orchard

 1# ntfy, the alert path for every site in this repo. status and logging publish
 2# over the bridge with a write-only token, and a phone reads over the tunnel at
 3# ntfy.bythewood.me with a separate read-only account.
 4#
 5# Publishing is fenced to the bridge by Caddy rather than by anything in here,
 6# because ntfy has no way to restrict an account by source address. That is the
 7# fact to remember before trying to solve it again in this file.
 8
 9# 8000 like every other container in this repo. ntfy's own default is :80.
10listen-http: ":8000"
11
12# What a click link in a notification has to resolve to from anywhere.
13base-url: "https://ntfy.bythewood.me"
14
15# So messages survive a restart and a phone that was offline. The default is 12h,
16# and a day covers a weekend away from signal at a handful of alerts a month.
17cache-file: "/var/lib/ntfy/cache.db"
18cache-duration: "24h"
19
20# deny-all means an anonymous request can neither read nor publish, on any topic.
21# Two accounts exist, created by setup-ntfy.sh: isaac reads status and logging,
22# orchard writes them with a token that lives in each site's .env.
23auth-file: "/var/lib/ntfy/user.db"
24auth-default-access: "deny-all"
25
26# Attachments are off (no attachment-cache-dir), so nothing here accepts a file
27# upload.
28
29# No web app. ntfy serves a full single-page client at / by default, and the only
30# clients here are an Android app and two Go programs, neither of which reads any
31# of it.
32web-root: "disable"
33
34# X-Forwarded-For is NOT trusted, even though Caddy sets it, since trusting it
35# would let a publisher spoof its own address. Rate limits count against the peer
36# address instead, the bridge for publishers and Caddy for readers.
37behind-proxy: false
38
39# Machine to machine, and every publish is already recorded by the site that made
40# it.
41log-level: "warn"