name: ntfy

# Self-hosted ntfy push-notification server behind the central Caddy proxy at
# push.waldson.com.br. The HTTP API/web UI is reached only through Caddy on
# proxy_net (nothing is published to the host); Caddy transparently upgrades the
# long-lived WebSocket connections the Android app and web UI use for instant
# delivery. Access is deny-all by default: no topic works without a user or
# token, both created out of band via the CLI (see README.md for the deploy,
# user-creation, and upgrade runbook).

services:
  ntfy:
    # Pinned to the current major so `pull` brings patch/minor fixes while a
    # major bump stays a deliberate tag edit.
    image: binwiederhier/ntfy:v2
    # The image's entrypoint is `ntfy`; the server needs the `serve` subcommand.
    command: serve
    restart: unless-stopped
    # Run as the droplet's deploy user so the auth/cache SQLite files in the
    # bind mount stay owned by 1000 and are manageable over plain SSH, matching
    # the Syncthing and Forgejo stacks. A non-root process cannot bind :80, so
    # ntfy listens on :8080 below and Caddy reverse-proxies to that high port -
    # the same shape as Syncthing (:8384) and Forgejo (:3000).
    user: "1000:1000"
    environment:
      # Public-facing identity. Drives the links and topic URLs the web UI and
      # clients show; without it ntfy would advertise its container hostname.
      NTFY_BASE_URL: https://push.waldson.com.br
      # Unprivileged listen port so the container can run as UID 1000. Caddy
      # reaches this by container name on proxy_net.
      NTFY_LISTEN_HTTP: ":8080"
      # Trust Caddy's X-Forwarded-For so rate limiting and logs see the real
      # client IP instead of the proxy's container address.
      NTFY_BEHIND_PROXY: "true"
      # Deny-all: every publish and subscribe requires an authenticated user or
      # token. There is no open topic and no sign-up path; the admin user and
      # any publish tokens are created via the CLI (see the runbook).
      NTFY_AUTH_FILE: /var/lib/ntfy/user.db
      NTFY_AUTH_DEFAULT_ACCESS: deny-all
      # Message cache backs the poll/since catch-up feature and survives
      # restarts. Duration left at ntfy's 12h default.
      NTFY_CACHE_FILE: /var/lib/ntfy/cache.db
      # File attachments enabled at ntfy's default size limits, stored under the
      # data dir so they persist with everything else.
      NTFY_ATTACHMENT_CACHE_DIR: /var/lib/ntfy/attachments
    volumes:
      # Auth db, message cache, and attachments all live here on a host bind
      # mount, so the whole instance survives recreation and is inspectable over
      # SSH. Git-ignored via the repo's data/ rule.
      - ./data:/var/lib/ntfy
    # No ports published: the server is pure HTTP and reached only through Caddy
    # on proxy_net. Nothing new to open on the host firewall.
    mem_limit: 256m
    networks:
      - proxy_net

networks:
  proxy_net:
    external: true