blumeops/docs/how-to/zot/fix-ntfy-nix-version.md

---
title: Fix ntfy Nix Version
modified: 2026-02-20
tags:
  - how-to
  - containers
  - nix
  - zot
---

# Fix ntfy Nix Version

Override the nixpkgs ntfy-sh derivation to build v2.17.0 from the forge mirror, aligning the nix-built container with the Dockerfile version.

## Context

Discovered during [[add-container-version-sync-check]]: the ntfy container has both a Dockerfile and a `default.nix`. The Dockerfile builds v2.17.0 from `forge.ops.eblu.me/mirrors/ntfy.git`, but the nix derivation uses `pkgs.ntfy-sh` from nixpkgs which is pinned at 2.15.0. The version sync check currently excludes ntfy from nix version validation as a workaround.

## What Was Done

Replaced the nixpkgs `pkgs.ntfy-sh` reference in `containers/ntfy/default.nix` with a custom derivation that builds v2.17.0 from the forge mirror using `fetchgit`, `buildNpmPackage` (web UI), and `buildGoModule` (server). Docs are skipped (placeholder for `go:embed`, matching the Dockerfile approach).

The `container-version-check` script was updated to extract versions from local nix files via regex (`version = "X.Y.Z"`) before falling back to the Dagger `nix-version` function for unmodified nixpkgs packages. This avoids the issue where `nix eval nixpkgs#ntfy-sh.version` returns the upstream 2.15.0 instead of our overridden 2.17.0.

## Key Files

| File | Change |
|------|--------|
| `containers/ntfy/default.nix` | Custom derivation building v2.17.0 from forge |
| `mise-tasks/container-version-check` | Regex-based local nix version extraction |

## Verification

- [x] `dagger call build-nix --src=. --container-name=ntfy` produces a working image
- [x] Version extractable from local `default.nix` via regex (2.17.0)
- [x] `mise run container-version-check --all-files` passes with ntfy included

## Related

- [[add-container-version-sync-check]] — Parent: needs ntfy in NIX_PACKAGE_MAP
- [[harden-zot-registry]] — Root goal
Harden zot registry, pt 1 (#231) ## Summary - Enable OIDC + API key authentication on zot with anonymous pull preserved - Enforce tag immutability for version tags - Adopt commit-SHA-based container image tagging Details in the [[harden-zot-registry]] Mikado chain (`mise run docs-mikado harden-zot-registry`). ## Test plan - [ ] Anonymous pull still works - [ ] Unauthenticated push fails (401) - [ ] CI container builds pass with new auth and tagging - [ ] `mise run services-check` passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/231 2026-02-20 22:50:01 -08:00			`---`
			`title: Fix ntfy Nix Version`
			`modified: 2026-02-20`
			`tags:`
			`- how-to`
			`- containers`
			`- nix`
			`- zot`
			`---`

			`# Fix ntfy Nix Version`

			`Override the nixpkgs ntfy-sh derivation to build v2.17.0 from the forge mirror, aligning the nix-built container with the Dockerfile version.`

			`## Context`

Migrate upstream mirrors to mirrors/ Forgejo org (#265) ## Summary - Created `mirrors` Forgejo organization for upstream mirror repos - Transferred 22 mirror repos from `eblume/` to `mirrors/` (mirror sync config preserved) - Deleted unused repos: hajimari, hister - Updated all container build URLs (homepage, navidrome, ntfy Dockerfiles + nix) - Updated documentation references (migrate-forgejo-from-brew, upstream-fork-strategy, fix-ntfy-nix-version) - `dotfiles` intentionally kept under `eblume/` per user request - `devpi` transferred to `mirrors/` Repos remaining under `eblume/`: blumeops, cv, mcquack, dotfiles ## Cleanup TODO - [ ] Delete temp Forgejo API token "claude-migration-temp" (Settings > Applications) ## Test Plan - [x] Verified mirror config (mirror=true, original_url) survived transfer on test repo (tesla_auth) - [x] All pre-commit hooks pass (including container-version-check, docs-check-links) - [ ] Verify a mirror repo sync runs successfully after transfer (check mirrors/authentik or similar) - [ ] Rebuild containers from branch to verify Dockerfile URLs resolve Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/265 2026-02-24 20:43:14 -08:00			Discovered during [[add-container-version-sync-check]]: the ntfy container has both a Dockerfile and a `default.nix`. The Dockerfile builds v2.17.0 from `forge.ops.eblu.me/mirrors/ntfy.git`, but the nix derivation uses `pkgs.ntfy-sh` from nixpkgs which is pinned at 2.15.0. The version sync check currently excludes ntfy from nix version validation as a workaround.
Harden zot registry, pt 1 (#231) ## Summary - Enable OIDC + API key authentication on zot with anonymous pull preserved - Enforce tag immutability for version tags - Adopt commit-SHA-based container image tagging Details in the [[harden-zot-registry]] Mikado chain (`mise run docs-mikado harden-zot-registry`). ## Test plan - [ ] Anonymous pull still works - [ ] Unauthenticated push fails (401) - [ ] CI container builds pass with new auth and tagging - [ ] `mise run services-check` passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/231 2026-02-20 22:50:01 -08:00
			`## What Was Done`

			Replaced the nixpkgs `pkgs.ntfy-sh` reference in `containers/ntfy/default.nix` with a custom derivation that builds v2.17.0 from the forge mirror using `fetchgit`, `buildNpmPackage` (web UI), and `buildGoModule` (server). Docs are skipped (placeholder for `go:embed`, matching the Dockerfile approach).

			The `container-version-check` script was updated to extract versions from local nix files via regex (`version = "X.Y.Z"`) before falling back to the Dagger `nix-version` function for unmodified nixpkgs packages. This avoids the issue where `nix eval nixpkgs#ntfy-sh.version` returns the upstream 2.15.0 instead of our overridden 2.17.0.

			`## Key Files`

			`\| File \| Change \|`
			`\|------\|--------\|`
			\| `containers/ntfy/default.nix` \| Custom derivation building v2.17.0 from forge \|
			\| `mise-tasks/container-version-check` \| Regex-based local nix version extraction \|

			`## Verification`

			- [x] `dagger call build-nix --src=. --container-name=ntfy` produces a working image
			- [x] Version extractable from local `default.nix` via regex (2.17.0)
			- [x] `mise run container-version-check --all-files` passes with ntfy included

			`## Related`

			`- [[add-container-version-sync-check]] — Parent: needs ntfy in NIX_PACKAGE_MAP`
			`- [[harden-zot-registry]] — Root goal`