Erich Blume 3e604d8fdc Review ntfy: upgrade to v2.17.0 and add reference docs (#201 )

## Summary
- Upgrade ntfy from v2.11.0 to v2.17.0 (6 minor releases, no breaking changes)
- Add reference doc for ntfy service
- Add reference doc for frigate service (ntfy's sole producer via frigate-notify)
- Update reference index and service-versions.yaml tracking

## Notable upstream changes (v2.12.0–v2.17.0)
- **v2.14.0:** Declarative users/ACL config in files
- **v2.15.0:** `require-login` flag for topic-level auth
- **v2.16.0:** Dead man's switch (heartbeat) notifications, notification update/delete
- **v2.17.0:** Priority templating, crash fixes (nil pointer panics)

## Deployment and Testing
- [ ] ArgoCD sync ntfy after merge
- [ ] Verify ntfy pod healthy with new image
- [ ] Send a test notification via `curl -d "test" https://ntfy.ops.eblu.me/test`
- [ ] Verify frigate-notify still delivers alerts to ntfy

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/201

2026-02-17 09:51:40 -08:00

2 KiB

Raw Blame History

title

modified

Ntfy

Self-hosted push notification service. Ntfy receives HTTP POST messages and delivers them to subscribed clients (mobile apps, web UI, CLI).

Quick Reference

Property	Value
URL	https://ntfy.ops.eblu.me
Tailscale URL	https://ntfy.tail8d86e.ts.net
Namespace	`ntfy`
Image	`binwiederhier/ntfy:v2.17.0`
Upstream	https://github.com/binwiederhier/ntfy
Manifests	`argocd/manifests/ntfy/`

Architecture

Ntfy runs as a single pod with no persistent storage — message cache and attachments use an emptyDir volume. This is intentional: ntfy is treated as an ephemeral delivery channel, not a message store. Messages lost on pod restart are acceptable.

The upstream relay (ntfy.sh) is configured so mobile app clients can receive push notifications via Google FCM / Apple APNs without self-hosting those integrations.

Producers

Currently the only producer is frigate-notify, which publishes camera detection alerts (person, vehicle, animal) from frigate via MQTT to ntfy:

Frigate → MQTT (Mosquitto) → frigate-notify → ntfy → mobile clients

The frigate-notify config points to ntfy's cluster-internal address:

http://ntfy.ntfy.svc.cluster.local:80

Other services could publish to ntfy in the future — any HTTP client can POST to a topic.

Configuration

Server config is in a ConfigMap (ntfy-config):

Setting	Value
`base-url`	`https://ntfy.ops.eblu.me`
`upstream-base-url`	`https://ntfy.sh`
`attachment-total-size-limit`	1 GB
`attachment-file-size-limit`	10 MB
`attachment-expiry-duration`	24h

No authentication is configured — access is restricted by Tailscale ACLs (only tailnet clients can reach the service).

routing - How ntfy is exposed via Caddy
observability - Monitoring and alerting infrastructure

2 KiB Raw Blame History