move to ntfy-sh

3 files changed, 56 insertions, 126 deletions

diff --git a/adonis/autopush/default.nix b/adonis/autopush/default.nix
deleted file mode 100644
index 292abaf..0000000
--- a/adonis/autopush/default.nix
+++ /dev/null
@@ -1,125 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}: let
-  domain = "push.${config.customOps.domain.fqdn}";
-  port = 8082;
-  redisPort = 6369;
-  endpointPort = 443;
-  autopush = pkgs.autopush-rs;
-in {
-  sops.secrets = {
-    "autopush/autoconnect" = {};
-    "autopush/autoendpoint" = {};
-    "autopush/mollysocket" = {};
-  };
-
-  environment.systemPackages = [autopush];
-  services.redis.servers."autopush" = {
-    enable = true;
-    port = redisPort;
-  };
-  systemd.services = let
-    logLevel = "info";
-    rustLog =
-      "autopush=${logLevel},"
-      + "autopush_common=${logLevel},"
-      + "autoendpoint=${logLevel},"
-      + "autoconnect=${logLevel},"
-      + "slog_mozlog_json=info,warn";
-  in {
-    autopush-autoconnect = {
-      environment = {
-        AUTOCONNECT__DB_DSN = "redis://127.0.0.1:${builtins.toString redisPort}";
-        AUTOCONNECT__ENDPOINT_SCHEME = "https";
-        AUTOCONNECT__ENDPOINT_HOSTNAME = "updates.${domain}";
-        AUTOCONNECT__ENDPOINT_PORT = builtins.toString endpointPort;
-        AUTOCONNECT__ROUTER_HOSTNAME = "127.0.0.1";
-        RUST_LOG = rustLog;
-      };
-      wantedBy = ["multi-user.target"];
-      serviceConfig = {
-        EnvironmentFile = config.sops.secrets."autopush/autoconnect".path;
-        ExecStart = "${autopush}/bin/autoconnect";
-      };
-    };
-    autopush-autoendpoint = {
-      environment = {
-        AUTOEND__DB_DSN = "redis://127.0.0.1:${builtins.toString redisPort}";
-        AUTOEND__HOST = "127.0.0.1";
-        AUTOEND__PORT = builtins.toString port;
-        AUTOEND__ENDPOINT_URL = "https://updates.${domain}";
-        AUTOEND__HUMAN_LOGS = "true";
-        RUST_LOG = rustLog;
-      };
-      wantedBy = ["multi-user.target"];
-      serviceConfig = {
-        EnvironmentFile = config.sops.secrets."autopush/autoendpoint".path;
-        ExecStart = "${autopush}/bin/autoendpoint";
-      };
-    };
-  };
-
-  services.mollysocket = {
-    enable = true;
-    settings = {
-      allowed_endpoints = [
-        "https://${domain}"
-        "https://updates.${domain}"
-      ];
-      webserver = true;
-    };
-    environmentFile = config.sops.secrets."autopush/mollysocket".path;
-  };
-
-  services.nginx.virtualHosts.${domain} = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:8080";
-      extraConfig = ''
-        proxy_http_version		1.1;
-        proxy_set_header			Host			$host;
-        proxy_set_header			Upgrade			$http_upgrade;
-        proxy_set_header			Connection		"upgrade";
-        proxy_set_header			X-Forwarded-For	$proxy_add_x_forwarded_for;
-        proxy_connect_timeout		3m;
-        proxy_send_timeout		3m;
-        proxy_read_timeout		3m;
-        client_max_body_size		0;
-        proxy_buffering			off;
-        proxy_request_buffering	off;
-        proxy_redirect			off;
-      '';
-    };
-  };
-  services.nginx.virtualHosts."updates.${domain}" = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:${builtins.toString port}";
-      extraConfig = ''
-        proxy_http_version		1.1;
-        proxy_set_header		Host		$host;
-        proxy_connect_timeout	3m;
-        proxy_send_timeout		3m;
-        proxy_read_timeout		3m;
-        client_max_body_size	0;
-      '';
-    };
-  };
-  services.nginx.virtualHosts."mollysocket.${domain}" = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:8020";
-      extraConfig = ''
-        proxy_set_header	Host			$host;
-        proxy_set_header	Upgrade			$http_upgrade;
-        proxy_set_header	Connection		"upgrade";
-        proxy_set_header	X-Forwarded-For	$proxy_add_x_forwarded_for;
-      '';
-    };
-  };
-}
diff --git a/adonis/default.nix b/adonis/default.nix
index c97d3ee..74ba9b5 100644
--- a/adonis/default.nix
+++ b/adonis/default.nix
@@ -3,7 +3,7 @@
     ./network.nix
     ./aur
     ./captiveportal
-    ./autopush
+    ./push
     ./tor
   ];
   system.stateVersion = "25.11";
diff --git a/adonis/push/default.nix b/adonis/push/default.nix
new file mode 100644
index 0000000..1dc8f1a
--- /dev/null
+++ b/adonis/push/default.nix
@@ -0,0 +1,55 @@
+{config, ...}: let
+  domain = "push.${config.customOps.domain.fqdn}";
+  ntfyPort = "8080";
+  mollyPort = "8020";
+  nginxConf = ''
+    proxy_set_header Host            $host;
+    proxy_set_header Upgrade         $http_upgrade;
+    proxy_set_header Connection      "upgrade";
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  '';
+in {
+  sops.secrets = {
+    "push/mollysocket" = {};
+  };
+
+  services.ntfy-sh = {
+    enable = true;
+    settings = {
+      listen-http = ":${ntfyPort}";
+      base-url = "https://${domain}";
+      behind-proxy = true;
+      auth-file = "/var/lib/ntfy/auth.db";
+      auth-access = ["*:up*:write-only"];
+    };
+  };
+
+  services.mollysocket = {
+    enable = true;
+    settings = {
+      allowed_endpoints = [
+        "https://${domain}"
+      ];
+      webserver = true;
+    };
+    environmentFile = config.sops.secrets."push/mollysocket".path;
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${ntfyPort}";
+      extraConfig = nginxConf;
+    };
+  };
+
+  services.nginx.virtualHosts."mollysocket.${domain}" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${mollyPort}";
+      extraConfig = nginxConf;
+    };
+  };
+}