fix(ntfy): publish ntfy host port so the external reverse proxy can reach it #95

wtclaude · 2026-07-22T08:58:13Z

wtclaude commented

2026-07-22 08:58:13 +00:00

Problem

The ntfy service in docker-compose.yml was configured with no published host port, on the assumption that the public reverse proxy (Pangolin) sits on the compose network and can dial ntfy:80 directly.

That assumption is false for this deployment. Pangolin runs outside the compose network and reaches every service through a published host port — which is exactly why the app service publishes 3000:3000 and binds 0.0.0.0. With ntfy publishing nothing, the notification subdomain has nothing to forward to, so push delivery could never work in production.

Fix

Publish the ntfy container's :80 on a host port: ${NTFY_HOST_PORT:-2586}:80, binding 0.0.0.0 like app. The reverse proxy now maps notify.<host> → host:NTFY_HOST_PORT → ntfy:80.
Correct the now-inaccurate "no published host port / internal-only publisher" comments in docker-compose.yml and ntfy/server.yml. In the current code the backend fans tickles out by POSTing to each device's registered public endpoint (utils/pushDispatch.js), gated by NTFY_ALLOWED_ORIGINS — there is no separate internal publish path, so both the app (SSE subscribe) and the backend reach ntfy on the same public origin.
Document NTFY_HOST_PORT in .env.example.

Contrast with INTERNAL_PORT / the bot, which are deliberately unpublished because they must never be public. ntfy is device-facing, so it is supposed to be reachable through the proxy — the removed comment conflated the two.

Deploy-config only — no code change. Validated docker compose config renders ntfy publishing 2586.

Docs updated in a companion PR: RunicGateway/docs#37 (android/PLAN.md §11/§13 and website/BACKEND_DESIGN.md).

AI-assisted: authored with Claude (Claude Code).

🤖 Generated with Claude Code

## Problem The `ntfy` service in `docker-compose.yml` was configured with **no published host port**, on the assumption that the public reverse proxy (Pangolin) sits *on* the compose network and can dial `ntfy:80` directly. That assumption is false for this deployment. Pangolin runs **outside** the compose network and reaches every service through a **published host port** — which is exactly why the `app` service publishes `3000:3000` and binds `0.0.0.0`. With ntfy publishing nothing, the notification subdomain has nothing to forward to, so **push delivery could never work in production**. ## Fix - Publish the ntfy container's `:80` on a host port: `${NTFY_HOST_PORT:-2586}:80`, binding `0.0.0.0` like `app`. The reverse proxy now maps `notify.<host>` → `host:NTFY_HOST_PORT` → `ntfy:80`. - Correct the now-inaccurate "no published host port / internal-only publisher" comments in `docker-compose.yml` and `ntfy/server.yml`. In the current code the backend fans tickles out by POSTing to each device's **registered public endpoint** (`utils/pushDispatch.js`), gated by `NTFY_ALLOWED_ORIGINS` — there is no separate internal publish path, so both the app (SSE subscribe) and the backend reach ntfy on the same public origin. - Document `NTFY_HOST_PORT` in `.env.example`. Contrast with `INTERNAL_PORT` / the bot, which are deliberately **unpublished** because they must never be public. ntfy is device-facing, so it is *supposed* to be reachable through the proxy — the removed comment conflated the two. **Deploy-config only — no code change.** Validated `docker compose config` renders `ntfy` publishing `2586`. Docs updated in a companion PR: **`RunicGateway/docs#37`** (`android/PLAN.md` §11/§13 and `website/BACKEND_DESIGN.md`). --- - [x] AI-assisted: authored with Claude (Claude Code). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

wtclaude added 1 commit 2026-07-22 08:58:15 +00:00

fix(ntfy): publish ntfy host port so the external reverse proxy can reach it

PR Checks / bot-install (pull_request) Successful in 18s

Details

PR Checks / client-build (pull_request) Successful in 30s

Details

PR Checks / server-tests (pull_request) Successful in 9m29s

Details

4151f7d44e

The ntfy service was configured with no published host port, on the
assumption that the public reverse proxy shares the compose network and
can dial ntfy:80 directly. It does not — Pangolin runs outside the
compose network and reaches every service through a published host port
(exactly why `app` publishes 3000). With no published port there was
nothing for the notification subdomain to forward to, so push delivery
could never work in production.

Publish container :80 on a host port (NTFY_HOST_PORT, default 2586,
binds 0.0.0.0 like `app`) and correct the now-inaccurate comments in
docker-compose.yml and ntfy/server.yml. Document NTFY_HOST_PORT in
.env.example. No code change — deploy config only.

Co-Authored-By: Claude <noreply@anthropic.com>

whitlocktech approved these changes 2026-07-22 08:58:48 +00:00

whitlocktech scheduled this pull request to auto merge when all checks succeed 2026-07-22 08:58:53 +00:00

whitlocktech merged commit 5fe7032567 into main

2026-07-22 09:08:15 +00:00

whitlocktech deleted branch fix/ntfy-published-port

2026-07-22 09:08:16 +00:00

whitlocktech referenced this issue from a commit

2026-07-22 09:08:17 +00:00

Merge pull request 'fix(ntfy): publish ntfy host port so the external reverse proxy can reach it' (#95) from fix/ntfy-published-port into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/website#95