ntfy Server + With some Web Password Protection such as Authelia reddit / selfhosted ---------------------------------------------------------------------- querylab · 2023-10-11 21:00 Has anyone tried to configure authelia or authentik with a local nfty server, do you know any way to protect the web interface? ---------------------------------------------------------------------- epsiblivion · 2023-10-11 21:10 if you're using swag, you can just add to the ntfy container label, swag=enable if swag has auto-proxy enabled. ---------------------------------------------------------------------- querylab · 2023-10-11 21:17 I don't know what swag is, I currently use authelia with nginx proxy manager and it is impossible to use it with a local ntfy server, I have tried a thousand ways and ntfy https://ntfy.sh/ is not viable without a dashbord web interface protected by a user and pass ---------------------------------------------------------------------- epsiblivion · 2023-10-11 21:27 you have to set the setting to make it reverse proxy aware. swag is a nginx based reverse proxy with a lot of builtin configs for various services and customizations. ---------------------------------------------------------------------- Independent_Till5832 · 2023-10-11 21:38 And how do you want to send alerts with authelia in front? ---------------------------------------------------------------------- querylab · 2023-10-11 21:42 So I ask is there any way to password protect the ntfy dashboard on the server? ---------------------------------------------------------------------- Independent_Till5832 · 2023-10-11 21:44 Sorry my bad, but why does it matter as long as you secure any channel? ---------------------------------------------------------------------- querylab · 2023-10-11 21:45 in fact i run ntfy server on docker on a vps tied with a cronjob but it scares me to think that anyone can manipulate and see my complete dashboard. ---------------------------------------------------------------------- mztiq · 2023-10-11 21:51 Then use it through a VPN (e.g. WireGuard), that's how I do it. Only expose services to the internet if you really have to. ---------------------------------------------------------------------- querylab · 2023-10-11 22:50 I have it also in a vpn wireguard and I do portforwarding from a local machine using a vps bridge but the point is not that the point is that lan or wan should have an authentication panel is basic in any web application I do not understand how ntfy has not done that yet. ---------------------------------------------------------------------- thekrautboy · 2023-10-12 01:40 https://ntfy.sh/docs/config/#access-control ---------------------------------------------------------------------- GregPL151 · 2023-10-16 23:18 For sure set the authentication inside NTFY itself. In terms of protecting NTFY with Authelia that is what I did to allow iOS app to receive notifications and being able to see the messages in the app. Add below in Authelia configuration.yml \- domain: 'ntfy.example.com' resources: \- '\^/yourtopic/json\\?poll=1&' methods: \- GET policy: bypass change domain to your NTFY hostname and 'yourtopic' to your topic name. I have a default config that protects everything else and bypass only this one so if you try to access your NTFY URL in the browser it will ask you to authenticate, but the iOS app will be able to do get the message from your NTFY server bypassing Authelia. Obviously, the topic itself requires built-in NTFY authentication so no one without the credentials cannot get the messages and no one can push new messages as well. Not sure how it would work with Android but you can protect your NTFY instance with Authelia and then see in nginx logs what URIs Android app is trying to reach and figure out what is required to get it work. Hope that helps a bit ;) ---------------------------------------------------------------------- nicnic2001 · 2023-11-21 15:34 So do you add '[ntfy.example.com](https://ntfy.example.com)' in your one/two\_factor policies? And then a separate '[ntfy.example.com](https://ntfy.example.com)' with the resource regex for bypass policy? ---------------------------------------------------------------------- GregPL151 · 2023-11-21 17:17 I think it is the other way around. In the config file you first add more specific policy, and then the more general one. Because the first policy that the request matches will apply and next rules will not apply. Please refer to the docs, everything is there. There is also a specific section for rule matching. https://www.authelia.com/configuration/security/access-control/ ---------------------------------------------------------------------- nicnic2001 · 2023-11-21 17:28 Thank you for your help :) Just managed to figure it out! ---------------------------------------------------------------------- ConsistentBuy6830 · 2023-11-23 16:36 Hey, I'm having some issues right now. I tried what was suggested above and my authelia logs aren't blocking the request by the looks of it but I'm still not getting any notifs on my phone (IOS). Are you able to shre your config or help me out here? Here are my logs from authelia: time="2023-11-24T00:09:35+08:00" level=info msg="Authelia v4.37.5 is starting" time="2023-11-24T00:09:35+08:00" level=info msg="Log severity set to debug" time="2023-11-24T00:09:35+08:00" level=info msg="Storage schema is being checked for updates" time="2023-11-24T00:09:35+08:00" level=info msg="Storage schema is already up to date" time="2023-11-24T00:09:35+08:00" level=debug msg="The NTP startup check was skipped due to there being no configured 2FA access control rules" time="2023-11-24T00:09:35+08:00" level=info msg="Initializing server for non-TLS connections on '[::]:9091' path '/'" time="2023-11-24T00:10:24+08:00" level=debug msg="Check authorization of subject username= groups= ip=***.**.***.*** and object https://ntfy.domain.com/SSH (method POST)." And here's my authelia config file: access_control: ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any ## resource if there is no policy to be applied to the user. default_policy: one_factor rules: - domain: domain.com policy: bypass - domain: ntfy.domain.com policy: bypass methods: - POST - domain: ntfy.domain.com policy: bypass methods: - GET resources: '^/Portfolio/json\?poll=1&' - domain: ntfy.domain.com policy: bypass methods: - GET resources: '^/SSH/json\?poll=1&' - domain: ntfy.domain.com policy: bypass methods: - GET resources: '^/Status/json\?poll=1&' - domain: ntfy.domain.com policy: one_factor I'm fairly new to authelia so any help would be greatly appreciated, thanks :) ---------------------------------------------------------------------- Hiren__ · 2023-11-23 18:06 hii! how did you do it? I'm trying to do the same at this moment. ---------------------------------------------------------------------- nicnic2001 · 2023-11-23 18:15 So, my authelia `configuration.yml` file: ```yaml ... access_control: default_policy: deny rules: - domain: - ntfy.example.domain methods: - GET - POST - PUT resources: - '^/topic1([/?].*)?$' - '^/topic2([/?].*)?$' policy: bypass - domain: - ntfy.example.domain methods: - POST policy: bypass - domain: - ntfy.example.domain policy: two_factor ``` Make sure you follow https://docs.ntfy.sh/config/?h=ios#ios-instant- notifications. I left `upstream-base-url` at the default value of `"https://ntfy.sh"`. You could this configuration isn't great because it lets anyone POST to your topics if they know the topic names so make sure you implement access control too: https://docs.ntfy.sh/config/?h=access+tok#access- control ---------------------------------------------------------------------- nicnic2001 · 2023-11-23 18:17 [https://www.reddit.com/r/selfhosted/comments/175os7t/comment/kagu05b/ ?utm\_source=share&utm\_medium=web2x&context=3](https://www.reddit.com /r/selfhosted/comments/175os7t/comment/kagu05b/?utm_source=share&utm_m edium=web2x&context=3) :) ---------------------------------------------------------------------- ConsistentBuy6830 · 2023-11-23 18:59 Yeah, I figured it out and I feel like a real dumb fuck. It was access control perms that were stopping the notifications... Didn't realise till I saw my ntfy logs. Thanks for your help!