Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
59 lines
2.3 KiB
YAML
59 lines
2.3 KiB
YAML
---
|
|
# Ntfy version to deploy
|
|
ntfy_version: latest
|
|
|
|
# Storage location
|
|
ntfy_data_dir: "{{ podman_projects_dir }}/ntfy/data"
|
|
ntfy_cache_dir: "{{ podman_projects_dir }}/ntfy/cache"
|
|
|
|
# Backup manifest - consumed by roles/backup via inventory `backup_jobs`.
|
|
# The ntfy role owns WHAT gets backed up: it knows its storage layout. The
|
|
# operator owns WHERE (repositories, retention, schedule) in the inventory.
|
|
# - cache.db is the ephemeral message cache: excluded, churns every run for
|
|
# no restore value. attachments/ lives under cache/, hence the narrow glob.
|
|
# - user.db holds users, tokens and ACLs: excluded from the live tree and
|
|
# dumped with sqlite3 .backup instead, because copying a live SQLite file
|
|
# yields a torn snapshot (recent writes sit in the -wal sidecar).
|
|
ntfy_backup_paths:
|
|
- "{{ ntfy_data_dir | dirname }}" # project root: data/, cache/, server.yml, ntfy.yaml
|
|
ntfy_backup_exclude:
|
|
- "{{ ntfy_cache_dir }}/cache.db*"
|
|
- "{{ ntfy_data_dir }}/user.db*"
|
|
ntfy_backup_sqlite:
|
|
- "{{ ntfy_data_dir }}/user.db"
|
|
|
|
# Authentication configuration (REQUIRED - must be set explicitly)
|
|
# Ntfy admin user for managing topics and access control
|
|
ntfy_admin_user: admin
|
|
# ntfy_admin_password: "" # Intentionally undefined - role will fail if not set
|
|
|
|
# Network configuration
|
|
ntfy_port: 8090
|
|
|
|
# Container image
|
|
ntfy_image: binwiederhier/ntfy
|
|
|
|
# Server configuration
|
|
ntfy_base_url: http://localhost:{{ ntfy_port }}
|
|
ntfy_behind_proxy: false
|
|
ntfy_enable_signup: false # Disable public signup for security
|
|
ntfy_enable_login: true # Enable authentication
|
|
ntfy_enable_reservations: true # Only authenticated users can reserve topics
|
|
|
|
# Nginx reverse proxy configuration
|
|
ntfy_nginx_enabled: false
|
|
ntfy_nginx_hostname: ntfy.nas.local
|
|
# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
|
|
# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
|
|
# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
|
|
# DNS record points at the host.
|
|
ntfy_nginx_letsencrypt: false
|
|
ntfy_nginx_ssl_certificate: >-
|
|
{{ ntfy_nginx_letsencrypt | ternary(
|
|
'/etc/letsencrypt/live/' ~ ntfy_nginx_hostname ~ '/fullchain.pem',
|
|
nginx_default_ssl_cert) }}
|
|
ntfy_nginx_ssl_certificate_key: >-
|
|
{{ ntfy_nginx_letsencrypt | ternary(
|
|
'/etc/letsencrypt/live/' ~ ntfy_nginx_hostname ~ '/privkey.pem',
|
|
nginx_default_ssl_key) }}
|