ntfy: added ntfy service

options/services.nix

@@ -23,6 +23,8 @@ in
     photoprism.enable = mkEnableOption "photoprism";
     navidrome.enable = mkEnableOption "navidrome";
 
+    ntfy-sh.enable = mkEnableOption "ntfy-sh";
+
     telemetry = {
       enable = mkEnableOption "telemetry";
       grafana.enable = mkOption {

profiles/homeserver.nix

@@ -70,6 +70,7 @@
       photoprism.enable = true;
       navidrome.enable = true;
       telemetry.enable = true;
+      ntfy-sh.enable = true;
     };
   };
 }

system/services/caddy.nix

@@ -17,7 +17,7 @@ in
       reverse_proxy 192.168.100.1
     '';
 
-    services.caddy.virtualHosts."tigor.web.id".extraConfig =
+    services.caddy.virtualHosts."hosts.tigor.web.id".extraConfig =
       let
         domains = attrsets.mapAttrsToList (name: _: strings.removePrefix "https://" name) config.services.caddy.virtualHosts;
         sortedDomains = lists.sort (a: b: a < b) domains;

system/services/default.nix

@@ -17,5 +17,6 @@
     ./syncthing.nix
     ./wireguard.nix
     ./photoprism.nix
+    ./ntfy-sh.nix
   ];
 }

system/services/ntfy-sh.nix

@@ -0,0 +1,44 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.profile.services.ntfy-sh;
+  inherit (lib) mkIf;
+  domain = "ntfy.tigor.web.id";
+in
+{
+  config = mkIf cfg.enable {
+    services.caddy.virtualHosts.${domain}.extraConfig = ''
+      reverse_proxy ${config.services.ntfy-sh.settings.listen-http}
+    '';
+    environment.systemPackages = with pkgs; [
+      # Access to `ntfy` cli tool
+      ntfy-sh
+    ];
+
+    services.ntfy-sh = {
+      enable = true;
+      settings =
+        let
+          base-dir = "/var/lib/ntfy-sh";
+        in
+        rec {
+          listen-http = "0.0.0.0:15150";
+          behind-proxy = true;
+          base-url = "https://${domain}";
+
+          # Performance. Cache and Batching.
+          cache-file = "${base-dir}/cache.db";
+          cache-duration = "24h";
+          cache-batch-size = 10;
+          cache-batch-timeout = "1s";
+
+          # Auth
+          auth-file = "${base-dir}/auth.db";
+          auth-default-access = "deny-all";
+
+          # Attachments
+          attachment-cache-dir = "${base-dir}/attachments";
+          attachment-expiry-duration = cache-duration;
+        };
+    };
+  };
+}