wtclaude
4151f7d44e
The ntfy service was configured with no published host port, on the assumption that the public reverse proxy shares the compose network and can dial ntfy:80 directly. It does not — Pangolin runs outside the compose network and reaches every service through a published host port (exactly why `app` publishes 3000). With no published port there was nothing for the notification subdomain to forward to, so push delivery could never work in production. Publish container :80 on a host port (NTFY_HOST_PORT, default 2586, binds 0.0.0.0 like `app`) and correct the now-inaccurate comments in docker-compose.yml and ntfy/server.yml. Document NTFY_HOST_PORT in .env.example. No code change — deploy config only. Co-Authored-By: Claude <noreply@anthropic.com>
36 lines
1.8 KiB
YAML
36 lines
1.8 KiB
YAML
# ── ntfy self-hosted server config (UnifiedPush relay) ─────────────────────
|
|
#
|
|
# Backs the Android app's opt-in push notifications (docs/android/PLAN.md §11).
|
|
# Declarative + committed: `docker compose up` provisions a working relay with
|
|
# NO interactive setup — no `ntfy user add`, no per-user accounts, no post-deploy
|
|
# steps. The website backend treats ntfy as an UNTRUSTED relay and only ever
|
|
# publishes content-free tickles ({ stream, ref }); the real, ownership-checked
|
|
# content is pulled by the app over the authenticated website API. That is why
|
|
# anonymous access to unguessable topics is intentional and safe here.
|
|
#
|
|
# The public base URL is provided per-deploy via the NTFY_BASE_URL env var in
|
|
# docker-compose.yml (ntfy env vars override this file), so this default is only
|
|
# a placeholder for a bare `ntfy serve`.
|
|
base-url: "https://ntfy.localhost"
|
|
|
|
# ntfy listens on :80 inside the container. docker-compose.yml publishes this on
|
|
# a host port (NTFY_HOST_PORT, default 2586) so the public reverse proxy — which
|
|
# lives OUTSIDE the compose network — can terminate TLS and forward the
|
|
# notification subdomain to it. Both the app (SSE subscribe) and the backend
|
|
# (POSTing content-free tickles to registered device endpoints) reach ntfy on
|
|
# that public origin, so all traffic flows through the proxy.
|
|
listen-http: ":80"
|
|
behind-proxy: true
|
|
|
|
# Persist the message cache + (empty) auth db on the named volume.
|
|
cache-file: "/var/lib/ntfy/cache.db"
|
|
auth-file: "/var/lib/ntfy/auth.db"
|
|
|
|
# No accounts to administer — anonymous read+write to unguessable topics. Safe
|
|
# because payloads are content-free; the security boundary is the authenticated
|
|
# website API, not ntfy (see the header note).
|
|
auth-default-access: "read-write"
|
|
|
|
# Pure relay: no attachments.
|
|
attachment-cache-dir: ""
|