ntfy

Self-hosted ntfy push-notification server at https://ntfy.bobparsons.dev, behind Traefik on the server host.

Deployed by Forgejo Actions on push to main.

Layout

Path	Purpose
docker-compose.yml	the whole service definition; image tag pinned literally
.forgejo/workflows/deploy.yml	deploy pipeline (deploy runner)

State lives on the host at /home/server/ntfy/data, not in this repo:

• auth.db — users, tokens and topic ACLs
• cache.db — cached messages
• attachments/ — uploaded files (1G cap, 6h expiry)

data/ is gitignored. Nothing in this repo needs to be secret — see Secrets.

Access model

NTFY_AUTH_DEFAULT_ACCESS=deny-all with signup disabled, so nothing is readable or writable without an explicit grant. Current grants:

• deadstyle — admin, read-write on all topics
• anonymous (*) — write-only on backups, so jobs can publish without credentials while nobody can read the topic

These live in auth.db and are managed with the CLI, not this repo:

docker exec -it ntfy ntfy user list
docker exec -it ntfy ntfy access
docker exec -it ntfy ntfy user add --role=admin <name>
docker exec -it ntfy ntfy access <user> <topic> <rw|ro|wo|deny>

Secrets

There are none, and the repo needs no Infisical wiring. The only secret this service ever had was a bootstrap admin password used once to create the deadstyle user; that user now lives in auth.db, so the deploy has no secret to inject. Creating a new admin is a manual, interactive step (above).

Upgrading

Bump the tag in docker-compose.yml and push. Check the release notes first — ntfy ships security fixes in ordinary minor releases.

Do not switch back to :latest. It was pinned to :latest until 2026-09-04 and had silently sat on 2.19.2 since March, nine minor versions and several security fixes behind, because nothing ever re-pulled it.