[PR #1579] WIP: `auth-user-header`: Support for Authelia, etc. #1647

New issue

Open

opened 2026-05-07 01:03:04 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-07 01:03:04 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/binwiederhier/ntfy/pull/1579
Author: @binwiederhier
Created: 1/30/2026
Status: 🔄 Open

Base: main ← Head: user-header

📝 Commits (6)

46cb9f2 User header
b67ffa4 Auth logout URL, auth proxy
9b1be51 Remove auth_mode
099cad0 Sw stuff
857f574 Merge branch 'main' into user-header
9e755a7 This works

📊 Changes

13 files changed (+281 additions, -41 deletions)

View changed files

📝 Dockerfile-build (+1 -0)
📝 cmd/serve.go (+28 -9)
📝 server/config.go (+4 -0)
📝 server/server.go (+29 -0)
📝 server/server.yml (+21 -0)
📝 server/server_test.go (+96 -0)
📝 server/types.go (+2 -0)
📝 web/public/config.js (+2 -0)
📝 web/public/sw.js (+38 -21)
📝 web/src/app/AccountApi.js (+23 -1)
📝 web/src/app/Session.js (+5 -1)
📝 web/src/components/ActionBar.jsx (+23 -7)
📝 web/src/components/Login.jsx (+9 -2)

📄 Description

This implements #601. It partially works. I tested it with Authelia.

What works

The configured auth-user-header (e.g. Remote-User) is passed from Authelia to ntfy, and ntfy then uses that header to pick the configured user in the backend
The web app redirects to Authelia when not logged in (this was very difficult due to aggressive service worker caching!)
The web app displays a logout button if auth-logout-url is configured, which allows you to log out via Authelia

What doesn't work

There seems to be a race when loading the web app that first initializes the database using "no user" (the ntfy IndexedDB is used instead of ntfy-$username), which leads to the wrong topics being shown in the sidebar. This can be easily reproduced when switching between users.
❓ ❓ I have no idea how the Android app is supposed to work at all with this.

Setup

ntfy/server.yml

auth-file: ...
auth-user-header: Remote-User
auth-logout-url:

Caddyfile

auth.dev.ntfy.sh {
  tls /etc/letsencrypt/live/dev.ntfy.sh/fullchain.pem /etc/letsencrypt/live/dev.ntfy.sh/privkey.pem
  reverse_proxy authelia:9091
}

ntfy.dev.ntfy.sh {
  tls /etc/letsencrypt/live/dev.ntfy.sh/fullchain.pem /etc/letsencrypt/live/dev.ntfy.sh/privkey.pem

  forward_auth authelia:9091 {
    uri /api/verify?rd=https://auth.dev.ntfy.sh/
    copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
  }

  reverse_proxy host.docker.internal:2586
}

authelia/configuration.yml

server:
  address: tcp://0.0.0.0:9091

log:
  level: info

authentication_backend:
  file:
    path: /config/users.yml
    password:
      algorithm: argon2id

access_control:
  default_policy: one_factor

session:
  secret: "REPLACE_WITH_LONG_RANDOM_1________________________________________"
  cookies:
    - domain: "dev.ntfy.sh"
      authelia_url: "https://auth.dev.ntfy.sh"
  expiration: 1h
  inactivity: 5m

storage:
  encryption_key: "REPLACE_WITH_LONG_RANDOM_2________________________________________"
  local:
    path: /config/db.sqlite3

notifier:
  filesystem:
    filename: /config/notification.txt

identity_validation:
  reset_password:
    jwt_secret: "REPLACE_WITH_LONG_RANDOM_3________________________________________"

docker-compose.yml

services:
  caddy:
    image: caddy:2
    ports:
      - "443:443/tcp"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - /etc/letsencrypt:/etc/letsencrypt:ro
      - caddy_data:/data
      - caddy_config:/config
    networks: [auth]
    extra_hosts:
      - "host.docker.internal:host-gateway"

  authelia:
    image: authelia/authelia:latest
    volumes:
      - ./authelia:/config
    networks: [auth]

networks:
  auth: {}

volumes:
  caddy_data: {}
  caddy_config: {}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/binwiederhier/ntfy/pull/1579 **Author:** [@binwiederhier](https://github.com/binwiederhier) **Created:** 1/30/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `user-header` --- ### 📝 Commits (6) - [`46cb9f2`](https://github.com/binwiederhier/ntfy/commit/46cb9f2b41e847c3ac51c85b37684ba79a1ba705) User header - [`b67ffa4`](https://github.com/binwiederhier/ntfy/commit/b67ffa4f5fc4fd5c056275a9388feac83fba703f) Auth logout URL, auth proxy - [`9b1be51`](https://github.com/binwiederhier/ntfy/commit/9b1be517eabee6691414602ab7a467b4bd56ae2d) Remove auth_mode - [`099cad0`](https://github.com/binwiederhier/ntfy/commit/099cad02b85075a5cb8ea440ee508c76074e1e3d) Sw stuff - [`857f574`](https://github.com/binwiederhier/ntfy/commit/857f5742b9f784b929454e382a23472b2f848ca0) Merge branch 'main' into user-header - [`9e755a7`](https://github.com/binwiederhier/ntfy/commit/9e755a73f0464cb54c2bb9705f9ae98c339ec6f8) This works ### 📊 Changes **13 files changed** (+281 additions, -41 deletions) <details> <summary>View changed files</summary> 📝 `Dockerfile-build` (+1 -0) 📝 `cmd/serve.go` (+28 -9) 📝 `server/config.go` (+4 -0) 📝 `server/server.go` (+29 -0) 📝 `server/server.yml` (+21 -0) 📝 `server/server_test.go` (+96 -0) 📝 `server/types.go` (+2 -0) 📝 `web/public/config.js` (+2 -0) 📝 `web/public/sw.js` (+38 -21) 📝 `web/src/app/AccountApi.js` (+23 -1) 📝 `web/src/app/Session.js` (+5 -1) 📝 `web/src/components/ActionBar.jsx` (+23 -7) 📝 `web/src/components/Login.jsx` (+9 -2) </details> ### 📄 Description This implements #601. It partially works. I tested it with Authelia. ### What works - The configured `auth-user-header` (e.g. `Remote-User`) is passed from Authelia to ntfy, and ntfy then uses that header to pick the configured user in the backend - The web app redirects to Authelia when not logged in (this was very difficult due to aggressive service worker caching!) - The web app displays a logout button if `auth-logout-url` is configured, which allows you to log out via Authelia <img width="484" height="343" alt="image" src="https://github.com/user-attachments/assets/1a92ee87-a32d-4501-86f0-2a5de6c71536" /> ### What doesn't work - There seems to be a race when loading the web app that first initializes the database using "no user" (the `ntfy` IndexedDB is used instead of `ntfy-$username`), which leads to the wrong topics being shown in the sidebar. This can be easily reproduced when switching between users. - :question: :question: I have no idea how the Android app is supposed to work at all with this. <img width="493" height="412" alt="image" src="https://github.com/user-attachments/assets/5d4f2b21-8375-4c4b-8052-b5a54595b317" /> ## Setup ### ntfy/server.yml ``` auth-file: ... auth-user-header: Remote-User auth-logout-url: ``` ### Caddyfile ``` auth.dev.ntfy.sh { tls /etc/letsencrypt/live/dev.ntfy.sh/fullchain.pem /etc/letsencrypt/live/dev.ntfy.sh/privkey.pem reverse_proxy authelia:9091 } ntfy.dev.ntfy.sh { tls /etc/letsencrypt/live/dev.ntfy.sh/fullchain.pem /etc/letsencrypt/live/dev.ntfy.sh/privkey.pem forward_auth authelia:9091 { uri /api/verify?rd=https://auth.dev.ntfy.sh/ copy_headers Remote-User Remote-Groups Remote-Name Remote-Email } reverse_proxy host.docker.internal:2586 } ``` ### authelia/configuration.yml ``` server: address: tcp://0.0.0.0:9091 log: level: info authentication_backend: file: path: /config/users.yml password: algorithm: argon2id access_control: default_policy: one_factor session: secret: "REPLACE_WITH_LONG_RANDOM_1________________________________________" cookies: - domain: "dev.ntfy.sh" authelia_url: "https://auth.dev.ntfy.sh" expiration: 1h inactivity: 5m storage: encryption_key: "REPLACE_WITH_LONG_RANDOM_2________________________________________" local: path: /config/db.sqlite3 notifier: filesystem: filename: /config/notification.txt identity_validation: reset_password: jwt_secret: "REPLACE_WITH_LONG_RANDOM_3________________________________________" ``` ### docker-compose.yml ``` services: caddy: image: caddy:2 ports: - "443:443/tcp" - "443:443/udp" volumes: - ./Caddyfile:/etc/caddy/Caddyfile:ro - /etc/letsencrypt:/etc/letsencrypt:ro - caddy_data:/data - caddy_config:/config networks: [auth] extra_hosts: - "host.docker.internal:host-gateway" authelia: image: authelia/authelia:latest volumes: - ./authelia:/config networks: [auth] networks: auth: {} volumes: caddy_data: {} caddy_config: {} ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>