starred/ntfy

Fork 0

mirror of https://github.com/binwiederhier/ntfy.git synced 2026-05-09 08:26:00 +02:00

[GH-ISSUE #620] [Feature] allow an anonymous "localhost user" for the Private instance #464

New issue

Closed

opened 2026-05-07 00:24:26 +02:00 by BreizhHardware · 9 comments

BreizhHardware commented

2026-05-07 00:24:26 +02:00

Owner

Originally created by @LuckyTurtleDev on GitHub (Feb 19, 2023).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/620

Application servers needs anonymous write access to ntfy. I am not a big fan of allowing everyone to upload data to my server.
Since ntfy is running on the same server as the application servers , I wonder if it would possible to give only localhost/docker anonymous write access to ntfy.

Originally created by @LuckyTurtleDev on GitHub (Feb 19, 2023). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/620 Application servers needs anonymous write access to ntfy. I am not a big fan of allowing everyone to upload data to my server. Since ntfy is running on the same server as the application servers , I wonder if it would possible to give only localhost/docker anonymous write access to ntfy.

BreizhHardware

2026-05-07 00:24:26 +02:00

closed this issue
added the
question

server
labels

BreizhHardware commented

2026-05-07 00:24:27 +02:00

Author

Owner

@binwiederhier commented on GitHub (Feb 19, 2023):

I am not a big fan of allowing everyone to upload data to my server.

I'm sure you've seen the section about access control in the docs (https://docs.ntfy.sh/config/#access-control), so you can define granular access controls based on users.

For your specific problem, you could define default permissions as deny-all, and then create ACL entries to allow anonymous write access to a topic:

server.yml

auth-default-access: deny-all

Define ACL:

ntfy access everyone sometopic write-only

And then you could restrict access to /sometopic in nginx (or whatever your proxy is) to only local IP addresses.

I do not intend to add IP restrictive access to ntfy itself (for now).

@binwiederhier commented on GitHub (Feb 19, 2023): > I am not a big fan of allowing everyone to upload data to my server. I'm sure you've seen the section about access control in the docs (https://docs.ntfy.sh/config/#access-control), so you can define granular access controls based on users. For your specific problem, you could define default permissions as `deny-all`, and then create ACL entries to allow anonymous write access to a topic: server.yml ``` auth-default-access: deny-all ``` Define ACL: ``` ntfy access everyone sometopic write-only ``` And then you could restrict access to `/sometopic` in nginx (or whatever your proxy is) to only local IP addresses. I do not intend to add IP restrictive access to ntfy itself (for now).

BreizhHardware commented

2026-05-07 00:24:27 +02:00

Author

Owner

@binwiederhier commented on GitHub (Feb 19, 2023):

Alternatively, if you have listen-unix defined, you can directly write to the unix socket, e.g. curl -d hi --unix-socket /tmp/ntfy.sock http://127.0.0.1/sometopic

@binwiederhier commented on GitHub (Feb 19, 2023): Alternatively, if you have `listen-unix` defined, you can directly write to the unix socket, e.g. `curl -d hi --unix-socket /tmp/ntfy.sock http://127.0.0.1/sometopic`

BreizhHardware commented

2026-05-07 00:24:27 +02:00

Author

Owner

@binwiederhier commented on GitHub (Feb 20, 2023):

Hope this was answered. If not, feel free to comment or re-open.

@binwiederhier commented on GitHub (Feb 20, 2023): Hope this was answered. If not, feel free to comment or re-open.

BreizhHardware commented

2026-05-07 00:24:27 +02:00

Author

Owner

@LuckyTurtleDev commented on GitHub (Feb 20, 2023):

Yes it was answered. Thanks. I will try out your solution soon.
Maybe this can be keep open for the feature request?

@LuckyTurtleDev commented on GitHub (Feb 20, 2023): Yes it was answered. Thanks. I will try out your solution soon. Maybe this can be keep open for the feature request?

BreizhHardware commented

2026-05-07 00:24:28 +02:00

Author

Owner

@LuckyTurtleDev commented on GitHub (Feb 21, 2023):

@binwiederhier sadly I am not allowed to reopen the issue

@LuckyTurtleDev commented on GitHub (Feb 21, 2023): @binwiederhier sadly I am not allowed to reopen the issue

BreizhHardware commented

2026-05-07 00:24:28 +02:00

Author

Owner

@binwiederhier commented on GitHub (Feb 21, 2023):

I don't think I want to implement IP-based access control in ntfy. That seems like something that has to live or be solved outside it. In a proxy, as I said. You can easily solve this in nginx.

@binwiederhier commented on GitHub (Feb 21, 2023): I don't think I want to implement IP-based access control in ntfy. That seems like something that has to live or be solved outside it. In a proxy, as I said. You can easily solve this in nginx.

BreizhHardware commented

2026-05-07 00:24:28 +02:00

Author

Owner

@LuckyTurtleDev commented on GitHub (Feb 22, 2023):

If I restrict access to /sometopic would not this effect also reading the topic?

Maybe it is a better idea to add the authorization header if the request does come from localhost?

@LuckyTurtleDev commented on GitHub (Feb 22, 2023): If I restrict access to `/sometopic` would not this effect also reading the topic? Maybe it is a better idea to add the authorization header if the request does come from localhost?

BreizhHardware commented

2026-05-07 00:24:28 +02:00

Author

Owner

@LuckyTurtleDev commented on GitHub (Mar 13, 2023):

I have now simple add a autheader at the reverse proxy for local ips. Works without any issue
Caddyfile:

push.example.com {
	respond /robots.txt 200 {
		body "User-agent: *
Disallow: /"
	}

	@local remote_ip private_ranges
	reverse_proxy @local localhost:16480 {
		header_up Authorization "Basic SomeBase64"
	}
	
	reverse_proxy localhost:16480 {
		header_down Referrer-Policy "strict-origin-when-cross-origin"
		header_down Strict-Transport-Security "max-age=15768000"
		header_down X-Frame-Options "sameorigin"
	}
}

@LuckyTurtleDev commented on GitHub (Mar 13, 2023): I have now simple add a autheader at the reverse proxy for local ips. Works without any issue `Caddyfile`: ``` push.example.com { respond /robots.txt 200 { body "User-agent: * Disallow: /" } @local remote_ip private_ranges reverse_proxy @local localhost:16480 { header_up Authorization "Basic SomeBase64" } reverse_proxy localhost:16480 { header_down Referrer-Policy "strict-origin-when-cross-origin" header_down Strict-Transport-Security "max-age=15768000" header_down X-Frame-Options "sameorigin" } }

BreizhHardware commented

2026-05-07 00:24:28 +02:00

Author

Owner

@binwiederhier commented on GitHub (Mar 13, 2023):

Very elegant. Nice.

@binwiederhier commented on GitHub (Mar 13, 2023): Very elegant. Nice.