# Your own push server for phone notifications (UnifiedPush via ntfy), so nothing goes
# through Google. Add this file to the usual production command, e.g.:
#
#   docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.behind-proxy.yml \
#     -f docker-compose.ntfy.yml --env-file deploy/production.env up -d
#
# Then point a subdomain (NTFY_DOMAIN, e.g. push.example.com) at 127.0.0.1:${NTFY_PORT:-3739} in your
# reverse proxy, with websockets on. ntfy can't live under a path like /push. See docs/PUSH.md.
services:
  ntfy:
    image: binwiederhier/ntfy:v2.30.0
    command: serve
    restart: unless-stopped
    environment:
      NTFY_BASE_URL: https://${NTFY_DOMAIN:?set NTFY_DOMAIN in production.env}
      NTFY_BEHIND_PROXY: 'true'
      # Keep messages for phones that are offline for a while.
      NTFY_CACHE_FILE: /var/cache/ntfy/cache.db
      NTFY_CACHE_DURATION: 24h
      # Private server: nobody can use it for anything except UnifiedPush topics ("up" + a long
      # random name only the phone and our server know).
      NTFY_AUTH_FILE: /var/lib/ntfy/auth.db
      NTFY_AUTH_DEFAULT_ACCESS: deny-all
      NTFY_AUTH_ACCESS: '*:up*:rw'
      NTFY_ENABLE_SIGNUP: 'false'
      NTFY_ENABLE_LOGIN: 'false'
      NTFY_WEB_ROOT: disable
    volumes:
      - ntfy_cache:/var/cache/ntfy
      - ntfy_lib:/var/lib/ntfy
    ports:
      - "${PROXY_BIND:-127.0.0.1}:${NTFY_PORT:-3739}:80"
    healthcheck:
      test: ["CMD-SHELL", "wget -q --tries=1 http://localhost:80/v1/health -O - | grep -q '\"healthy\":true'"]
      interval: 60s
      timeout: 10s
      retries: 3

volumes:
  ntfy_cache:
  ntfy_lib: