[004] Add ntfy stack behind Caddy at push.waldson.com.br

ntfy/compose.yaml

@@ -0,0 +1,59 @@
+name: ntfy
+
+# Self-hosted ntfy push-notification server behind the central Caddy proxy at
+# push.waldson.com.br. The HTTP API/web UI is reached only through Caddy on
+# proxy_net (nothing is published to the host); Caddy transparently upgrades the
+# long-lived WebSocket connections the Android app and web UI use for instant
+# delivery. Access is deny-all by default: no topic works without a user or
+# token, both created out of band via the CLI (see README.md for the deploy,
+# user-creation, and upgrade runbook).
+
+services:
+  ntfy:
+    # Pinned to the current major so `pull` brings patch/minor fixes while a
+    # major bump stays a deliberate tag edit.
+    image: binwiederhier/ntfy:v2
+    # The image's entrypoint is `ntfy`; the server needs the `serve` subcommand.
+    command: serve
+    restart: unless-stopped
+    # Run as the droplet's deploy user so the auth/cache SQLite files in the
+    # bind mount stay owned by 1000 and are manageable over plain SSH, matching
+    # the Syncthing and Forgejo stacks. A non-root process cannot bind :80, so
+    # ntfy listens on :8080 below and Caddy reverse-proxies to that high port -
+    # the same shape as Syncthing (:8384) and Forgejo (:3000).
+    user: "1000:1000"
+    environment:
+      # Public-facing identity. Drives the links and topic URLs the web UI and
+      # clients show; without it ntfy would advertise its container hostname.
+      NTFY_BASE_URL: https://push.waldson.com.br
+      # Unprivileged listen port so the container can run as UID 1000. Caddy
+      # reaches this by container name on proxy_net.
+      NTFY_LISTEN_HTTP: ":8080"
+      # Trust Caddy's X-Forwarded-For so rate limiting and logs see the real
+      # client IP instead of the proxy's container address.
+      NTFY_BEHIND_PROXY: "true"
+      # Deny-all: every publish and subscribe requires an authenticated user or
+      # token. There is no open topic and no sign-up path; the admin user and
+      # any publish tokens are created via the CLI (see the runbook).
+      NTFY_AUTH_FILE: /var/lib/ntfy/user.db
+      NTFY_AUTH_DEFAULT_ACCESS: deny-all
+      # Message cache backs the poll/since catch-up feature and survives
+      # restarts. Duration left at ntfy's 12h default.
+      NTFY_CACHE_FILE: /var/lib/ntfy/cache.db
+      # File attachments enabled at ntfy's default size limits, stored under the
+      # data dir so they persist with everything else.
+      NTFY_ATTACHMENT_CACHE_DIR: /var/lib/ntfy/attachments
+    volumes:
+      # Auth db, message cache, and attachments all live here on a host bind
+      # mount, so the whole instance survives recreation and is inspectable over
+      # SSH. Git-ignored via the repo's data/ rule.
+      - ./data:/var/lib/ntfy
+    # No ports published: the server is pure HTTP and reached only through Caddy
+    # on proxy_net. Nothing new to open on the host firewall.
+    mem_limit: 256m
+    networks:
+      - proxy_net
+
+networks:
+  proxy_net:
+    external: true