From 4b7aa3cbb52d5764ced9bcb96fe9c4ff813d1f9b Mon Sep 17 00:00:00 2001 From: C4 Patino Date: Sat, 27 Jun 2026 22:59:18 -0500 Subject: [PATCH] feat: modify ntfy to use postgresql and restrict to auth-ed logins --- modules/nixos/bundles/common/default.nix | 1 + modules/nixos/services/apps/ntfy/default.nix | 43 +++++++++++++++---- secrets/crypt/secrets.json | Bin 3879 -> 4136 bytes secrets/sops/secrets.yaml | 10 ++++- 4 files changed, 44 insertions(+), 10 deletions(-) diff --git a/modules/nixos/bundles/common/default.nix b/modules/nixos/bundles/common/default.nix index af8a9a0..e08a27b 100644 --- a/modules/nixos/bundles/common/default.nix +++ b/modules/nixos/bundles/common/default.nix @@ -87,6 +87,7 @@ in { "forgejo" "grafana" "asciinema" + "ntfy" "terraform" "vaultwarden" ]; diff --git a/modules/nixos/services/apps/ntfy/default.nix b/modules/nixos/services/apps/ntfy/default.nix index 2352ed7..8b4f1b8 100644 --- a/modules/nixos/services/apps/ntfy/default.nix +++ b/modules/nixos/services/apps/ntfy/default.nix @@ -1,16 +1,16 @@ { config, + inputs, lib, namespace, ... -}: -with lib; -with lib.${namespace}; let - inherit (lib) mkIf; - inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveServicePort; +}: let + inherit (lib) mkIf mkForce; + inherit (lib.${namespace}) getAttrByNamespace readJsonOrEmpty getIn resolveDatabaseIP hostHasService resolveServicePort; inherit (config.networking) hostName; networkCfg = getAttrByNamespace config "${namespace}.services.networking"; + pgCfg = getAttrByNamespace config "${namespace}.services.storage.postgresql"; isEnabled = hostHasService networkCfg.network-services hostName "ntfy"; port = resolveServicePort networkCfg.network-services "ntfy" 5201; @@ -18,11 +18,38 @@ in { config = mkIf isEnabled { services.ntfy-sh = { enable = true; - settings = { + settings = lib.mkForce { base-url = "http://ntfy.yumeami.sh"; - upstream-base-url = "https://ntfy.sh"; - listen-http = ":${toString port}"; behind-proxy = true; + listen-http = ":${toString port}"; + + upstream-base-url = "https://ntfy.sh"; + + attachment-cache-dir = "/var/lib/ntfy-sh/attachments"; + database-url = let + pgPassword = getIn "postgresql.ntfy.password" (readJsonOrEmpty "${inputs.self}/secrets/crypt/secrets.json"); + pgHost = resolveDatabaseIP networkCfg.devices pgCfg.databases "ntfy"; + pgPort = 5600; + in "postgres://ntfy:${pgPassword}@${pgHost}:${toString pgPort}/ntfy?sslmode=disable"; + + auth-default-access = "deny-all"; + enable-login = true; + require-login = true; + + auth-users = [ + "admin:$2b$10$Y0DfYjZ2uETxbNrexGvVF.LE3fBpJ.GBszccUGPqZAVQt9/bFsLR2:admin" + "autobrr:$2b$10$Juz/FMxnIkDZz3RFirS7beuNo.H6YxY74ZWy2C6Fdle/r0TYbRIe.:user" + "seerr:$2b$10$cv9DGn6TO62Gi99XYLpVEea8lnIPxB7jwFJwvtWiHQOJ57as0DqOi:user" + "uptime-kuma:$2b$10$VwXFNTRxUbZKch7fFJAtsu.zdulpqHnxKBsvrotX8.7DmQPnyna12:user" + "keitai:$2b$10$A1V0qHSQFZ0gU7COkZzeIOMd1NGxwa6JIBqTq/8dECz4MyyCL39V6:user" + ]; + + auth-access = [ + "autobrr:autobrr:write" + "seerr:seerr:write" + "uptime-kuma:uptime_kuma:write" + "keitai:*:read-only" + ]; }; }; diff --git a/secrets/crypt/secrets.json b/secrets/crypt/secrets.json index 2b3225d1238dfa017268021a75d5735daf91203e..d98cc66df8aef5d9c3e242202543a8e692c3dd32 100755 GIT binary patch literal 4136 zcmZQ@_Y83kiVO&0aC&-p4$Cc*uiFd$sEf1TysYv~#GtRdLGx*{Y^tQ~Wq%2S%$MAD zM?|a$c@4lrG%p8U~j&cRU{(B?u^xg8VVv;aB?ZrP~$D)4^uX1)9RoppTXLr!= zY_hL;uisugans?9 zNR7h_^e1K+NuLu|7Jk!vd1-l>rrVzP!cYEOQ+&O%;7rC##?@E<*+y+IZ2t3_wd8@f zX6vOC5uyERyT4uKvzx8B^_SiZv0tHw4)9q;IBU+4j5-}DZ0qs$w`a&U*Uk%yF?us6(xdc1->bh) zxn0{%zCGt}>U7$DbBffQ31)u3PPiy}W@Ud2`|{H7Q{!qe(aO_R=VQvwOmr`p_Q!4N z{RamB^zsA4rbjg`d^XP^@x1q=WIeSnH+Pt8_!?e9MkvL-mR zX2NvQqNCH(6I}i*+r9iTUxzpkuk~K`lPex1iu*YF@4r6fTKU9Hl~aFkWR>2`-;n=B z`W5p9uFZm*B-2v2C3`1}9OzNc@mw=)#B_z!r6_lCchW84v@Vc z)?!bqh{Hx>+=rHT;qS0XX{j! z!fIg2eF4Mrt$6V&faHN zV6(#0XN5t;bN;6*QoG-5HdAuGVsdcDmb_^urTqurecCVeym`UH%Y8d;{LcQRchu*q z(^2<3F;BhoMP^DE&zj=O8NqjO<0Suv{SKYe+;={B+J7`8N6hB(HkF4(o2D(BsJ|$G z&XyyQfo>H&QPfYc-Df-i0YCPRrL!G~8vCM7# z7dBl#FXvw0cFQU>{GXk;?KH8cwTxz~(&I8W$Zh0Zf8m?LBu$egh4+10CN5iJWbz=X zNT_S2vfx#wS$_p?6s+}r zvtTdv8socp;=%z<{Lhw5I>WcPw&85Xo$|bw8U>wuwwcfAlVQ8C_u=jJ9F4mloZjmu z65S=JvMFEc{jD8~k2LpLnA^RdHmBuA?yu{d{~k52@)dP2IV<8#0wYxgWlk=$D^&=dSse8Jl0m4rcKz4& z#=Q1?He1eZoAjh}iusK@8~+Fy2&4qux+c8h_m8`pu|+#scz-{y@-9nz>@%q@_u27T z*A%p`yjZsRl$e-Z(bv%D_UrEHU0=9pD$5*3f%Qk`RKJw9t=FF-@t6JTj9uT4sPNxW zcGL);S`blOCR-iLbxnx*|9wUq(^H=X&yjCXtrS8j(dn^Es*U_N_iqs47o)fw+w{&l(Scz52(eNA}& ze1*fT`JMv4GcB%nT)Jm>YRC4+&olNst$L+r=GVNkmV-ry|69-=ZNtOgu4nz$dL<)x z*<~KjhR>o;__SZ&vhJ_gckZ>C>|L>SKG_Stt=gcoed;8g8IIdZp43f`2|DRH@03-@ zvN^`OL780~G1@0xBW5ZJl;%o2Kd!uG{YClUCpQX}?0gQ?mK=9H;hcLRDAe&7Pwx8Q z--oveF0*eHD>v!Cay+u*3IDm3>k`(@LGjGy~gB7)ZAXq1CxIJtdqI&%PDmG zT#aXvD`spcn3Mc{YU>5TaJT3>N9z?o=N`~doax7S!;-Dvduy|Cf$eyY#2!ZI(QJoc*euWIL%{k}5|EW-^x|**KeofV7dORyB*fIJ4YgXxR^$#p8>t{GTu?w!$?_b0p(v-h8 zNY}1k=5NuzC7&d8n~3*dH?q1p^Zm4HJ36o-TE(V?C`G3 zgC*SVh9a}?)cyZVuVv~@Q(Ml(ZoO4adFTF_^P9fSKCK+R_Vh=#hG)&))5PO9^~~OI zZLKBiZids|rkl@}`Ww3KR5|zSNUc**$7%z+t4+6pc5PMIp7ecYlue1YZ)5&D$HzfC zmHY%gn7jF3WR_gBaZ2Cw0LMF1cowZpj!kZycXOrh&iCrCLL7f>|2gCS#@L;Ytu3^s zep&d^bw*YA#mXZbC*EyxoHbujQLH#+`sB$cH_uyqVQE#`DUOy2uU-k2slz_@!M=*)v0ucV%&z`vt5eVO zB^c>u{{Q=ZLP(+itFK}WTB5hR#p-td4!L@4k&W4umG9Z^TNrZ)T~q4hoU=-yD__B+ zOkFni^r^{iRR`|vn3y-A_h8K>%PCvM>n>c1+RWt`?Js3;n03K{_|m*X6D)cy4i^f} z?NI$KQSItk-~Z_MoSLxMjUWF{T~%?{CTr8a=VewilpY%wCNuu+-ycxCkG<^4?ssd1 zKV~=Ety})p&1lgp@RPn4bCN3GS0m&=6JTE=N0GV4PEn&t$HneCQ~$c z|DAV=p(~wdwtvXr;|bmylOein$}Ns7^FOcNn|zChX-U5pJgWF2I^(T$bhMDjQADWs{d-Qkm?wGr;c8F}eD9alCY}W5xj{KWE`2<=sZfWpT zY&)}}OyKsDP?O4c4WzR2O>0oB z&4*{IJ#_xJ*!{G{hTh5bzop~+50+?F-A*;UJ1<-3-E8y8>(pHIuI$_QJi+&3VDziB z&6z4$GRvE$sH&tXv!2;grzPNj?0Fb-oz%37*i8pSlg~P7E;irj+@m1KV<`V@&g4wR z*XIIbgZ^&56eIrR2(Q3hL*8{#2TzGjn8_LTC#_`tPn{>BOy1d=8}5I55TFtL|8}Rr zu^90K-;O4GhRPtVS$)6Nx#cilS`eqN>S ze-T%k@~W9{=LqOnI>p%)y?l0WN9N0flM z=DG`yeKTOy_%^UpmnKg zm+Y=-&)4%Y$EI|d9FvM}zaDgWX^DniALn|o=PVWqrJJ^=s^4Sdl3#f8vbhviq;}s|!Cxg>1hWzw)HZ%1mWh z?F#h`Yd7-nUt_%WHS|RK+*2Fg%->(qEj+u~{o-_!_c9wUHLk8$Z+5t0F;lL))$V=L z!CLmq|D1`EsGYodRYe##r|4$p%IllkE>C5vIAZ?(yV>?%yH5XgJhO`Tyq)#W%+zlT zMH70te0FMTrR$#kw2^}+USYeMLr~S(^PRWb+xys7zRLADX#UDvhv(M0&98XxdcV0^ z@kr0#wMeXVtK#4L!TXGAwr2M{Tz{;{%q4isWlPC>Hj*m zbdBzh+Lpt-Hfy!NTom_Az4UYmU)b&QpL<&-IZ7TAd!o{`an|~;OCM&R*6Dau>Al3c zX6L$}YbJHOgqNqSsfnA<_4-QKlBf-LtXAC6{j`>w{mgmRL)+HfpQ~rtzw++VycbK& zzFklkngKu17 z56hHx`%Kx}^2B{#ww>-#mYxfe+g##n5}l>ze*fa5)K3yr7N*KV|VHBc~w!^Zn1B%3!ioXKPRu;jiXY` zv(AgQANSvr6>`h}&)(MsZiPOoSAz9rtOQxN*{Cw~*oujjHrBBjcC>w3UADph$+{;h zJr;V`|8jgx(-!rd^Zrv+{jGhWOky=QyJGP(bK+N3fv3!KD26%6p6wye*u!?3*9v zTgtbqI)bI_xcKY%{*U)rUhe9=@bc;R$*Y?uwHv8UXR2K<`{svY!1r6n=HHNAk|TK} zy28Y3Zprk$PgM5HZ#LigpXK%;)%Z!%nWt{@$Z|PaP_cNs*xT|i+l|(7t8|K$vKB1% zu>E_mnrCKsoLy#Q?U@PZX00@G`2LgOQrKR_WBpDutaTck&e3g;lI=#z4^cR z|9xjW7_d0q>67k^!xbpf#o_4D#1e)$JS z!#;It9^1$F(l5j8!poV*zB*n#+Sm4NI?LG=@15@zI(_?SJK4v&`Ls2!ZkWRr#T5p| z4Lw}%Ccl2V;IjT9?bscXp4Z`sb2Gnnkn6T6c&m& zuN9l@_citEj_s``lP|R2U(@Alv20zfOK^3_q|JU;bPxairfiz_%W}YZrk$4c{00SGT|cw`3#FA$3U53sW}Fzu7O-@4x8cjK12HBtC0~B9 zKZ}sr=>SYq7N)Zw&2xUFUC3i0s<8Eji@RuJwEg;iq!9Jc<>0WqV+U z#_U@y-Fr{$Ioy2SYFT5E&s&?90uJ(*U$^W%JO9Fo8@J>-CVX<-d%*Iq-u_m@q{lZ? z7st&O&3N48_*^pS&Z$3@?%#U99bfa~@wSsf(LG)v+oIR6@fF>@;>f$ugjeYkKdw7o z?-T!8^4oMihlv4J(|*i2s~}OjQ*`0GbBiWaCY{bwp5}Bfq`&-JB9l|Z+KIC#^sjfm zGFklI<>pj{h>8TZ%P&1vNp$l*T6sZU!R=1?%J`5)1s;-(ckgk??`zq?zj&Smd!!0? zudJzX{KJsh1+y(5t+4#Rd)AD&8{4lq-!rQ{xVxy&g|G8pXZf}FJ-g;TWPI4G#eXt- z{(FD6^=k7xPTIda#Ct+nWc@S`?fT>1X5Z`!Pw^;(8ZPPKytX#+eft*q>+jny34d}4 zP}!jJqWXx5jme?-04sp7Om@z2cT1`+WK4BlHbue!B>OR&jg?|+R2b^Grwdd4xw zXouR&n%gtZ$e7D#J-x{u_A9e<*(-teRp;4@#NN&*4t??>dYw@5l0RyCKOZzsxVv*x zt!B#0wAUP>ZzNSsy_O3YO?>0Qd-eUMA{X5n{x$d3xPCjhOSR_agJl)$3X#vZ2YiyT zU)ndTYl7(I%ye#Bw-=xHRdyY;*yNY> zt0Pk#KWBT{F0I>k&VHBr&6r1TTSI*vPiLKMk-puSIZg8L`;9JT{DLJd8oyr~Ua{%e zrFlutvC{f$f7^_?Cyu4h;)ztX2B~* zKXDk`z>@%Lv8r zv}Uhq@3I_k)_=Mg{^aqQwu6kE>kcx{nO8m|V)Mp=b;7&C!%~c#4!$t0eZi{d=~;U) zd9U!?+du!l+LaJEdqebsdG3MwZcpNc|L^Fu;gHBaC&9X<(!09&m)DG6+p`!0e@L!- z%gMMjg7-qgse}pEftKO1@B70a-#5Peq5IqQ>kW6iI%R7&q`r4Iw9!`7)so-CYi{O{QDw>j&#zTNzI&(GKCp%zvJfij)3 zOYfvTw&-ZdtXWmE_ssIB0F~y?8UJEpXZe3~yWZH${yCt+HL8EgHI}za9Zvh^+O0Wf zv~;_2^PHs6c?N1~`poGvQxogvN?v{!AfMA<^~yd~=gMjxgNNqE+{~}0eCn7Ml(h3z zo#-dM_*;T8)8j>jo%dYyE1P4z`pvK87t373_dc`I7V;OKnE3p%^vw6$`1-1EzUCIS zo6KHoXU-j0Fj4wS-I}Qvs*G>EdKbu0a9Y;<==y2Kt%4USnEo6*&*;w#<_QrV$Lo6+Q(a@zif+LaP5<_dCkWzCFulh z#uZ%}Z!FrT2isrn2#P<@ytF)1i`R`qHUHdRr(a#l$G&XXUmM=KcWK8;5xu+)J5l*x z0bYs1^S(5^U$WYfr$aa8UC7^wm+DeAO)DK&DOX>;@$caD$3N}4_PD%#cjCqyqj|3c zVs~D=aYs+>IB&|)lFe^uj`xj z?Em@PQ@4ey|B^_2R%<1Ewe8Q^#&Bw@uwkFq2t`%<{ZMo^o+N{5F$0WCX zTj$8OT+`}4@qo$j{ujOm1K-R~A_vwTzwk`x&CzqKKmK;$JtfRu$u4yIRLc^JsEc}` z3{@=`B|a7XwLKgy@Z!H{;NBY^UxnYyJ+e)dL43YZvr|Qqm&3$m7cZPR;-7kAleC!A zD$s4r`^nq+;}T0Y7#TUq9DdIKg72zKCsFCPsXpiY*p_obX9ZJ zvJB2`TFmCbsC>C7*R^1u%_&XylSk5@&R-Hd=X}fV_Z&y#Z|}@fKOn!efMsswiPpbU zrku4Y|NL)O)kT5TlO?~*|E;l7dd3=|`VZwew(LIh;ZDLC1 z@nV9R_1|i4$@#vnZ%$60$e$|A`t{q9DcW8wwrRhXrtHqyexUDL$!Xyo3rq{MHvQ}@ z`kx?Dwb(jgT{~NQs^7npe_NZg--u56Jty_OeSP5R1Cm85f>Iw2cL&VSI8la+-VjP`o3pr@$Js~{?Em!o7>e7|1#YB+el~U%EV}{61B#j2~pv9t7}4zl{dxe z{C9t6WD~dK@*<&Sc1quVTHh43zO?9H!#CRutDdUN6SvW z*!+LL_}ZoR-+g}^*!%4Nw5wGL^`d!dUh%hsS@04g)HH2?qr diff --git a/secrets/sops/secrets.yaml b/secrets/sops/secrets.yaml index 4f2a88a..4145001 100755 --- a/secrets/sops/secrets.yaml +++ b/secrets/sops/secrets.yaml @@ -62,6 +62,12 @@ openvpn: ENC[AES256_GCM,data:7c0oz6EiliNnGtV71CTYlTnbXk8PjgRaq2b07iqiBv5w9YT+66+ vaultwarden: ENC[AES256_GCM,data:hXtsApGe3Htj6agKsgKG4aM7Y+aDe6AFzCzTE5+CoXSYRlWE6yhe0dMRZ5GYGwVV1Jcy9/9LvEksxhbP2sAgTW7pu6fa/kcn/IjoJm+Lqbg4F0rzruB56HxKypFblqqW2sq5gr3REEFU6y1SKN+eyyV0JM2hfTcb+SpbEPf+s2KhzADo,iv:04NeSQonfUTZ3zzp9lcbXGtILDpxaQVSoWWzFuGsWvA=,tag:Xn2UHGsq3J3Trbll6aqXTQ==,type:str] autobrr: ENC[AES256_GCM,data:usq182koGwroZcE8M9NTVA==,iv:G0qZua4n7lDyQEv15drNTo74UlitSzVEuFn1ZyZgCAk=,tag:kUBRZ46GzGL4J/BI06aKnw==,type:str] qui: ENC[AES256_GCM,data:b4fhhwUmM/ZWDGOAKwd+Z/tf5dpTrbTaXIpbHAyqg2edGcL/XU3fKHAg6h4q4wkzBTRGRkaQUxScGRtCusPwSQ==,iv:P4nhMIwIsmzImcpVZnBC+zFVXvegIODdXZtiMDn+E5k=,tag:XCQWeEpbM1VIhwWVTieVyw==,type:str] +ntfy: + admin: ENC[AES256_GCM,data:d77JV/yXDJB5Km2rmVVtWx0GLRVZU24wwQBq6AgngN2I2KsclyTmM9nhkLU=,iv:nlaF4QToFWS0gk+UK/XGR/Rdoa0Ugn99CheqL8ZSIhM=,tag:A19+nX1DXPbwmoomhuXXUg==,type:str] + autobrr: ENC[AES256_GCM,data:44BF664QbezcZeSbj0mUOhZgwC7tzrJcUh0Ub9LpXkh8Gjo7O60vqy3W0NY=,iv:t6TGS9A0vla5hLomtU+IxngY5FmHA70LHtBB/t4RdsI=,tag:2J+jOiwsl8d82T4qBZCLeg==,type:str] + seerr: ENC[AES256_GCM,data:0Ui94NByMXo84DRpLXZip6k1qOmiGbNy+WWxqow1g/gqcNdBRP1w+C1U54M=,iv:7NM/g13Gs6/y+5Sxt5Bu7g9wMUefxDdZF6xmO84XyOU=,tag:iDxwYEbtb/RJk/rHIB5ijg==,type:str] + uptime-kuma: ENC[AES256_GCM,data:QpkDv8I45WRxsVaGTfQ2E5ubV63D8EffO4SPyWHgDUqgCCalTH7HKqSaccg=,iv:bDGcDpMLpmD+oHzhZRkPP57tllaz8IrJBZEYZpbaYlw=,tag:Un7n0HIf23PX5748KGjPUw==,type:str] + keitai: ENC[AES256_GCM,data:U7aUq82VkTkk1guUG54ykTfhON5NCwto1vR5SZAxgwTkzd5AlkMzh1M16m4=,iv:De2FcOpBWn5vfHU2LxWV7hCwsoy+QUbkgwzGPQlL3sw=,tag:8cIzvNgdr9NgN3inQm0xhw==,type:str] sops: age: - enc: | @@ -145,7 +151,7 @@ sops: yUtR1lCjpW5Hpi2vDoom4HDsodeXfazqS+RjpHuKOLeO39bb4KbAhg== -----END AGE ENCRYPTED FILE----- recipient: age1988jz0qfj6m9xfenhd292tkxwyxvzhv79gkgrhm0gep353kej3yqe6zp86 - lastmodified: "2026-06-24T05:42:40Z" - mac: ENC[AES256_GCM,data:sDOn9uKkvYQ88gUcYJK3pxbkCaTjLD+XG3Y/rJg7Xw4nA5fRsAvpV8iJx0NVu3vr6IKvaB3gApYWlfd5p9RfTAgt9IRnWEAWZI3/iSUmocbA8og9zgJrD4mpAyq3BoTcbbf7Wrm6hiVCoan9N4wBvka+a7e9nj77sXS5FVHY5Qs=,iv:ooCGmbfuzNeP8yQtmp3mffdW/0PbuOGnkcMmo4llHHI=,tag:qU5PJl3HikEVtDXNcAO7mg==,type:str] + lastmodified: "2026-06-28T03:41:37Z" + mac: ENC[AES256_GCM,data:MJfkxpQn9GEg96secXM03d8vXxYRy7A0XwFOpUw2uaTw06MCN4a2cwxzsq9Eh2rbHb7Zo7EwHDSmWK6jCXYVbrWgAkwuWKTWkb0RcUGwCOi38wMDJdysADRuSUKUrC1q5Ws4DDX5iYEAjlClE1KKO1peIZ1nUvt9GlJT+GfdrTg=,iv:i71tFaefBc8pSXEKEe8AWuywN7l9pMOZVMXVVEzyyMs=,tag:UxsoiJnC0u1d6r7iobcnIQ==,type:str] unencrypted_suffix: _unencrypted version: 3.13.1