c4patino/yumeami
1
0
Fork 0
Code Activity Actions

feat: modify ntfy to use postgresql and restrict to auth-ed logins
All checks were successful
ci / treefmt (push) Successful in 1m41s
Details

Browse source
This commit is contained in:
Ceferino Patino 2026-06-27 22:59:18 -05:00
commit 4b7aa3cbb5
Signed by: c4patino
SSH key fingerprint: SHA256:Wu+cU1t+7zVT9wzew/4meNmeulo66NzMqc22MdDBgXI
4 changed files with 44 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

1
modules/nixos/bundles/common/default.nix
View file

@ -87,6 +87,7 @@ in {
"forgejo"
"grafana"
"asciinema"
"ntfy"
"terraform"
"vaultwarden"
];

43
modules/nixos/services/apps/ntfy/default.nix
View file

@ -1,16 +1,16 @@
{
config,
inputs,
lib,
namespace,
...
}:
with lib;
with lib.${namespace}; let
inherit (lib) mkIf;
inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveServicePort;
}: let
inherit (lib) mkIf mkForce;
inherit (lib.${namespace}) getAttrByNamespace readJsonOrEmpty getIn resolveDatabaseIP hostHasService resolveServicePort;
inherit (config.networking) hostName;
networkCfg = getAttrByNamespace config "${namespace}.services.networking";
pgCfg = getAttrByNamespace config "${namespace}.services.storage.postgresql";
isEnabled = hostHasService networkCfg.network-services hostName "ntfy";
port = resolveServicePort networkCfg.network-services "ntfy" 5201;
@ -18,11 +18,38 @@ in {
config = mkIf isEnabled {
services.ntfy-sh = {
enable = true;
settings = {
settings = lib.mkForce {
base-url = "http://ntfy.yumeami.sh";
upstream-base-url = "https://ntfy.sh";
listen-http = ":${toString port}";
behind-proxy = true;
listen-http = ":${toString port}";
upstream-base-url = "https://ntfy.sh";
attachment-cache-dir = "/var/lib/ntfy-sh/attachments";
database-url = let
pgPassword = getIn "postgresql.ntfy.password" (readJsonOrEmpty "${inputs.self}/secrets/crypt/secrets.json");
pgHost = resolveDatabaseIP networkCfg.devices pgCfg.databases "ntfy";
pgPort = 5600;
in "postgres://ntfy:${pgPassword}@${pgHost}:${toString pgPort}/ntfy?sslmode=disable";
auth-default-access = "deny-all";
enable-login = true;
require-login = true;
auth-users = [
"admin:$2b$10$Y0DfYjZ2uETxbNrexGvVF.LE3fBpJ.GBszccUGPqZAVQt9/bFsLR2:admin"
"autobrr:$2b$10$Juz/FMxnIkDZz3RFirS7beuNo.H6YxY74ZWy2C6Fdle/r0TYbRIe.:user"
"seerr:$2b$10$cv9DGn6TO62Gi99XYLpVEea8lnIPxB7jwFJwvtWiHQOJ57as0DqOi:user"
"uptime-kuma:$2b$10$VwXFNTRxUbZKch7fFJAtsu.zdulpqHnxKBsvrotX8.7DmQPnyna12:user"
"keitai:$2b$10$A1V0qHSQFZ0gU7COkZzeIOMd1NGxwa6JIBqTq/8dECz4MyyCL39V6:user"
];
auth-access = [
"autobrr:autobrr:write"
"seerr:seerr:write"
"uptime-kuma:uptime_kuma:write"
"keitai:*:read-only"
];
};
};

BIN
secrets/crypt/secrets.json
View file

Binary file not shown.

10
secrets/sops/secrets.yaml
View file

@ -62,6 +62,12 @@ openvpn: ENC[AES256_GCM,data:7c0oz6EiliNnGtV71CTYlTnbXk8PjgRaq2b07iqiBv5w9YT+66+
vaultwarden: ENC[AES256_GCM,data:hXtsApGe3Htj6agKsgKG4aM7Y+aDe6AFzCzTE5+CoXSYRlWE6yhe0dMRZ5GYGwVV1Jcy9/9LvEksxhbP2sAgTW7pu6fa/kcn/IjoJm+Lqbg4F0rzruB56HxKypFblqqW2sq5gr3REEFU6y1SKN+eyyV0JM2hfTcb+SpbEPf+s2KhzADo,iv:04NeSQonfUTZ3zzp9lcbXGtILDpxaQVSoWWzFuGsWvA=,tag:Xn2UHGsq3J3Trbll6aqXTQ==,type:str]
autobrr: ENC[AES256_GCM,data:usq182koGwroZcE8M9NTVA==,iv:G0qZua4n7lDyQEv15drNTo74UlitSzVEuFn1ZyZgCAk=,tag:kUBRZ46GzGL4J/BI06aKnw==,type:str]
qui: ENC[AES256_GCM,data:b4fhhwUmM/ZWDGOAKwd+Z/tf5dpTrbTaXIpbHAyqg2edGcL/XU3fKHAg6h4q4wkzBTRGRkaQUxScGRtCusPwSQ==,iv:P4nhMIwIsmzImcpVZnBC+zFVXvegIODdXZtiMDn+E5k=,tag:XCQWeEpbM1VIhwWVTieVyw==,type:str]
ntfy:
admin: ENC[AES256_GCM,data:d77JV/yXDJB5Km2rmVVtWx0GLRVZU24wwQBq6AgngN2I2KsclyTmM9nhkLU=,iv:nlaF4QToFWS0gk+UK/XGR/Rdoa0Ugn99CheqL8ZSIhM=,tag:A19+nX1DXPbwmoomhuXXUg==,type:str]
autobrr: ENC[AES256_GCM,data:44BF664QbezcZeSbj0mUOhZgwC7tzrJcUh0Ub9LpXkh8Gjo7O60vqy3W0NY=,iv:t6TGS9A0vla5hLomtU+IxngY5FmHA70LHtBB/t4RdsI=,tag:2J+jOiwsl8d82T4qBZCLeg==,type:str]
seerr: ENC[AES256_GCM,data:0Ui94NByMXo84DRpLXZip6k1qOmiGbNy+WWxqow1g/gqcNdBRP1w+C1U54M=,iv:7NM/g13Gs6/y+5Sxt5Bu7g9wMUefxDdZF6xmO84XyOU=,tag:iDxwYEbtb/RJk/rHIB5ijg==,type:str]
uptime-kuma: ENC[AES256_GCM,data:QpkDv8I45WRxsVaGTfQ2E5ubV63D8EffO4SPyWHgDUqgCCalTH7HKqSaccg=,iv:bDGcDpMLpmD+oHzhZRkPP57tllaz8IrJBZEYZpbaYlw=,tag:Un7n0HIf23PX5748KGjPUw==,type:str]
keitai: ENC[AES256_GCM,data:U7aUq82VkTkk1guUG54ykTfhON5NCwto1vR5SZAxgwTkzd5AlkMzh1M16m4=,iv:De2FcOpBWn5vfHU2LxWV7hCwsoy+QUbkgwzGPQlL3sw=,tag:8cIzvNgdr9NgN3inQm0xhw==,type:str]
sops:
age:
- enc: |
@ -145,7 +151,7 @@ sops:
yUtR1lCjpW5Hpi2vDoom4HDsodeXfazqS+RjpHuKOLeO39bb4KbAhg==
-----END AGE ENCRYPTED FILE-----
recipient: age1988jz0qfj6m9xfenhd292tkxwyxvzhv79gkgrhm0gep353kej3yqe6zp86
lastmodified: "2026-06-24T05:42:40Z"
mac: ENC[AES256_GCM,data:sDOn9uKkvYQ88gUcYJK3pxbkCaTjLD+XG3Y/rJg7Xw4nA5fRsAvpV8iJx0NVu3vr6IKvaB3gApYWlfd5p9RfTAgt9IRnWEAWZI3/iSUmocbA8og9zgJrD4mpAyq3BoTcbbf7Wrm6hiVCoan9N4wBvka+a7e9nj77sXS5FVHY5Qs=,iv:ooCGmbfuzNeP8yQtmp3mffdW/0PbuOGnkcMmo4llHHI=,tag:qU5PJl3HikEVtDXNcAO7mg==,type:str]
lastmodified: "2026-06-28T03:41:37Z"
mac: ENC[AES256_GCM,data:MJfkxpQn9GEg96secXM03d8vXxYRy7A0XwFOpUw2uaTw06MCN4a2cwxzsq9Eh2rbHb7Zo7EwHDSmWK6jCXYVbrWgAkwuWKTWkb0RcUGwCOi38wMDJdysADRuSUKUrC1q5Ws4DDX5iYEAjlClE1KKO1peIZ1nUvt9GlJT+GfdrTg=,iv:i71tFaefBc8pSXEKEe8AWuywN7l9pMOZVMXVVEzyyMs=,tag:UxsoiJnC0u1d6r7iobcnIQ==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.1