowed. To
ntfy adds no row here: it is reached only through Caddy on 80/443. If ufw
rules are ever tightened, keep the four rows above allowed. To
re-verify reachability from any machine outside the droplet:
```sh
@ -285,6 +377,7 @@ and point at the droplet:
| www.waldson.com.br | A | 174.138.36.232 | redirect to apex |
| git.waldson.com.br | A | 174.138.36.232 | Forgejo |
| sync.waldson.com.br| A | 174.138.36.232 | Syncthing GUI |
| push.waldson.com.br| A | 174.138.36.232 | ntfy push server |
personaledson.com.br and nazareonline.com.br also resolve here for the
existing stacks. Check resolution with: