50 lines
1.8 KiB
Nix
50 lines
1.8 KiB
Nix
{ config
|
|
, pkgs
|
|
, lib
|
|
, ...
|
|
}:
|
|
|
|
{
|
|
options.services.ntfy-container = {
|
|
enable = lib.mkEnableOption "ntfy service";
|
|
port = lib.mkOption {
|
|
type = lib.types.port;
|
|
default = 8080;
|
|
description = "Host port to map to ntfy";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf config.services.ntfy-container.enable {
|
|
services.ntfy-sh = {
|
|
enable = true;
|
|
settings = {
|
|
base-url = "https://ntfy.edley.me";
|
|
# Bind to all interfaces - nginx proxy (in Docker container) needs to reach it.
|
|
# Security: firewall restricts access to nginx proxy machine only.
|
|
listen-http = ":${toString config.services.ntfy-container.port}";
|
|
cache-file = "/var/lib/ntfy-sh/cache.db";
|
|
auth-file = "/var/lib/ntfy-sh/user.db";
|
|
behind-proxy = true; # Explicitly enable proxy support (X-Forwarded-*)
|
|
|
|
# Security: Deny all access by default, require login
|
|
auth-default-access = "deny-all";
|
|
enable-signup = false;
|
|
enable-login = true;
|
|
# Require login for ALL web app actions - hides the public UI
|
|
# behind authentication so anonymous visitors can't even browse
|
|
# the web app.
|
|
require-login = true;
|
|
};
|
|
};
|
|
|
|
# Firewall: allow access only from nginx proxy machine (adjust IP as needed).
|
|
# Example: allow from 10.0.0.x (Tailscale IP of nginx proxy machine)
|
|
# networking.firewall.allowedTCPPorts = [ config.services.ntfy-container.port ];
|
|
# networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ config.services.ntfy-container.port ];
|
|
|
|
# Ensure state directory exists (ntfy-sh service usually creates it, but good to ensure permissions if needed)
|
|
# The systemd service for ntfy-sh usually handles DynamicUser/StateDirectory or similar.
|
|
# We can trust the upstream module for basic setup.
|
|
};
|
|
}
|