:PROPERTIES:
:ID: fd781dd9-e52c-4e3f-82ad-b27783b33177
:END:

#+title: homey/ntfy
#+filetags: :project: :knowledge: :ntfy:

:PROPERTIES:
:ID: homey-ntfy
:END:

#+title: homey/ntfy
#+filetags: :project: :knowledge: :ntfy:

Self-hosted ntfy push notification server at =https://ntfy.zakobar.com=. Native NixOS service (not a container), port 2586. =auth-default-access = deny-all= — all clients need a token or password. Bypasses Authelia (ntfy enforces its own auth so the mobile app works without SSO). Topic for alerts: =alerts=.

** Sending Notifications from CLI

Token stored in =pass= at =zakobar-homecenter/ntfy-token=.

#+begin_src bash
# Basic
curl -H "Authorization: Bearer $(pass zakobar-homecenter/ntfy-token)" \
     -d "your message" \
     https://ntfy.zakobar.com/alerts

# With metadata
curl -H "Authorization: Bearer $(pass zakobar-homecenter/ntfy-token)" \
     -H "Title: Backup complete" \
     -H "Priority: default" \
     -H "Tags: white_check_mark" \
     -d "restic finished successfully" \
     https://ntfy.zakobar.com/alerts
#+end_src

Priority values: =min=, =low=, =default=, =high=, =urgent=.
Tags are emoji shortcodes (e.g. =warning=, =rotating_light=, =white_check_mark=).

** Token Management

*Generating / rotating a token:*

Two gotchas with =ntfy token add=:
1. Output goes to stderr — must redirect with =2>&1= or the pipe gets nothing.
2. No global =--config= flag — use =NTFY_AUTH_FILE= env var instead.
3. =pass insert -e= prompts from =/dev/tty=, not stdin — use =-m= (multiline) for piping.

#+begin_src bash
ssh admin@192.168.1.100 'sudo NTFY_AUTH_FILE=/mnt/data/ntfy/auth.db ntfy token add admin 2>&1' \
  | awk '{print $2}' \
  | pass insert -m -f zakobar-homecenter/ntfy-token
#+end_src

*Listing / removing tokens* (e.g. to clean up leaked tokens):

#+begin_src bash
ssh admin@192.168.1.100 'sudo NTFY_AUTH_FILE=/mnt/data/ntfy/auth.db ntfy token list admin'
ssh admin@192.168.1.100 'sudo NTFY_AUTH_FILE=/mnt/data/ntfy/auth.db ntfy token remove admin tk_xxxx'
#+end_src