ntfy搭建一個私有消息通知服務

# 創建配置目錄
mkdir -p etc
# 創建配置文件
touch server.yml

# 填寫妳自己的域名，末尾不需要
base-url: "https://www.xxx.com"
# 認證數據庫的位置
auth-file: "/var/lib/ntfy/user.db"
# 默認訪問策略，deny-all 代表默認禁止所有未授權用戶
auth-default-access: "deny-all"

version: "2.3"
 
services:
  ntfy:
    image: binwiederhier/ntfy:v2.10.0
    container_name: ntfy
    command:
      - serve
    environment:
      - TZ=Asia/Shanghai    # optional: set desired timezone
    volumes:
      - ./cache:/var/cache/ntfy
      - ./etc:/etc/ntfy
      - ./db:/var/lib/ntfy
    ports:
      - 4080:80
    healthcheck: # optional: remember to adapt the host:port to your environment
        test: ["CMD-SHELL", "wget -q --tries=1 http://localhost:80/v1/health -O - | grep -Eo'\"healthy\"\\s*:\\s*true'|| exit 1"]
        interval: 60s
        timeout: 10s
        retries: 3
        start_period: 40s
    restart: unless-stopped

# 創建一個管理員角色，username 請自行設置
docker exec -it ntfy ntfy user add --role=admin username
# 創建一個普通用戶
docker exec -it ntfy ntfy user add --role=user username
# 修改用戶權限，權限可以是 read-write、read-only、write-only 或 deny
docker exec -it ntfy ntfy access 用户名 主题 权限
# 查看訪問控製列表（ACL）docker exec -it ntfy ntfy access

server {
  listen 80;
  # 改成你自己的域名
  server_name www.xxx.com;
  # 设置 301 重定向到 https
  rewrite ^(.*) https://www.xxx.com$1 redirect;
}
 
server {
  listen 443 ssl http2;
  # 改成你自己的域名
  server_name www.xxx.com;
  # 設置日誌路徑
  access_log /data/logs/www.xxx.com_nginx.log xlog;
 
  # See https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6see https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6
  ssl_session_timeout 1d;
  ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
  ssl_session_tickets off;
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  ssl_prefer_server_ciphers off;
  # 配置證書路徑
  ssl_certificate /xxx/www.xxx.com.crt;
  ssl_certificate_key /xxx/www.xxx.com.key;
 
  location / {
    # 改成你自己的 ntfy 端口
    proxy_pass http://127.0.0.1:4080;
    proxy_http_version 1.1;
 
    proxy_set_header Host $http_host;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
    proxy_connect_timeout 3m;
    proxy_send_timeout 3m;
    proxy_read_timeout 3m;
 
    client_max_body_size 0; # Stream request body to backend
  }
}

curl \
  -u testuser:fakepassword \
  -d "Look ma, with auth" \
  http://localhost/test