Notifications sort of fixed

README.org

@@ -134,17 +134,45 @@ Some services require manual one-time configuration after the first deploy.
 
 ** Ntfy — push notifications
 
-Ntfy's admin user is created automatically from sops on first start.  You
-still need to create a phone token and subscribe to the alerts topic.
+Ntfy's admin user is created automatically from sops on first start.
 
-1. Visit =https://ntfy.zakobar.com= and log in with the admin password
-   (=ntfy/admin_password= in =secrets/secrets.yaml=).
-2. Go to *Account → Access Tokens → Create token* — give it a name (e.g.
-   "phone") and copy the token value.
-3. In the [[https://ntfy.sh][Ntfy mobile app]]:
-   - *Server*: =https://ntfy.zakobar.com=
-   - *Access token*: the token you just created
-4. Subscribe to the =alerts= topic in the app.
+*** Step 1 — Generate VAPID keys (Web Push)
+
+Run on the Pi *before* the first full deploy:
+
+#+begin_src bash
+ssh admin@192.168.1.100 'sudo ntfy webpush keys'
+#+end_src
+
+This prints a public key and a private key.
+
+- Copy the *public key* into =hosts/pi-main/default.nix=:
+  #+begin_src nix
+  homey.ntfy.webPushPublicKey = "<public-key>";
+  homey.ntfy.webPushEmail     = "mailto:you@zakobar.com";
+  #+end_src
+- Add the *private key* to sops:
+  #+begin_src bash
+  sops secrets/secrets.yaml
+  # add: ntfy/web_push_private_key: <private-key>
+  #+end_src
+
+The private key is injected at boot and never lands in the nix store.
+
+*** Step 2 — Subscribe via Safari PWA (recommended for iOS)
+
+1. Visit =https://ntfy.zakobar.com= in Safari and log in with the admin
+   password (=ntfy/admin_password= in =secrets/secrets.yaml=).
+2. Go to *Account → Access Tokens → Create token* — give it a name and
+   copy the value.
+3. Log in with the token, then tap *Share → Add to Home Screen*.
+4. Open the app from the Home Screen (must be launched from there, not
+   Safari, to get push permission).
+5. Subscribe to the =alerts= topic and grant notification permission when
+   prompted.
+
+Web Push via the PWA uses Apple's APNs directly and is more reliable on
+iOS than the native ntfy app's upstream relay.
 
 ** Uptime Kuma — notifications (two-deploy process)