Refine user header code

.github/dependabot.yml

@@ -1,26 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "npm"
-    directory: "/web"
-    schedule:
-      interval: "weekly"
-    cooldown:
-      default-days: 7
-
-  - package-ecosystem: "gomod"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    cooldown:
-      default-days: 7
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    cooldown:
-      default-days: 7
-    groups:
-      all:
-        patterns:
-          - "*"

.github/workflows/build.yaml

@@ -1,27 +1,30 @@
 name: build
-on:
-  push:
-    branches: [ main ]
-  pull_request:
+on: [push, pull_request]
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      -
+        name: Checkout code
+        uses: actions/checkout@v3
+      -
+        name: Install Go
+        uses: actions/setup-go@v4
         with:
-          go-version-file: '.go-version'
-      - name: Install node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+          go-version: '1.20.x'
+      -
+        name: Install node
+        uses: actions/setup-node@v3
         with:
-          node-version: '24'
+          node-version: '18'
           cache: 'npm'
           cache-dependency-path: './web/package-lock.json'
-      - name: Install dependencies
+      -
+        name: Install dependencies
         run: make build-deps-ubuntu
-      - name: Build all the things
+      -
+        name: Build all the things
         run: make build
-      - name: Print build results and checksums
+      -
+        name: Print build results and checksums
         run: make cli-build-results

.github/workflows/docs.yaml

@@ -9,10 +9,10 @@ jobs:
     steps:
       -
         name: Checkout ntfy code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v3
       -
         name: Checkout docs pages code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v3
         with:
           repository: binwiederhier/ntfy-docs.github.io
           path: build/ntfy-docs.github.io

.github/workflows/release.yaml

@@ -6,46 +6,36 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:17
-        env:
-          POSTGRES_USER: ntfy
-          POSTGRES_PASSWORD: ntfy
-          POSTGRES_DB: ntfy_test
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U ntfy"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-    env:
-      NTFY_TEST_DATABASE_URL: "postgres://ntfy:ntfy@localhost:5432/ntfy_test?sslmode=disable"
-      NTFY_TEST_S3_URL: ${{ secrets.NTFY_TEST_S3_URL }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      -
+        name: Checkout code
+        uses: actions/checkout@v3
+      -
+        name: Install Go
+        uses: actions/setup-go@v4
         with:
-          go-version-file: '.go-version'
-      - name: Install node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+          go-version: '1.20.x'
+      -
+        name: Install node
+        uses: actions/setup-node@v3
         with:
-          node-version: '24'
+          node-version: '18'
           cache: 'npm'
           cache-dependency-path: './web/package-lock.json'
-      - name: Docker login
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+      -
+        name: Docker login
+        uses: docker/login-action@v2
         with:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
-      - name: Install dependencies
+      -
+        name: Install dependencies
         run: make build-deps-ubuntu
-      - name: Build and publish
+      -
+        name: Build and publish
         run: make release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Print build results and checksums
+      -
+        name: Print build results and checksums
         run: make cli-build-results

.github/workflows/test.yaml

@@ -1,48 +1,39 @@
 name: test
-on:
-  push:
-    branches: [ main ]
-  pull_request:
+on: [push, pull_request]
 jobs:
   test:
     runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:17
-        env:
-          POSTGRES_USER: ntfy
-          POSTGRES_PASSWORD: ntfy
-          POSTGRES_DB: ntfy_test
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U ntfy"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-    env:
-      NTFY_TEST_DATABASE_URL: "postgres://ntfy:ntfy@localhost:5432/ntfy_test?sslmode=disable"
-      NTFY_TEST_S3_URL: ${{ secrets.NTFY_TEST_S3_URL }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      -
+        name: Checkout code
+        uses: actions/checkout@v3
+      -
+        name: Install Go
+        uses: actions/setup-go@v4
         with:
-          go-version-file: '.go-version'
-      - name: Install node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+          go-version: '1.20.x'
+      -
+        name: Install node
+        uses: actions/setup-node@v3
         with:
-          node-version: '24'
+          node-version: '18'
           cache: 'npm'
           cache-dependency-path: './web/package-lock.json'
-      - name: Install dependencies
+      -
+        name: Install dependencies
         run: make build-deps-ubuntu
-      - name: Build docs (required for tests)
+      -
+        name: Build docs (required for tests)
         run: make docs
-      - name: Build web app (required for tests)
+      -
+        name: Build web app (required for tests)
         run: make web
-      - name: Run tests, formatting, vetting and linting
-        run: make checkv
-      - name: Run coverage
+      -
+        name: Run tests, formatting, vetting and linting
+        run: make check
+      -
+        name: Run coverage
         run: make coverage
+      -
+        name: Upload coverage to codecov.io
+        run: make coverage-upload

.gitignore

@@ -7,15 +7,10 @@ build/
 server/docs/
 server/site/
 tools/fbsend/fbsend
-tools/pgimport/pgimport
-tools/loadtest/loadtest
-tools/s3cli/s3cli
 playground/
 secrets/
 *.iml
 node_modules/
 .DS_Store
 __pycache__
-web/dev-dist/
-venv/
-cmd/key-file.yaml
+web/dev-dist/

.go-version

@@ -1 +0,0 @@
-1.26.5

.goreleaser.yml

@@ -1,72 +1,76 @@
-version: 2
 before:
   hooks:
     - go mod download
     - go mod tidy
 builds:
-  - id: ntfy_linux_amd64
+  -
+    id: ntfy_linux_amd64
     binary: ntfy
     env:
       - CGO_ENABLED=1 # required for go-sqlite3
-    tags: [ sqlite_omit_load_extension,osusergo,netgo ]
+    tags: [sqlite_omit_load_extension,osusergo,netgo]
     ldflags:
       - "-linkmode=external -extldflags=-static -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
-    goos: [ linux ]
-    goarch: [ amd64 ]
-  - id: ntfy_linux_armv6
+    goos: [linux]
+    goarch: [amd64]
+  -
+    id: ntfy_linux_armv6
     binary: ntfy
     env:
       - CGO_ENABLED=1 # required for go-sqlite3
       - CC=arm-linux-gnueabi-gcc # apt install gcc-arm-linux-gnueabi
-    tags: [ sqlite_omit_load_extension,osusergo,netgo ]
+    tags: [sqlite_omit_load_extension,osusergo,netgo]
     ldflags:
       - "-linkmode=external -extldflags=-static -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
-    goos: [ linux ]
-    goarch: [ arm ]
-    goarm: [ 6 ]
-  - id: ntfy_linux_armv7
+    goos: [linux]
+    goarch: [arm]
+    goarm: [6]
+  -
+    id: ntfy_linux_armv7
     binary: ntfy
     env:
       - CGO_ENABLED=1 # required for go-sqlite3
       - CC=arm-linux-gnueabi-gcc # apt install gcc-arm-linux-gnueabi
-    tags: [ sqlite_omit_load_extension,osusergo,netgo ]
+    tags: [sqlite_omit_load_extension,osusergo,netgo]
     ldflags:
       - "-linkmode=external -extldflags=-static -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
-    goos: [ linux ]
-    goarch: [ arm ]
-    goarm: [ 7 ]
-  - id: ntfy_linux_arm64
+    goos: [linux]
+    goarch: [arm]
+    goarm: [7]
+  -
+    id: ntfy_linux_arm64
     binary: ntfy
     env:
       - CGO_ENABLED=1 # required for go-sqlite3
       - CC=aarch64-linux-gnu-gcc # apt install gcc-aarch64-linux-gnu
-    tags: [ sqlite_omit_load_extension,osusergo,netgo ]
+    tags: [sqlite_omit_load_extension,osusergo,netgo]
     ldflags:
       - "-linkmode=external -extldflags=-static -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
-    goos: [ linux ]
-    goarch: [ arm64 ]
-  - id: ntfy_windows_amd64
+    goos: [linux]
+    goarch: [arm64]
+  -
+    id: ntfy_windows_amd64
     binary: ntfy
     env:
-      - CGO_ENABLED=1 # required for go-sqlite3
-      - CC=x86_64-w64-mingw32-gcc # apt install gcc-mingw-w64-x86-64
-    tags: [ sqlite_omit_load_extension,osusergo,netgo ]
+      - CGO_ENABLED=0 # explicitly disable, since we don't need go-sqlite3
+    tags: [noserver] # don't include server files
     ldflags:
-      - "-s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
-    goos: [ windows ]
-    goarch: [amd64 ]
+      - "-X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
+    goos: [windows]
+    goarch: [amd64]
   -
     id: ntfy_darwin_all
     binary: ntfy
     env:
       - CGO_ENABLED=0 # explicitly disable, since we don't need go-sqlite3
-    tags: [ noserver ] # don't include server files
+    tags: [noserver] # don't include server files
     ldflags:
       - "-X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
-    goos: [ darwin ]
-    goarch: [ amd64, arm64 ] # will be combined to "universal binary" (see below)
+    goos: [darwin]
+    goarch: [amd64, arm64] # will be combined to "universal binary" (see below)
 nfpms:
-  - package_name: ntfy
+  -
+    package_name: ntfy
     homepage: https://heckel.io/ntfy
     maintainer: Philipp C. Heckel <philipp.heckel@gmail.com>
     description: Simple pub-sub notification service
@@ -86,8 +90,6 @@ nfpms:
         type: "config|noreplace"
       - src: client/ntfy-client.service
         dst: /lib/systemd/system/ntfy-client.service
-      - src: client/user/ntfy-client.service
-        dst: /lib/systemd/user/ntfy-client.service
       - dst: /var/cache/ntfy
         type: dir
       - dst: /var/cache/ntfy/attachments
@@ -102,8 +104,9 @@ nfpms:
       preremove: "scripts/prerm.sh"
       postremove: "scripts/postrm.sh"
 archives:
-  - id: ntfy_linux
-    ids:
+  -
+    id: ntfy_linux
+    builds:
       - ntfy_linux_amd64
       - ntfy_linux_armv6
       - ntfy_linux_armv7
@@ -116,18 +119,19 @@ archives:
       - server/ntfy.service
       - client/client.yml
       - client/ntfy-client.service
-      - client/user/ntfy-client.service
-  - id: ntfy_windows
-    ids:
+  -
+    id: ntfy_windows
+    builds:
       - ntfy_windows_amd64
-    formats: [ zip ]
+    format: zip
     wrap_in_directory: true
     files:
       - LICENSE
       - README.md
       - client/client.yml
-  - id: ntfy_darwin
-    ids:
+  -
+    id: ntfy_darwin
+    builds:
       - ntfy_darwin_all
     wrap_in_directory: true
     files:
@@ -135,13 +139,14 @@ archives:
       - README.md
       - client/client.yml
 universal_binaries:
-  - id: ntfy_darwin_all
+  -
+    id: ntfy_darwin_all
     replace: true
     name_template: ntfy
 checksum:
   name_template: 'checksums.txt'
 snapshot:
-  version_template: "{{ .Tag }}-next"
+  name_template: "{{ .Tag }}-next"
 changelog:
   sort: asc
   filters:
@@ -159,14 +164,14 @@ dockers:
   - image_templates:
       - &arm64v8_image "binwiederhier/ntfy:{{ .Tag }}-arm64v8"
     use: buildx
-    dockerfile: Dockerfile-arm
+    dockerfile: Dockerfile
     goarch: arm64
     build_flag_templates:
       - "--platform=linux/arm64/v8"
   - image_templates:
       - &armv7_image "binwiederhier/ntfy:{{ .Tag }}-armv7"
     use: buildx
-    dockerfile: Dockerfile-arm
+    dockerfile: Dockerfile
     goarch: arm
     goarm: 7
     build_flag_templates:
@@ -174,7 +179,7 @@ dockers:
   - image_templates:
       - &armv6_image "binwiederhier/ntfy:{{ .Tag }}-armv6"
     use: buildx
-    dockerfile: Dockerfile-arm
+    dockerfile: Dockerfile
     goarch: arm
     goarm: 6
     build_flag_templates:
@@ -192,15 +197,3 @@ docker_manifests:
       - *arm64v8_image
       - *armv7_image
       - *armv6_image
-  - name_template: "binwiederhier/ntfy:v{{ .Major }}"
-    image_templates:
-      - *amd64_image
-      - *arm64v8_image
-      - *armv7_image
-      - *armv6_image
-  - name_template: "binwiederhier/ntfy:v{{ .Major }}.{{ .Minor }}"
-    image_templates:
-      - *amd64_image
-      - *arm64v8_image
-      - *armv7_image
-      - *armv6_image

CODE_OF_CONDUCT.md

@@ -60,7 +60,7 @@ representative at an online or offline event.
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported to the community leaders responsible for enforcement via Discord/Matrix (binwiederhier),
-or email (contact@mail.ntfy.sh). All complaints will be reviewed and investigated promptly 
+or email (ntfy@heckel.io). All complaints will be reviewed and investigated promptly 
 and fairly.
 
 All community leaders are obligated to respect the privacy and security of the

Dockerfile

@@ -9,7 +9,6 @@ LABEL org.opencontainers.image.licenses="Apache-2.0, GPL-2.0"
 LABEL org.opencontainers.image.title="ntfy"
 LABEL org.opencontainers.image.description="Send push notifications to your phone or desktop using PUT/POST"
 
-RUN apk add --no-cache tzdata
 COPY ntfy /usr/bin
 
 EXPOSE 80/tcp

Dockerfile-arm

@@ -1,18 +0,0 @@
-FROM alpine
-
-LABEL org.opencontainers.image.authors="philipp.heckel@gmail.com"
-LABEL org.opencontainers.image.url="https://ntfy.sh/"
-LABEL org.opencontainers.image.documentation="https://docs.ntfy.sh/"
-LABEL org.opencontainers.image.source="https://github.com/binwiederhier/ntfy"
-LABEL org.opencontainers.image.vendor="Philipp C. Heckel"
-LABEL org.opencontainers.image.licenses="Apache-2.0, GPL-2.0"
-LABEL org.opencontainers.image.title="ntfy"
-LABEL org.opencontainers.image.description="Send push notifications to your phone or desktop using PUT/POST"
-
-# Alpine does not support adding "tzdata" on ARM anymore, see
-# https://github.com/binwiederhier/ntfy/issues/894
-
-COPY ntfy /usr/bin
-
-EXPOSE 80/tcp
-ENTRYPOINT ["ntfy"]

Dockerfile-build

@@ -1,34 +1,28 @@
-FROM golang:1.25-bookworm AS builder
+FROM golang:1.19-bullseye as builder
 
 ARG VERSION=dev
 ARG COMMIT=unknown
-ARG NODE_MAJOR=24
 
-RUN apt-get update && apt-get install -y \
-       build-essential ca-certificates curl gnupg \
-    && mkdir -p /etc/apt/keyrings \
-    && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
-    && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" >> /etc/apt/sources.list.d/nodesource.list \
-    && apt-get update \
-    && apt-get install -y \
-      python3-pip \
-      python3-venv \
-      nodejs \
-    && rm -rf /var/lib/apt/lists/*
+RUN apt-get update
+RUN curl -fsSL https://deb.nodesource.com/setup_18.x | bash
+RUN apt-get install -y \
+    build-essential \
+    nodejs \
+    python3-pip
 
 WORKDIR /app
 ADD Makefile .
 
 # docs
 ADD ./requirements.txt .
-RUN --mount=type=cache,target=/root/.cache/pip make docs-deps
+RUN make docs-deps
 ADD ./mkdocs.yml .
 ADD ./docs ./docs
 RUN make docs-build
-
+ 
 # web
 ADD ./web/package.json ./web/package-lock.json ./web/
-RUN --mount=type=cache,target=/root/.npm make web-deps
+RUN make web-deps
 ADD ./web ./web
 RUN make web-build
 
@@ -40,23 +34,10 @@ ADD ./log ./log
 ADD ./server ./server
 ADD ./user ./user
 ADD ./util ./util
-ADD ./payments ./payments
-ADD ./db ./db
-ADD ./message ./message
-ADD ./model ./model
-ADD ./webpush ./webpush
-ADD ./attachment ./attachment
-ADD ./mail ./mail
-ADD ./s3 ./s3
-ADD ./action ./action
-ADD ./template/gotext ./template/gotext
-
-RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build make VERSION=$VERSION COMMIT=$COMMIT cli-linux-server
+RUN make VERSION=$VERSION COMMIT=$COMMIT cli-linux-server
 
 FROM alpine
 
-ARG VERSION=dev
-
 LABEL org.opencontainers.image.authors="philipp.heckel@gmail.com"
 LABEL org.opencontainers.image.url="https://ntfy.sh/"
 LABEL org.opencontainers.image.documentation="https://docs.ntfy.sh/"
@@ -65,7 +46,6 @@ LABEL org.opencontainers.image.vendor="Philipp C. Heckel"
 LABEL org.opencontainers.image.licenses="Apache-2.0, GPL-2.0"
 LABEL org.opencontainers.image.title="ntfy"
 LABEL org.opencontainers.image.description="Send push notifications to your phone or desktop using PUT/POST"
-LABEL org.opencontainers.image.version="$VERSION"
 
 COPY --from=builder /app/dist/ntfy_linux_server/ntfy /usr/bin/ntfy
 

Makefile

@@ -1,13 +1,8 @@
 MAKEFLAGS := --jobs=1
-NPM := npm
-PYTHON := python3
-PIP := pip3
 VERSION := $(shell git describe --tag)
 COMMIT := $(shell git rev-parse --short HEAD)
 
-# FORCE is an always-out-of-date target with no recipe; listing it as a prerequisite
-# forces that target's recipe to run every time (the classic "FORCE target" idiom).
-FORCE:
+.PHONY:
 
 help:
 	@echo "Typical commands (more see below):"
@@ -34,7 +29,6 @@ help:
 	@echo "Build server & client (without GoReleaser):"
 	@echo "  make cli-linux-server           - Build client & server (no GoReleaser, current arch, Linux)"
 	@echo "  make cli-darwin-server          - Build client & server (no GoReleaser, current arch, macOS)"
-	@echo "  make cli-windows-server         - Build client & server (no GoReleaser, amd64 only, Windows)"
 	@echo "  make cli-client                 - Build client only (no GoReleaser, current arch, Linux/macOS/Windows)"
 	@echo
 	@echo "Build dev Docker:"
@@ -45,9 +39,8 @@ help:
 	@echo "  make web-deps                   - Install web app dependencies (npm install the universe)"
 	@echo "  make web-build                  - Actually build the web app"
 	@echo "  make web-lint                   - Run eslint on the web app"
-	@echo "  make web-test                   - Run vitest unit tests for the web app"
-	@echo "  make web-fmt                    - Run prettier on the web app"
-	@echo "  make web-fmt-check              - Run prettier on the web app, but don't change anything"
+	@echo "  make web-format                 - Run prettier on the web app"
+	@echo "  make web-format-check           - Run prettier on the web app, but don't change anything"
 	@echo
 	@echo "Build documentation:"
 	@echo "  make docs                       - Build the documentation"
@@ -55,9 +48,7 @@ help:
 	@echo "  make docs-build                 - Actually build the documentation"
 	@echo
 	@echo "Test/check:"
-	@echo "  make test                       - Run all tests (Go + web)"
-	@echo "  make cli-test                   - Run Go tests only"
-	@echo "  make web-test                   - Run web app tests only"
+	@echo "  make test                       - Run tests"
 	@echo "  make race                       - Run tests with -race flag"
 	@echo "  make coverage                   - Run tests and show coverage"
 	@echo "  make coverage-html              - Run tests and show coverage (as HTML)"
@@ -87,12 +78,12 @@ help:
 
 # Building everything
 
-clean: FORCE
+clean: .PHONY
 	rm -rf dist build server/docs server/site
 
 build: web docs cli
 
-update: web-deps-update cli-deps-update docs-deps-update go-check
+update: web-deps-update cli-deps-update docs-deps-update
 	docker pull alpine
 
 docker-dev:
@@ -104,7 +95,6 @@ docker-dev:
 		--build-arg COMMIT=$(COMMIT) \
 		./
 
-
 # Ubuntu-specific
 
 build-deps-ubuntu:
@@ -113,28 +103,32 @@ build-deps-ubuntu:
 		curl \
 		gcc-aarch64-linux-gnu \
 		gcc-arm-linux-gnueabi \
-		gcc-mingw-w64-x86-64 \
-		python3 \
-		python3-venv \
 		jq
 	which pip3 || sudo apt-get install -y python3-pip
 
-
 # Documentation
 
 docs: docs-deps docs-build
 
-docs-venv: FORCE
-	$(PYTHON) -m venv ./venv
+docs-build: .PHONY
+	@if ! /bin/echo -e "import sys\nif sys.version_info < (3,8):\n exit(1)" | python3; then \
+	  if which python3.8; then \
+	  	echo "python3.8 $(shell which mkdocs) build"; \
+	    python3.8 $(shell which mkdocs) build; \
+	  else \
+	    echo "ERROR: Python version too low. mkdocs-material needs >= 3.8"; \
+	    exit 1; \
+	  fi; \
+	else \
+	  echo "mkdocs build"; \
+	  mkdocs build; \
+	fi
 
-docs-build: docs-venv
-	(. venv/bin/activate && $(PYTHON) -m mkdocs build)
+docs-deps: .PHONY
+	pip3 install -r requirements.txt
 
-docs-deps: docs-venv
-	(. venv/bin/activate && $(PIP) install -r requirements.txt)
-
-docs-deps-update: FORCE
-	(. venv/bin/activate && $(PIP) install -r requirements.txt --upgrade)
+docs-deps-update: .PHONY
+	pip3 install -r requirements.txt --upgrade
 
 
 # Web app
@@ -143,7 +137,7 @@ web: web-deps web-build
 
 web-build:
 	cd web \
-		&& $(NPM) run build \
+		&& npm run build \
 		&& mv build/index.html build/app.html \
 		&& rm -rf ../server/site \
 		&& mv build ../server/site \
@@ -151,25 +145,20 @@ web-build:
 			../server/site/config.js
 
 web-deps:
-	cd web && $(NPM) ci
-	# Use "npm ci" so that we don't change the package lock file
+	cd web && npm install
 	# If this fails for .svg files, optimize them with svgo
 
 web-deps-update:
-	cd web && $(NPM) update --before="$(shell date -d '7 days ago' +%Y-%m-%d)"
-	cd web && $(NPM) install
+	cd web && npm update
 
-web-fmt:
-	cd web && $(NPM) run format
+web-format:
+	cd web && npm run format
 
-web-fmt-check:
-	cd web && $(NPM) run format:check
+web-format-check:
+	cd web && npm run format:check
 
 web-lint:
-	cd web && $(NPM) run lint
-
-web-test:
-	cd web && $(NPM) run test
+	cd web && npm run lint
 
 # Main server/client build
 
@@ -214,16 +203,6 @@ cli-darwin-server: cli-deps-static-sites
 		-ldflags \
 		"-linkmode=external -s -w -X main.version=$(VERSION) -X main.commit=$(COMMIT) -X main.date=$(shell date +%s)"
 
-cli-windows-server: cli-deps-static-sites
-	# This is a target to build the CLI (including the server) for Windows.
-	# Use this for Windows development, if you really don't want to install GoReleaser ...
-	mkdir -p dist/ntfy_windows_server server/docs
-	CC=x86_64-w64-mingw32-gcc GOOS=windows GOARCH=amd64 CGO_ENABLED=1 go build \
-		-o dist/ntfy_windows_server/ntfy.exe \
-		-tags sqlite_omit_load_extension,osusergo,netgo \
-		-ldflags \
-		"-s -w -X main.version=$(VERSION) -X main.commit=$(COMMIT) -X main.date=$(shell date +%s)"
-
 cli-client: cli-deps-static-sites
 	# This is a target to build the CLI (excluding the server) manually. This should work on Linux/macOS/Windows.
 	# Use this for development, if you really don't want to install GoReleaser ...
@@ -236,14 +215,14 @@ cli-client: cli-deps-static-sites
 
 cli-deps: cli-deps-static-sites cli-deps-all cli-deps-gcc
 
-cli-deps-gcc: cli-deps-gcc-armv6-armv7 cli-deps-gcc-arm64 cli-deps-gcc-windows
+cli-deps-gcc: cli-deps-gcc-armv6-armv7 cli-deps-gcc-arm64
 
 cli-deps-static-sites:
 	mkdir -p server/docs server/site
 	touch server/docs/index.html server/site/app.html
 
 cli-deps-all:
-	go install github.com/goreleaser/goreleaser/v2@latest
+	go install github.com/goreleaser/goreleaser@latest
 
 cli-deps-gcc-armv6-armv7:
 	which arm-linux-gnueabi-gcc || { echo "ERROR: ARMv6/ARMv7 cross compiler not installed. On Ubuntu, run: apt install gcc-arm-linux-gnueabi"; exit 1; }
@@ -251,15 +230,11 @@ cli-deps-gcc-armv6-armv7:
 cli-deps-gcc-arm64:
 	which aarch64-linux-gnu-gcc || { echo "ERROR: ARM64 cross compiler not installed. On Ubuntu, run: apt install gcc-aarch64-linux-gnu"; exit 1; }
 
-cli-deps-gcc-windows:
-	which x86_64-w64-mingw32-gcc || { echo "ERROR: Windows cross compiler not installed. On Ubuntu, run: apt install gcc-mingw-w64-x86-64"; exit 1; }
-
 cli-deps-update:
 	go get -u
-	go mod tidy
 	go install honnef.co/go/tools/cmd/staticcheck@latest
 	go install golang.org/x/lint/golint@latest
-	go install github.com/goreleaser/goreleaser/v2@latest
+	go install github.com/goreleaser/goreleaser@latest
 
 cli-build-results:
 	cat dist/config.yaml
@@ -273,31 +248,25 @@ cli-build-results:
 
 # Test/check targets
 
-check: test web-fmt-check fmt-check vet web-lint lint staticcheck template-check go-check
+check: test web-format-check fmt-check vet web-lint lint staticcheck
 
-checkv: testv web-fmt-check fmt-check vet web-lint lint staticcheck template-check go-check
+test: .PHONY
+	go test $(shell go list ./... | grep -vE 'ntfy/(test|examples|tools)')
 
-test: cli-test web-test
+testv: .PHONY
+	go test -v $(shell go list ./... | grep -vE 'ntfy/(test|examples|tools)')
 
-testv: cli-testv web-test
-
-cli-test: FORCE
-	go test $(shell go list -f '{{if .TestGoFiles}}{{.ImportPath}}{{end}}' ./... | grep -vE 'ntfy/v2/(test|examples|tools)')
-
-cli-testv: FORCE
-	go test -v $(shell go list -f '{{if .TestGoFiles}}{{.ImportPath}}{{end}}' ./... | grep -vE 'ntfy/v2/(test|examples|tools)')
-
-race: FORCE
-	go test -v -race $(shell go list -f '{{if .TestGoFiles}}{{.ImportPath}}{{end}}' ./... | grep -vE 'ntfy/v2/(test|examples|tools)')
+race: .PHONY
+	go test -v -race $(shell go list ./... | grep -vE 'ntfy/(test|examples|tools)')
 
 coverage:
 	mkdir -p build/coverage
-	go test -v -race -coverprofile=build/coverage/coverage.txt -covermode=atomic $(shell go list -f '{{if .TestGoFiles}}{{.ImportPath}}{{end}}' ./... | grep -vE 'ntfy/v2/(test|examples|tools|web)')
+	go test -v -race -coverprofile=build/coverage/coverage.txt -covermode=atomic $(shell go list ./... | grep -vE 'ntfy/(test|examples|tools)')
 	go tool cover -func build/coverage/coverage.txt
 
 coverage-html:
 	mkdir -p build/coverage
-	go test -race -coverprofile=build/coverage/coverage.txt -covermode=atomic $(shell go list -f '{{if .TestGoFiles}}{{.ImportPath}}{{end}}' ./... | grep -vE 'ntfy/v2/(test|examples|tools)')
+	go test -race -coverprofile=build/coverage/coverage.txt -covermode=atomic $(shell go list ./... | grep -vE 'ntfy/(test|examples|tools)')
 	go tool cover -html build/coverage/coverage.txt
 
 coverage-upload:
@@ -306,7 +275,7 @@ coverage-upload:
 
 # Lint/formatting targets
 
-fmt: web-fmt
+fmt:
 	gofmt -s -w .
 
 fmt-check:
@@ -317,87 +286,27 @@ vet:
 
 lint:
 	which golint || go install golang.org/x/lint/golint@latest
-	go list ./... | grep -v /vendor/ | grep -vE 'ntfy/v2/template/gotext' | xargs -L1 golint -set_exit_status
+	go list ./... | grep -v /vendor/ | xargs -L1 golint -set_exit_status
 
-staticcheck: FORCE
+staticcheck: .PHONY
 	rm -rf build/staticcheck
 	which staticcheck || go install honnef.co/go/tools/cmd/staticcheck@latest
 	mkdir -p build/staticcheck
 	ln -s "go" build/staticcheck/go
-	PATH="$(PWD)/build/staticcheck:$(PATH)" staticcheck $$(go list ./... | grep -vE 'ntfy/v2/template/gotext')
+	PATH="$(PWD)/build/staticcheck:$(PATH)" staticcheck ./...
 	rm -rf build/staticcheck
 
 
-# Vendored template targets (see template/README.md)
-
-TEMPLATE_GO_VERSION := go$(shell cat .go-version 2>/dev/null)
-
-update-template:
-	@if [ "$$(go env GOVERSION)" != "$(TEMPLATE_GO_VERSION)" ]; then \
-		echo "ERROR: local Go $$(go env GOVERSION) != $(TEMPLATE_GO_VERSION) pinned in .go-version."; \
-		echo "Bump .go-version and install that toolchain first: go install golang.org/dl/$(TEMPLATE_GO_VERSION)@latest && $(TEMPLATE_GO_VERSION) download"; \
-		exit 1; \
-	fi
-	src="$$(go env GOROOT)/src"; \
-	rm -f template/gotext/*.go template/gotext/fmtsort/*.go; \
-	for f in $$(go list -f '{{range .GoFiles}}{{.}} {{end}}' text/template); do cp "$$src/text/template/$$f" template/gotext/; done; \
-	for f in $$(go list -f '{{range .GoFiles}}{{.}} {{end}}' internal/fmtsort); do cp "$$src/internal/fmtsort/$$f" template/gotext/fmtsort/; done; \
-	sed -i 's/^package template$$/package gotext/' template/gotext/*.go; \
-	sed -i 's#"internal/fmtsort"#"heckel.io/ntfy/v2/template/gotext/fmtsort"#' template/gotext/*.go; \
-	( cd template/gotext && for p in patches/*.patch; do echo "Applying $$p"; git apply "$$p" || exit 1; done )
-	go env GOVERSION > template/gotext/GENERATED_FROM
-	@echo "Regenerated template/gotext/ from $(TEMPLATE_GO_VERSION) (files enumerated via 'go list'); review with 'git diff'."
-
-template-check: FORCE
-	@if [ "$$(cat template/gotext/GENERATED_FROM)" != "$(TEMPLATE_GO_VERSION)" ]; then \
-		echo "ERROR: template/gotext was generated from $$(cat template/gotext/GENERATED_FROM), but .go-version pins $(TEMPLATE_GO_VERSION). Run 'make update-template' on the pinned Go."; \
-		exit 1; \
-	fi
-	@if [ "$$(go env GOVERSION)" != "$(TEMPLATE_GO_VERSION)" ]; then \
-		echo "SKIP: local Go $$(go env GOVERSION) != pinned $(TEMPLATE_GO_VERSION); skipping vendored template content check (version marker already verified)."; \
-		exit 0; \
-	fi
-	@tmp=$$(mktemp -d); src="$$(go env GOROOT)/src"; \
-	mkdir -p "$$tmp/gotext/fmtsort"; \
-	for f in $$(go list -f '{{range .GoFiles}}{{.}} {{end}}' text/template); do cp "$$src/text/template/$$f" "$$tmp/gotext/"; done; \
-	for f in $$(go list -f '{{range .GoFiles}}{{.}} {{end}}' internal/fmtsort); do cp "$$src/internal/fmtsort/$$f" "$$tmp/gotext/fmtsort/"; done; \
-	sed -i 's/^package template$$/package gotext/' "$$tmp/gotext/"*.go; \
-	sed -i 's#"internal/fmtsort"#"heckel.io/ntfy/v2/template/gotext/fmtsort"#' "$$tmp/gotext/"*.go; \
-	cp template/gotext/patches/*.patch "$$tmp/"; \
-	( cd "$$tmp/gotext" && for p in "$$tmp"/*.patch; do git apply "$$p" || exit 1; done ); \
-	if diff -rq -x 'README.md' -x 'GENERATED_FROM' -x 'patches' "$$tmp/gotext" template/gotext >/dev/null 2>&1; then \
-		rm -rf "$$tmp"; \
-	else \
-		echo "ERROR: template/gotext/ drifted from GOROOT+patches (or its file set changed). Run 'make update-template' on Go $(TEMPLATE_GO_VERSION):"; \
-		diff -rq -x 'README.md' -x 'GENERATED_FROM' -x 'patches' "$$tmp/gotext" template/gotext; \
-		rm -rf "$$tmp"; exit 1; \
-	fi
-
-# go-check is advisory only (never fails): it warns when the pinned Go (.go-version) is behind the
-# latest upstream release, so template/gotext doesn't silently fall behind on text/template fixes.
-go-check: FORCE
-	@latest=$$(curl -s --max-time 10 'https://go.dev/VERSION?m=text' 2>/dev/null | head -1); \
-	if [ -n "$$latest" ] && [ "$$latest" != "$(TEMPLATE_GO_VERSION)" ]; then \
-		echo ""; \
-		echo "note: latest Go is $$latest, but template/gotext is pinned to $(TEMPLATE_GO_VERSION) (.go-version)."; \
-		echo "      to bump: install $$latest, set .go-version to $${latest#go}, then run 'make update-template'."; \
-	fi
-
-
 # Releasing targets
 
 release: clean cli-deps release-checks docs web check
 	goreleaser release --clean
 
 release-snapshot: clean cli-deps docs web check
-	goreleaser release --snapshot --clean
+	goreleaser release --snapshot --skip-publish --clean
 
 release-checks:
 	$(eval LATEST_TAG := $(shell git describe --abbrev=0 --tags | cut -c2-))
-	if [ "$$(go env GOVERSION)" != "go$$(cat .go-version)" ]; then\
-		echo "ERROR: releases must use the pinned Go toolchain (go$$(cat .go-version) from .go-version), but this is $$(go env GOVERSION). This also ensures 'make check' enforces (not skips) the template/gotext drift check.";\
-		exit 1;\
-	fi
 	if ! grep -q $(LATEST_TAG) docs/install.md; then\
 	 	echo "ERROR: Must update docs/install.md with latest tag first.";\
 	 	exit 1;\

README.md

@@ -1,27 +1,15 @@
-<div align="center" markdown="1">
-<sup>Special thanks to:</sup>
-<br>
-<br>
-<a href="https://go.warp.dev/ntfy">
-  <img alt="Warp sponsorship" width="400" src="https://raw.githubusercontent.com/warpdotdev/brand-assets/refs/heads/main/Github/Sponsor/Warp-Github-LG-02.png">
-</a>
-
-### [Warp, built for coding with multiple AI agents.](https://go.warp.dev/ntfy)
-[Available for MacOS, Linux, & Windows](https://go.warp.dev/ntfy)<br>
-</div>
-<hr>
-
 ![ntfy](web/public/static/images/ntfy.png)
 
 # ntfy.sh | Send push notifications to your phone or desktop via PUT/POST
 [![Release](https://img.shields.io/github/release/binwiederhier/ntfy.svg?color=success&style=flat-square)](https://github.com/binwiederhier/ntfy/releases/latest)
-[![Go Reference](https://pkg.go.dev/badge/heckel.io/ntfy.svg)](https://pkg.go.dev/heckel.io/ntfy/v2)
+[![Go Reference](https://pkg.go.dev/badge/heckel.io/ntfy.svg)](https://pkg.go.dev/heckel.io/ntfy)
 [![Tests](https://github.com/binwiederhier/ntfy/workflows/test/badge.svg)](https://github.com/binwiederhier/ntfy/actions)
 [![Go Report Card](https://goreportcard.com/badge/github.com/binwiederhier/ntfy)](https://goreportcard.com/report/github.com/binwiederhier/ntfy)
 [![codecov](https://codecov.io/gh/binwiederhier/ntfy/branch/main/graph/badge.svg?token=A597KQ463G)](https://codecov.io/gh/binwiederhier/ntfy)
 [![Discord](https://img.shields.io/discord/874398661709295626?label=Discord)](https://discord.gg/cT7ECsZj9w)
 [![Matrix](https://img.shields.io/matrix/ntfy:matrix.org?label=Matrix)](https://matrix.to/#/#ntfy:matrix.org)
 [![Matrix space](https://img.shields.io/matrix/ntfy-space:matrix.org?label=Matrix+space)](https://matrix.to/#/#ntfy-space:matrix.org)
+[![Lemmy](https://img.shields.io/badge/Lemmy-discuss-green)](https://discuss.ntfy.sh/c/ntfy)
 [![Healthcheck](https://healthchecks.io/badge/68b65976-b3b0-4102-aec9-980921/kcoEgrLY.svg)](https://ntfy.statuspage.io/)
 [![Gitpod](https://img.shields.io/badge/Contribute%20with-Gitpod-908a85?logo=gitpod)](https://gitpod.io/#https://github.com/binwiederhier/ntfy)
 
@@ -30,16 +18,10 @@ notification service. With ntfy, you can **send notifications to your phone or d
 **without having to sign up or pay any fees**. If you'd like to run your own instance of the service, you can easily do 
 so since ntfy is open source.
 
-You can access the free version of ntfy at **[ntfy.sh](https://ntfy.sh)**. There is also an [open-source Android app](https://github.com/binwiederhier/ntfy-android)
+You can access the free version of ntfy at **[ntfy.sh](https://ntfy.sh)**. There is also an [open source Android app](https://github.com/binwiederhier/ntfy-android)
 available on [Google Play](https://play.google.com/store/apps/details?id=io.heckel.ntfy) or [F-Droid](https://f-droid.org/en/packages/io.heckel.ntfy/),
 as well as an [open source iOS app](https://github.com/binwiederhier/ntfy-ios) available on the [App Store](https://apps.apple.com/us/app/ntfy/id1625396347).
 
-<p>
-  <a href="https://play.google.com/store/apps/details?id=io.heckel.ntfy"><img height="50" src="docs/static/img/badge-googleplay.png"></a>
-  <a href="https://f-droid.org/en/packages/io.heckel.ntfy/"><img width="170" src="docs/static/img/badge-fdroid.svg"></a>
-  <a href="https://apps.apple.com/us/app/ntfy/id1625396347"><img height="50" src="docs/static/img/badge-appstore.png"></a>
-</p>
-
 <p>
   <img src=".github/images/screenshot-curl.png" height="180">
   <img src=".github/images/screenshot-web-detail.png" height="180">
@@ -49,10 +31,7 @@ as well as an [open source iOS app](https://github.com/binwiederhier/ntfy-ios) a
 </p>
 
 ## [ntfy Pro](https://ntfy.sh/app) 💸 🎉
-I now offer paid plans for [ntfy.sh](https://ntfy.sh/) if you don't want to self-host, or you want to support the development of 
-ntfy (→ [Purchase via web app](https://ntfy.sh/app)). You can **buy a plan for as low as $5/month**.
-You can also donate via [GitHub Sponsors](https://github.com/sponsors/binwiederhier), and [Liberapay](https://liberapay.com/ntfy).
-I would be very humbled by your sponsorship. ❤️ 
+I now offer paid plans for [ntfy.sh](https://ntfy.sh/) if you don't want to self-host, or you want to support the development of ntfy (→ [Purchase via web app](https://ntfy.sh/app)). You can **buy a plan for as low as $3.33/month** (if you use promo code `MYTOPIC`, limited time only). You can also donate via [GitHub Sponsors](https://github.com/sponsors/binwiederhier), and [Liberapay](https://liberapay.com/ntfy). I would be very humbled by your sponsorship. ❤️ 
 
 ## **[Documentation](https://ntfy.sh/docs/)**
 
@@ -62,31 +41,34 @@ I would be very humbled by your sponsorship. ❤️
 [Install / Self-hosting](https://ntfy.sh/docs/install/) |
 [Building](https://ntfy.sh/docs/develop/)
 
-## Chat/forum
+## Chat / forum
 There are a few ways to get in touch with me and/or the rest of the community. Feel free to use any of these methods. Whatever
 works best for you:
 
 * [Discord server](https://discord.gg/cT7ECsZj9w) - direct chat with the community
 * [Matrix room #ntfy](https://matrix.to/#/#ntfy:matrix.org) (+ [Matrix space](https://matrix.to/#/#ntfy-space:matrix.org)) - same chat, bridged from Discord
+* [Lemmy discussion board](https://discuss.ntfy.sh/c/ntfy) - asynchronous forum (_new as of June 2023_)
 * [GitHub issues](https://github.com/binwiederhier/ntfy/issues) - questions, features, bugs
 
-## Announcements/beta testers
+## Announcements / beta testers
 For announcements of new releases and cutting-edge beta versions, please subscribe to the [ntfy.sh/announcements](https://ntfy.sh/announcements) 
 topic. If you'd like to test the iOS app, join [TestFlight](https://testflight.apple.com/join/P1fFnAm9). For Android betas,
 join Discord/Matrix (I'll eventually make a testing channel in Google Play).
 
+## Contributing
+I welcome any and all contributions. Just create a PR or an issue. For larger features/ideas, please reach out
+on Discord/Matrix first to see if I'd accept them. To contribute code, check out the [build instructions](https://ntfy.sh/docs/develop/) 
+for the server and the Android app. Or, if you'd like to help translate 🇩🇪 🇺🇸 🇧🇬, you can start immediately in
+[Hosted Weblate](https://hosted.weblate.org/projects/ntfy/).
+
+<a href="https://hosted.weblate.org/engage/ntfy/">
+<img src="https://hosted.weblate.org/widgets/ntfy/-/multi-blue.svg" alt="Translation status" />
+</a>
+
 ## Sponsors
-If you'd like to support the ntfy maintainers, please consider donating to [GitHub Sponsors](https://github.com/sponsors/binwiederhier) or
-and [Liberapay](https://liberapay.com/ntfy). We would be humbled if you helped carry the server and developer 
-account costs. Even small donations are very much appreciated. 
-
-Thank you to our commercial sponsors, who help keep the service running and the development going:
-
-<a href="https://m.do.co/c/442b929528db"><img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" width="201px"></a>
-
-<a href="https://go.warp.dev/ntfy"><img src="https://raw.githubusercontent.com/warpdotdev/brand-assets/refs/heads/main/Logos/Warp-Wordmark-Black.png" width="160px"></a>
-
-And a big fat **Thank You** to the individuals who have sponsored ntfy in the past, or are still sponsoring ntfy:
+I have just very recently started accepting donations via [GitHub Sponsors](https://github.com/sponsors/binwiederhier),
+and [Liberapay](https://liberapay.com/ntfy). I would be humbled if you helped me carry the server and developer 
+account costs. Even small donations are very much appreciated. A big fat **Thank You** to the folks already sponsoring ntfy:
 
 <a href="https://github.com/neutralinsomniac"><img src="https://github.com/neutralinsomniac.png" width="40px" /></a>
 <a href="https://github.com/aspyct"><img src="https://github.com/aspyct.png" width="40px" /></a>
@@ -159,89 +141,14 @@ And a big fat **Thank You** to the individuals who have sponsored ntfy in the pa
 <a href="https://github.com/darkdragon-001"><img src="https://github.com/darkdragon-001.png" width="40px" /></a>
 <a href="https://github.com/jonathan-kosgei"><img src="https://github.com/jonathan-kosgei.png" width="40px" /></a>
 <a href="https://github.com/KevinWang15"><img src="https://github.com/KevinWang15.png" width="40px" /></a>
-<a href="https://github.com/darkmattercoder"><img src="https://github.com/darkmattercoder.png" width="40px" /></a>
-<a href="https://github.com/bmcgonag"><img src="https://github.com/bmcgonag.png" width="40px" /></a>
-<a href="https://github.com/skorokithakis"><img src="https://github.com/skorokithakis.png" width="40px" /></a>
-<a href="https://github.com/eenturk"><img src="https://github.com/eenturk.png" width="40px" /></a>
-<a href="https://github.com/spirossi"><img src="https://github.com/spirossi.png" width="40px" /></a>
-<a href="https://github.com/teomarcdhio"><img src="https://github.com/teomarcdhio.png" width="40px" /></a>
-<a href="https://github.com/MarcMichalsky"><img src="https://github.com/MarcMichalsky.png" width="40px" /></a>
-<a href="https://github.com/LuckVintage"><img src="https://github.com/LuckVintage.png" width="40px" /></a>
-<a href="https://github.com/spartan"><img src="https://github.com/spartan.png" width="40px" /></a>
-<a href="https://github.com/alexandzors"><img src="https://github.com/alexandzors.png" width="40px" /></a>
-<a href="https://github.com/dkramer95"><img src="https://github.com/dkramer95.png" width="40px" /></a>
-<a href="https://github.com/YezGotIt"><img src="https://github.com/YezGotIt.png" width="40px" /></a>
-<a href="https://github.com/thomasskou"><img src="https://github.com/thomasskou.png" width="40px" /></a>
-<a href="https://github.com/surfernv"><img src="https://github.com/surfernv.png" width="40px" /></a>
-<a href="https://github.com/richardleach"><img src="https://github.com/richardleach.png" width="40px" /></a>
-<a href="https://github.com/bear"><img src="https://github.com/bear.png" width="40px" /></a>
-<a href="https://github.com/cminter"><img src="https://github.com/cminter.png" width="40px" /></a>
-<a href="https://github.com/bahur142"><img src="https://github.com/bahur142.png" width="40px" /></a>
-<a href="https://github.com/pgwiebes"><img src="https://github.com/pgwiebes.png" width="40px" /></a>
-<a href="https://github.com/ralhei"><img src="https://github.com/ralhei.png" width="40px" /></a>
-<a href="https://github.com/TechMDW"><img src="https://github.com/TechMDW.png" width="40px" /></a>
-<a href="https://github.com/ubipo"><img src="https://github.com/ubipo.png" width="40px" /></a>
-<a href="https://github.com/tka85"><img src="https://github.com/tka85.png" width="40px" /></a>
-<a href="https://github.com/beekeeb"><img src="https://github.com/beekeeb.png" width="40px" /></a>
-<a href="https://github.com/Emiliaaah"><img src="https://github.com/Emiliaaah.png" width="40px" /></a>
-<a href="https://github.com/zark0s"><img src="https://github.com/zark0s.png" width="40px" /></a>
-<a href="https://github.com/tomershvueli"><img src="https://github.com/tomershvueli.png" width="40px" /></a>
-<a href="https://github.com/CataIana"><img src="https://github.com/CataIana.png" width="40px" /></a>
-<a href="https://github.com/ajay-actuary"><img src="https://github.com/ajay-actuary.png" width="40px" /></a>
-<a href="https://github.com/mursec"><img src="https://github.com/mursec.png" width="40px" /></a>
-<a href="https://github.com/FrameXX"><img src="https://github.com/FrameXX.png" width="40px" /></a>
-<a href="https://github.com/vovayartsev"><img src="https://github.com/vovayartsev.png" width="40px" /></a>
-<a href="https://github.com/dwain-lab"><img src="https://github.com/dwain-lab.png" width="40px" /></a>
-<a href="https://github.com/brookmg"><img src="https://github.com/brookmg.png" width="40px" /></a>
-<a href="https://github.com/siebej"><img src="https://github.com/siebej.png" width="40px" /></a>
-<a href="https://github.com/rxsantos"><img src="https://github.com/rxsantos.png" width="40px" /></a>
-<a href="https://github.com/hermannx5"><img src="https://github.com/hermannx5.png" width="40px" /></a>
-<a href="https://github.com/rwxd"><img src="https://github.com/rwxd.png" width="40px" /></a>
-<a href="https://github.com/Integral-Tech"><img src="https://github.com/Integral-Tech.png" width="40px" /></a>
-<a href="https://github.com/TheTomik1"><img src="https://github.com/TheTomik1.png" width="40px" /></a>
-<a href="https://github.com/dav23r"><img src="https://github.com/dav23r.png" width="40px" /></a>
-<a href="https://github.com/stannynuytkens"><img src="https://github.com/stannynuytkens.png" width="40px" /></a>
-<a href="https://github.com/danbartram"><img src="https://github.com/danbartram.png" width="40px" /></a>
-<a href="https://github.com/arthurgleckler"><img src="https://github.com/arthurgleckler.png" width="40px" /></a>
-<a href="https://github.com/tomroth04"><img src="https://github.com/tomroth04.png" width="40px" /></a>
-<a href="https://github.com/Circenn5130"><img src="https://github.com/Circenn5130.png" width="40px" /></a>
-<a href="https://github.com/jceloria"><img src="https://github.com/jceloria.png" width="40px" /></a>
-<a href="https://github.com/afunworm"><img src="https://github.com/afunworm.png" width="40px" /></a>
-<a href="https://github.com/PTR-inc"><img src="https://github.com/PTR-inc.png" width="40px" /></a>
-<a href="https://github.com/spudooli"><img src="https://github.com/spudooli.png" width="40px" /></a>
-<a href="https://github.com/IMarkoMC"><img src="https://github.com/IMarkoMC.png" width="40px" /></a>
-<a href="https://github.com/rubund"><img src="https://github.com/rubund.png" width="40px" /></a>
-<a href="https://github.com/Riolku"><img src="https://github.com/Riolku.png" width="40px" /></a>
-<a href="https://github.com/arnbrhm"><img src="https://github.com/arnbrhm.png" width="40px" /></a>
-<a href="https://github.com/herzkerl"><img src="https://github.com/herzkerl.png" width="40px" /></a>
-<a href="https://github.com/0x45796164"><img src="https://github.com/0x45796164.png" width="40px" /></a>
-<a href="https://github.com/madchr1st"><img src="https://github.com/madchr1st.png" width="40px" /></a>
-<a href="https://github.com/avalentic"><img src="https://github.com/avalentic.png" width="40px" /></a>
-<a href="https://github.com/TheCraiggers"><img src="https://github.com/TheCraiggers.png" width="40px" /></a>
-<a href="https://github.com/sheetd"><img src="https://github.com/sheetd.png" width="40px" /></a>
-<a href="https://github.com/dlt-green"><img src="https://github.com/dlt-green.png" width="40px" /></a>
-<a href="https://github.com/suhlig"><img src="https://github.com/suhlig.png" width="40px" /></a>
-<a href="https://github.com/Proximus888"><img src="https://github.com/Proximus888.png" width="40px" /></a>
-<a href="https://github.com/wielandp"><img src="https://github.com/wielandp.png" width="40px" /></a>
-<a href="https://github.com/chxseh"><img src="https://github.com/chxseh.png" width="40px" /></a>
-<a href="https://github.com/user8446"><img src="https://github.com/user8446.png" width="40px" /></a>
-<a href="https://github.com/cdf-eagles"><img src="https://github.com/cdf-eagles.png" width="40px" /></a>
 
-## Contributing
-I welcome any contributions. Just create a PR or an issue. For larger features/ideas, please reach out
-on Discord/Matrix first to see if I'd accept them. To contribute code, check out the [build instructions](https://ntfy.sh/docs/develop/)
-for the server and the Android app. Or, if you'd like to help translate 🇩🇪 🇺🇸 🇧🇬, you can start immediately in
-[Hosted Weblate](https://hosted.weblate.org/projects/ntfy/).
+I'd also like to thank JetBrains for providing their awesome [IntelliJ IDEA](https://www.jetbrains.com/idea/) to me for free,
+and [DigitalOcean](https://m.do.co/c/442b929528db) (*referral link*) for supporting the project:
 
-<a href="https://hosted.weblate.org/engage/ntfy/">
-<img src="https://hosted.weblate.org/widgets/ntfy/-/multi-blue.svg" alt="Translation status" />
-</a>
+<a href="https://m.do.co/c/442b929528db"><img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" width="201px"></a>
 
 ## Code of Conduct
-We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for
-everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity
-and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste,
-color, religion, or sexual identity and orientation.
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
 
 **We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.**
 
@@ -251,7 +158,7 @@ _Please be sure to read the complete [Code of Conduct](CODE_OF_CONDUCT.md)._
 Made with ❤️ by [Philipp C. Heckel](https://heckel.io).   
 The project is dual licensed under the [Apache License 2.0](LICENSE) and the [GPLv2 License](LICENSE.GPLv2).
 
-Third-party libraries and resources:
+Third party libraries and resources:
 * [github.com/urfave/cli](https://github.com/urfave/cli) (MIT) is used to drive the CLI
 * [Mixkit sounds](https://mixkit.co/free-sound-effects/notification/) (Mixkit Free License) are used as notification sounds
 * [Sounds from notificationsounds.com](https://notificationsounds.com) (Creative Commons Attribution) are used as notification sounds
@@ -266,11 +173,9 @@ Third-party libraries and resources:
 * [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) (MIT) is used to provide the persistent message cache
 * [Firebase Admin SDK](https://github.com/firebase/firebase-admin-go) (Apache 2.0) is used to send FCM messages
 * [github/gemoji](https://github.com/github/gemoji) (MIT) is used for emoji support (specifically the [emoji.json](https://raw.githubusercontent.com/github/gemoji/master/db/emoji.json) file)
-* Go's [text/template](https://pkg.go.dev/text/template) (BSD-3-Clause) is vendored under [template/gotext/](template/gotext/) with a small patch adding an execution deadline (see [template/gotext/README.md](template/gotext/README.md))
 * [Lightbox with vanilla JS](https://yossiabramov.com/blog/vanilla-js-lightbox) as a lightbox on the landing page 
 * [HTTP middleware for gzip compression](https://gist.github.com/CJEnright/bc2d8b8dc0c1389a9feeddb110f822d7) (MIT) is used for serving static files
 * [Regex for auto-linking](https://github.com/bryanwoods/autolink-js) (MIT) is used to highlight links (the library is not used)
 * [Statically linking go-sqlite3](https://www.arp242.net/static-go.html)
 * [Linked tabs in mkdocs](https://facelessuser.github.io/pymdown-extensions/extensions/tabbed/#linked-tabs)
 * [webpush-go](https://github.com/SherClockHolmes/webpush-go) (MIT) is used to send web push notifications
-* [Sprig](https://github.com/Masterminds/sprig) (MIT) is used to add template parsing functions

SECURITY.md

@@ -6,7 +6,5 @@ As of today, I only support the latest version of ntfy. Please make sure you sta
 
 ## Reporting a Vulnerability
 
-Please report security vulnerabilities privately via email to [security@mail.ntfy.sh](mailto:security@mail.ntfy.sh).
-
-You can also reach me on [Discord](https://discord.gg/cT7ECsZj9w) or [Matrix](https://matrix.to/#/#ntfy:matrix.org) 
-(my username is `binwiederhier`).
+Please report severe security issues privately via ntfy@heckel.io, [Discord](https://discord.gg/cT7ECsZj9w),
+or [Matrix](https://matrix.to/#/#ntfy:matrix.org) (my username is `binwiederhier`).

attachment/backend.go

@@ -1,23 +0,0 @@
-package attachment
-
-import (
-	"io"
-	"time"
-)
-
-// backendObject represents an object stored in a backend.
-type object struct {
-	ID           string
-	Size         int64
-	LastModified time.Time
-}
-
-// backend is a minimal I/O interface for storing and retrieving attachment files.
-// It has no knowledge of size tracking, limiting, or ID validation.
-type backend interface {
-	Put(id string, reader io.Reader, untrustedLength int64) error
-	Get(id string) (io.ReadCloser, int64, error)
-	List() ([]object, error)
-	Delete(ids ...string) error
-	DeleteIncomplete(cutoff time.Time) error
-}

attachment/backend_file.go

@@ -1,94 +0,0 @@
-package attachment
-
-import (
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"time"
-)
-
-type fileBackend struct {
-	dir string
-}
-
-var _ backend = (*fileBackend)(nil)
-
-func newFileBackend(dir string) (*fileBackend, error) {
-	if err := os.MkdirAll(dir, 0700); err != nil {
-		return nil, err
-	}
-	return &fileBackend{dir: dir}, nil
-}
-
-func (b *fileBackend) Put(id string, reader io.Reader, untrustedLength int64) error {
-	if untrustedLength > 0 {
-		reader = io.LimitReader(reader, untrustedLength)
-	}
-	file := filepath.Join(b.dir, id)
-	f, err := os.OpenFile(file, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	n, err := io.Copy(f, reader)
-	if err != nil {
-		os.Remove(file)
-		return err
-	} else if untrustedLength > 0 && n != untrustedLength {
-		os.Remove(file)
-		return fmt.Errorf("content length mismatch: claimed %d, got %d", untrustedLength, n)
-	}
-	if err := f.Close(); err != nil {
-		os.Remove(file)
-		return err
-	}
-	return nil
-}
-
-func (b *fileBackend) List() ([]object, error) {
-	entries, err := os.ReadDir(b.dir)
-	if err != nil {
-		return nil, err
-	}
-	objects := make([]object, 0, len(entries))
-	for _, e := range entries {
-		info, err := e.Info()
-		if err != nil {
-			return nil, err
-		}
-		objects = append(objects, object{
-			ID:           e.Name(),
-			Size:         info.Size(),
-			LastModified: info.ModTime(),
-		})
-	}
-	return objects, nil
-}
-
-func (b *fileBackend) Get(id string) (io.ReadCloser, int64, error) {
-	file := filepath.Join(b.dir, id)
-	stat, err := os.Stat(file)
-	if err != nil {
-		return nil, 0, err
-	}
-	f, err := os.Open(file)
-	if err != nil {
-		return nil, 0, err
-	}
-	return f, stat.Size(), nil
-}
-
-func (b *fileBackend) Delete(ids ...string) error {
-	for _, id := range ids {
-		file := filepath.Join(b.dir, id)
-		if err := os.Remove(file); err != nil && !os.IsNotExist(err) {
-			return err
-		}
-	}
-	return nil
-}
-
-func (b *fileBackend) DeleteIncomplete(_ time.Time) error {
-	return nil
-}

attachment/backend_s3.go

@@ -1,51 +0,0 @@
-package attachment
-
-import (
-	"context"
-	"io"
-	"time"
-
-	"heckel.io/ntfy/v2/s3"
-)
-
-type s3Backend struct {
-	client *s3.Client
-}
-
-var _ backend = (*s3Backend)(nil)
-
-func newS3Backend(client *s3.Client) *s3Backend {
-	return &s3Backend{client: client}
-}
-
-func (b *s3Backend) Put(id string, reader io.Reader, untrustedLength int64) error {
-	return b.client.PutObject(context.Background(), id, reader, untrustedLength)
-}
-
-func (b *s3Backend) Get(id string) (io.ReadCloser, int64, error) {
-	return b.client.GetObject(context.Background(), id)
-}
-
-func (b *s3Backend) List() ([]object, error) {
-	objects, err := b.client.ListObjectsV2(context.Background())
-	if err != nil {
-		return nil, err
-	}
-	result := make([]object, 0, len(objects))
-	for _, obj := range objects {
-		result = append(result, object{
-			ID:           obj.Key,
-			Size:         obj.Size,
-			LastModified: obj.LastModified,
-		})
-	}
-	return result, nil
-}
-
-func (b *s3Backend) Delete(ids ...string) error {
-	return b.client.DeleteObjects(context.Background(), ids)
-}
-
-func (b *s3Backend) DeleteIncomplete(cutoff time.Time) error {
-	return b.client.AbortIncompleteUploads(context.Background(), cutoff)
-}

attachment/store.go

@@ -1,246 +0,0 @@
-package attachment
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"sync"
-	"time"
-
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/model"
-	"heckel.io/ntfy/v2/s3"
-	"heckel.io/ntfy/v2/util"
-)
-
-const (
-	tagStore     = "attachment_store"
-	syncInterval = 15 * time.Minute // How often to run the background sync loop
-)
-
-var errInvalidFileID = errors.New("invalid file ID")
-
-// Store manages attachment storage with shared logic for size tracking, limiting,
-// ID validation, and background sync to reconcile storage with the database.
-type Store struct {
-	backend              backend
-	limit                int64                            // Defined limit of the store in bytes
-	size                 int64                            // Current size of the store in bytes
-	sizes                map[string]int64                 // File ID -> size, for subtracting on Remove
-	attachmentsWithSizes func() (map[string]int64, error) // Returns file ID -> size for active attachments
-	orphanGracePeriod    time.Duration                    // Don't delete orphaned objects younger than this
-	closeChan            chan struct{}
-	doneChan             chan struct{}
-	mu                   sync.RWMutex // Protects size and sizes
-}
-
-// NewFileStore creates a new file-system backed attachment cache
-func NewFileStore(dir string, totalSizeLimit int64, orphanGracePeriod time.Duration, attachmentsWithSizes func() (map[string]int64, error)) (*Store, error) {
-	b, err := newFileBackend(dir)
-	if err != nil {
-		return nil, err
-	}
-	return newStore(b, totalSizeLimit, orphanGracePeriod, attachmentsWithSizes)
-}
-
-// NewS3Store creates a new S3-backed attachment cache. The s3URL must be in the format:
-//
-//	s3://ACCESS_KEY:SECRET_KEY@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT][&disable_http2=true]
-func NewS3Store(s3URL string, totalSizeLimit int64, orphanGracePeriod time.Duration, attachmentsWithSizes func() (map[string]int64, error)) (*Store, error) {
-	config, err := s3.ParseURL(s3URL)
-	if err != nil {
-		return nil, err
-	}
-	return newStore(newS3Backend(s3.New(config)), totalSizeLimit, orphanGracePeriod, attachmentsWithSizes)
-}
-
-func newStore(backend backend, totalSizeLimit int64, orphanGracePeriod time.Duration, attachmentsWithSizes func() (map[string]int64, error)) (*Store, error) {
-	c := &Store{
-		backend:              backend,
-		limit:                totalSizeLimit,
-		sizes:                make(map[string]int64),
-		attachmentsWithSizes: attachmentsWithSizes,
-		orphanGracePeriod:    orphanGracePeriod,
-		closeChan:            make(chan struct{}),
-		doneChan:             make(chan struct{}),
-	}
-	// Hydrate sizes from the database immediately so that Size()/Remaining()/Remove()
-	// are accurate from the start, without waiting for the first sync() call.
-	if attachmentsWithSizes != nil {
-		attachments, err := attachmentsWithSizes()
-		if err != nil {
-			return nil, fmt.Errorf("attachment store: failed to load existing attachments: %w", err)
-		}
-		for id, size := range attachments {
-			c.sizes[id] = size
-			c.size += size
-		}
-		go c.syncLoop()
-	} else {
-		close(c.doneChan)
-	}
-	return c, nil
-}
-
-// Write stores an attachment file. The id is validated, and the write is subject to
-// the total size limit and any additional limiters. The untrustedLength is a hint
-// from the client's Content-Length header; backends may use it to optimize uploads (e.g.
-// streaming directly to S3 without buffering).
-func (c *Store) Write(id string, reader io.Reader, untrustedLength int64, limiters ...util.Limiter) (int64, error) {
-	if !model.ValidMessageID(id) {
-		return 0, errInvalidFileID
-	}
-	log.Tag(tagStore).Field("message_id", id).Debug("Writing attachment")
-	limiters = append(limiters, util.NewFixedLimiter(c.Remaining()))
-	countingReader := util.NewCountingReader(reader)
-	limitReader := util.NewLimitReader(countingReader, limiters...)
-	if err := c.backend.Put(id, limitReader, untrustedLength); err != nil {
-		c.backend.Delete(id) //nolint:errcheck
-		return 0, err
-	}
-	size := countingReader.Total()
-	c.mu.Lock()
-	c.size += size
-	c.sizes[id] = size
-	c.mu.Unlock()
-	return size, nil
-}
-
-// Read retrieves an attachment file by ID
-func (c *Store) Read(id string) (io.ReadCloser, int64, error) {
-	if !model.ValidMessageID(id) {
-		return nil, 0, errInvalidFileID
-	}
-	return c.backend.Get(id)
-}
-
-// Remove deletes attachment files by ID and subtracts their known sizes from
-// the total. Sizes for objects not tracked (e.g. written before this process
-// started and before the first sync) are corrected by the next sync() call.
-func (c *Store) Remove(ids ...string) error {
-	for _, id := range ids {
-		if !model.ValidMessageID(id) {
-			return errInvalidFileID
-		}
-	}
-	// Remove from backend
-	for _, id := range ids {
-		log.Tag(tagStore).Field("message_id", id).Debug("Removing attachment")
-	}
-	if err := c.backend.Delete(ids...); err != nil {
-		return err
-	}
-	// Update total cache size
-	c.mu.Lock()
-	for _, id := range ids {
-		if size, ok := c.sizes[id]; ok {
-			c.size -= size
-			delete(c.sizes, id)
-		}
-	}
-	if c.size < 0 {
-		c.size = 0
-	}
-	c.mu.Unlock()
-	return nil
-}
-
-// Sync triggers an immediate reconciliation of storage with the database.
-func (c *Store) Sync() error {
-	return c.sync()
-}
-
-// sync reconciles the backend storage with the database. It lists all objects,
-// deletes orphans (not in the valid ID set and older than the grace period), and
-// recomputes the total size from the existing attachments in the database.
-func (c *Store) sync() error {
-	if c.attachmentsWithSizes == nil {
-		return nil
-	}
-	attachmentsWithSizes, err := c.attachmentsWithSizes()
-	if err != nil {
-		return fmt.Errorf("attachment sync: failed to get existing attachments: %w", err)
-	}
-	remoteObjects, err := c.backend.List()
-	if err != nil {
-		return fmt.Errorf("attachment sync: failed to list objects: %w", err)
-	}
-	// Calculate total cache size and collect orphaned attachments, excluding objects younger
-	// than the grace period to account for races, and skipping objects with invalid IDs.
-	cutoff := time.Now().Add(-c.orphanGracePeriod)
-	var orphanIDs []string
-	var count, totalSize int64
-	sizes := make(map[string]int64, len(remoteObjects))
-	for _, obj := range remoteObjects {
-		if !model.ValidMessageID(obj.ID) {
-			continue
-		}
-		if _, ok := attachmentsWithSizes[obj.ID]; !ok && obj.LastModified.Before(cutoff) {
-			orphanIDs = append(orphanIDs, obj.ID)
-		} else {
-			count++
-			totalSize += attachmentsWithSizes[obj.ID]
-			sizes[obj.ID] = attachmentsWithSizes[obj.ID]
-		}
-	}
-	log.Tag(tagStore).Debug("Attachment store updated: %d attachment(s), %s", count, util.FormatSizeHuman(totalSize))
-	c.mu.Lock()
-	c.size = totalSize
-	c.sizes = sizes
-	c.mu.Unlock()
-	// Delete orphaned attachments
-	if len(orphanIDs) > 0 {
-		log.Tag(tagStore).Debug("Deleting %d orphaned attachment(s)", len(orphanIDs))
-		if err := c.backend.Delete(orphanIDs...); err != nil {
-			return fmt.Errorf("attachment sync: failed to delete orphaned objects: %w", err)
-		}
-	}
-	// Clean up incomplete uploads (S3 only)
-	if err := c.backend.DeleteIncomplete(cutoff); err != nil {
-		log.Tag(tagStore).Err(err).Warn("Failed to abort incomplete uploads from attachment cache")
-	}
-	return nil
-}
-
-// Size returns the current total size of all attachments
-func (c *Store) Size() int64 {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	return c.size
-}
-
-// Remaining returns the remaining capacity for attachments
-func (c *Store) Remaining() int64 {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	remaining := c.limit - c.size
-	if remaining < 0 {
-		return 0
-	}
-	return remaining
-}
-
-// Close stops the background sync goroutine and waits for it to finish
-func (c *Store) Close() {
-	close(c.closeChan)
-	<-c.doneChan
-}
-
-func (c *Store) syncLoop() {
-	defer close(c.doneChan)
-	if err := c.sync(); err != nil {
-		log.Tag(tagStore).Err(err).Warn("Attachment sync failed")
-	}
-	ticker := time.NewTicker(syncInterval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ticker.C:
-			if err := c.sync(); err != nil {
-				log.Tag(tagStore).Err(err).Warn("Attachment sync failed")
-			}
-		case <-c.closeChan:
-			return
-		}
-	}
-}

attachment/store_file_test.go

@@ -1,17 +0,0 @@
-package attachment
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-func newTestFileStore(t *testing.T, totalSizeLimit int64) (dir string, cache *Store) {
-	t.Helper()
-	dir = t.TempDir()
-	cache, err := NewFileStore(dir, totalSizeLimit, time.Hour, nil)
-	require.Nil(t, err)
-	t.Cleanup(func() { cache.Close() })
-	return dir, cache
-}

attachment/store_s3_test.go

@@ -1,120 +0,0 @@
-package attachment
-
-import (
-	"context"
-	"io"
-	"os"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/s3"
-)
-
-func TestS3Store_WriteWithPrefix(t *testing.T) {
-	s3URL := os.Getenv("NTFY_TEST_S3_URL")
-	if s3URL == "" {
-		t.Skip("NTFY_TEST_S3_URL not set")
-	}
-	cfg, err := s3.ParseURL(s3URL)
-	require.Nil(t, err)
-	cfg.Prefix = "test-prefix"
-	client := s3.New(cfg)
-	deleteAllObjects(t, client)
-	backend := newS3Backend(client)
-	cache, err := newStore(backend, 10*1024, time.Hour, nil)
-	require.Nil(t, err)
-	t.Cleanup(func() {
-		deleteAllObjects(t, client)
-		cache.Close()
-	})
-
-	size, err := cache.Write("abcdefghijkl", strings.NewReader("test"), 0)
-	require.Nil(t, err)
-	require.Equal(t, int64(4), size)
-
-	reader, _, err := cache.Read("abcdefghijkl")
-	require.Nil(t, err)
-	data, err := io.ReadAll(reader)
-	reader.Close()
-	require.Nil(t, err)
-	require.Equal(t, "test", string(data))
-}
-
-// --- Helpers ---
-
-func newTestRealS3Store(t *testing.T, totalSizeLimit int64) (*Store, *modTimeOverrideBackend) {
-	t.Helper()
-	s3URL := os.Getenv("NTFY_TEST_S3_URL")
-	if s3URL == "" {
-		t.Skip("NTFY_TEST_S3_URL not set")
-	}
-	cfg, err := s3.ParseURL(s3URL)
-	require.Nil(t, err)
-	if cfg.Prefix != "" {
-		cfg.Prefix = cfg.Prefix + "/testpkg-attachment"
-	} else {
-		cfg.Prefix = "testpkg-attachment"
-	}
-	client := s3.New(cfg)
-	inner := newS3Backend(client)
-	wrapper := &modTimeOverrideBackend{backend: inner, modTimes: make(map[string]time.Time)}
-	deleteAllObjects(t, client)
-	store, err := newStore(wrapper, totalSizeLimit, time.Hour, nil)
-	require.Nil(t, err)
-	t.Cleanup(func() {
-		deleteAllObjects(t, client)
-		store.Close()
-	})
-	return store, wrapper
-}
-
-func deleteAllObjects(t *testing.T, client *s3.Client) {
-	t.Helper()
-	for i := 0; i < 20; i++ {
-		objects, err := client.ListObjectsV2(context.Background())
-		require.Nil(t, err)
-		if len(objects) == 0 {
-			return
-		}
-		keys := make([]string, len(objects))
-		for j, obj := range objects {
-			keys[j] = obj.Key
-		}
-		require.Nil(t, client.DeleteObjects(context.Background(), keys))
-		time.Sleep(200 * time.Millisecond)
-	}
-	t.Fatal("timed out waiting for bucket to be empty")
-}
-
-// modTimeOverrideBackend wraps a backend and allows overriding LastModified times returned by List().
-// This is used in tests to simulate old objects on backends (like real S3) where
-// LastModified cannot be set directly.
-type modTimeOverrideBackend struct {
-	backend
-	mu       sync.Mutex
-	modTimes map[string]time.Time // object ID -> override time
-}
-
-func (b *modTimeOverrideBackend) List() ([]object, error) {
-	objects, err := b.backend.List()
-	if err != nil {
-		return nil, err
-	}
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	for i, obj := range objects {
-		if t, ok := b.modTimes[obj.ID]; ok {
-			objects[i].LastModified = t
-		}
-	}
-	return objects, nil
-}
-
-func (b *modTimeOverrideBackend) setModTime(id string, t time.Time) {
-	b.mu.Lock()
-	b.modTimes[id] = t
-	b.mu.Unlock()
-}

attachment/store_test.go

@@ -1,352 +0,0 @@
-package attachment
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/util"
-)
-
-const testSizeLimit = 10 * 1024
-
-func TestStore_WriteReadRemove(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		// Write
-		size, err := s.Write("abcdefghijkl", strings.NewReader("hello world"), 0)
-		require.Nil(t, err)
-		require.Equal(t, int64(11), size)
-		require.Equal(t, int64(11), s.Size())
-
-		// Read back
-		reader, readSize, err := s.Read("abcdefghijkl")
-		require.Nil(t, err)
-		require.Equal(t, int64(11), readSize)
-		data, err := io.ReadAll(reader)
-		reader.Close()
-		require.Nil(t, err)
-		require.Equal(t, "hello world", string(data))
-
-		// Remove
-		require.Nil(t, s.Remove("abcdefghijkl"))
-		require.Equal(t, int64(0), s.Size())
-
-		// Read after remove should fail
-		_, _, err = s.Read("abcdefghijkl")
-		require.Error(t, err)
-	})
-}
-
-func TestStore_WriteRemoveMultiple(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		for i := 0; i < 5; i++ {
-			_, err := s.Write(fmt.Sprintf("abcdefghijk%d", i), bytes.NewReader(make([]byte, 100)), 0)
-			require.Nil(t, err)
-		}
-		require.Equal(t, int64(500), s.Size())
-
-		require.Nil(t, s.Remove("abcdefghijk1", "abcdefghijk3"))
-		require.Equal(t, int64(300), s.Size())
-
-		// Removed files should not be readable
-		_, _, err := s.Read("abcdefghijk1")
-		require.Error(t, err)
-		_, _, err = s.Read("abcdefghijk3")
-		require.Error(t, err)
-
-		// Remaining files should still be readable
-		for _, id := range []string{"abcdefghijk0", "abcdefghijk2", "abcdefghijk4"} {
-			reader, _, err := s.Read(id)
-			require.Nil(t, err)
-			reader.Close()
-		}
-	})
-}
-
-func TestStore_WriteTotalSizeLimit(t *testing.T) {
-	forEachBackend(t, 100, func(t *testing.T, s *Store, _ func(string)) {
-		// First write fits
-		_, err := s.Write("abcdefghijk0", bytes.NewReader(make([]byte, 80)), 0)
-		require.Nil(t, err)
-		require.Equal(t, int64(80), s.Size())
-		require.Equal(t, int64(20), s.Remaining())
-
-		// Second write exceeds total limit
-		_, err = s.Write("abcdefghijk1", bytes.NewReader(make([]byte, 50)), 0)
-		require.ErrorIs(t, err, util.ErrLimitReached)
-	})
-}
-
-func TestStore_WriteAdditionalLimiter(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		_, err := s.Write("abcdefghijkl", bytes.NewReader(make([]byte, 200)), 0, util.NewFixedLimiter(100))
-		require.ErrorIs(t, err, util.ErrLimitReached)
-
-		// File should not be readable (was cleaned up)
-		_, _, err = s.Read("abcdefghijkl")
-		require.Error(t, err)
-	})
-}
-
-func TestStore_WriteWithLimiter(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		size, err := s.Write("abcdefghijkl", strings.NewReader("normal file"), 0, util.NewFixedLimiter(999))
-		require.Nil(t, err)
-		require.Equal(t, int64(11), size)
-		require.Equal(t, int64(11), s.Size())
-	})
-}
-
-func TestStore_WriteOverwriteSameID(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		// Write 100 bytes
-		_, err := s.Write("abcdefghijkl", bytes.NewReader(make([]byte, 100)), 0)
-		require.Nil(t, err)
-		require.Equal(t, int64(100), s.Size())
-
-		// Overwrite with 50 bytes
-		_, err = s.Write("abcdefghijkl", bytes.NewReader(make([]byte, 50)), 0)
-		require.Nil(t, err)
-		require.Equal(t, int64(150), s.Size()) // Store tracks both writes
-
-		// Read back should return the latest content
-		reader, readSize, err := s.Read("abcdefghijkl")
-		require.Nil(t, err)
-		require.Equal(t, int64(50), readSize)
-		reader.Close()
-	})
-}
-
-func TestStore_WriteAfterFailure(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		// Failed write: limiter rejects it
-		_, err := s.Write("abcdefghijkl", bytes.NewReader(make([]byte, 200)), 0, util.NewFixedLimiter(100))
-		require.ErrorIs(t, err, util.ErrLimitReached)
-		require.Equal(t, int64(0), s.Size())
-
-		// Subsequent write with a different ID should succeed
-		size, err := s.Write("abcdefghijk2", strings.NewReader("hello"), 0)
-		require.Nil(t, err)
-		require.Equal(t, int64(5), size)
-		require.Equal(t, int64(5), s.Size())
-
-		// The failed ID should not be readable
-		_, _, err = s.Read("abcdefghijkl")
-		require.Error(t, err)
-
-		// The successful ID should be readable
-		reader, _, err := s.Read("abcdefghijk2")
-		require.Nil(t, err)
-		reader.Close()
-	})
-}
-
-func TestStore_SyncRecomputesSize(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, makeOld func(string)) {
-		// Write two files
-		_, err := s.Write("abcdefghijk0", bytes.NewReader(make([]byte, 100)), 0)
-		require.Nil(t, err)
-		_, err = s.Write("abcdefghijk1", bytes.NewReader(make([]byte, 200)), 0)
-		require.Nil(t, err)
-		require.Equal(t, int64(300), s.Size())
-
-		// Corrupt the in-memory size tracking
-		s.mu.Lock()
-		s.size = 999
-		s.mu.Unlock()
-		require.Equal(t, int64(999), s.Size())
-
-		// Set attachmentsWithSizes to include both files so nothing gets deleted
-		s.attachmentsWithSizes = func() (map[string]int64, error) {
-			return map[string]int64{"abcdefghijk0": 100, "abcdefghijk1": 200}, nil
-		}
-
-		// Sync should recompute size from the backend
-		require.Nil(t, s.sync())
-		require.Equal(t, int64(300), s.Size())
-	})
-}
-
-func TestStore_ReadNotFound(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		_, _, err := s.Read("abcdefghijkl")
-		require.Error(t, err)
-	})
-}
-
-func TestStore_InvalidID(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		_, err := s.Write("bad", strings.NewReader("x"), 0)
-		require.Equal(t, errInvalidFileID, err)
-
-		_, _, err = s.Read("bad")
-		require.Equal(t, errInvalidFileID, err)
-
-		err = s.Remove("bad")
-		require.Equal(t, errInvalidFileID, err)
-	})
-}
-
-func TestStore_WriteLargeObjects(t *testing.T) {
-	sizes := map[string]int64{
-		"100B": 100,
-		"6MB":  6 * 1024 * 1024,
-		"12MB": 12 * 1024 * 1024,
-	}
-	for name, sz := range sizes {
-		t.Run(name, func(t *testing.T) {
-			forEachBackend(t, sz+1024, func(t *testing.T, s *Store, _ func(string)) {
-				data := make([]byte, sz)
-				for i := range data {
-					data[i] = byte(i % 251)
-				}
-
-				size, err := s.Write("abcdefghijkl", bytes.NewReader(data), 0)
-				require.Nil(t, err)
-				require.Equal(t, sz, size)
-				require.Equal(t, sz, s.Size())
-
-				reader, readSize, err := s.Read("abcdefghijkl")
-				require.Nil(t, err)
-				require.Equal(t, sz, readSize)
-				got, err := io.ReadAll(reader)
-				reader.Close()
-				require.Nil(t, err)
-				require.Equal(t, data, got)
-			})
-		})
-	}
-}
-
-func TestStore_WriteUntrustedLengthExact(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		size, err := s.Write("abcdefghijkl", strings.NewReader("hello world"), 11)
-		require.Nil(t, err)
-		require.Equal(t, int64(11), size)
-
-		reader, _, err := s.Read("abcdefghijkl")
-		require.Nil(t, err)
-		data, err := io.ReadAll(reader)
-		reader.Close()
-		require.Nil(t, err)
-		require.Equal(t, "hello world", string(data))
-	})
-}
-
-func TestStore_WriteUntrustedLengthBodyLonger(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		// Body has 11 bytes, but we claim 5 — only first 5 bytes should be stored
-		size, err := s.Write("abcdefghijkl", strings.NewReader("hello world"), 5)
-		require.Nil(t, err)
-		require.Equal(t, int64(5), size)
-
-		reader, _, err := s.Read("abcdefghijkl")
-		require.Nil(t, err)
-		data, err := io.ReadAll(reader)
-		reader.Close()
-		require.Nil(t, err)
-		require.Equal(t, "hello", string(data))
-	})
-}
-
-func TestStore_WriteUntrustedLengthBodyShorter(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		// Body has 5 bytes, but we claim 100 — should fail
-		_, err := s.Write("abcdefghijkl", strings.NewReader("hello"), 100)
-		require.Error(t, err)
-
-		// File should not be readable (was cleaned up)
-		_, _, err = s.Read("abcdefghijkl")
-		require.Error(t, err)
-	})
-}
-
-func TestStore_Sync(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, makeOld func(string)) {
-		// Write some files
-		_, err := s.Write("abcdefghijk0", strings.NewReader("file0"), 0)
-		require.Nil(t, err)
-		_, err = s.Write("abcdefghijk1", strings.NewReader("file1"), 0)
-		require.Nil(t, err)
-		_, err = s.Write("abcdefghijk2", strings.NewReader("file2"), 0)
-		require.Nil(t, err)
-
-		require.Equal(t, int64(15), s.Size())
-
-		// Set the ID provider to only know about file 0 and 2
-		s.attachmentsWithSizes = func() (map[string]int64, error) {
-			return map[string]int64{"abcdefghijk0": 5, "abcdefghijk2": 5}, nil
-		}
-
-		// Make file 1 old enough to be cleaned up
-		makeOld("abcdefghijk1")
-
-		// Run sync
-		require.Nil(t, s.sync())
-
-		// File 1 should be deleted (orphan, old enough)
-		_, _, err = s.Read("abcdefghijk1")
-		require.Error(t, err)
-
-		// Files 0 and 2 should still be readable
-		r, _, err := s.Read("abcdefghijk0")
-		require.Nil(t, err)
-		r.Close()
-		r, _, err = s.Read("abcdefghijk2")
-		require.Nil(t, err)
-		r.Close()
-
-		// Size should be updated
-		require.Equal(t, int64(10), s.Size())
-	})
-}
-
-func TestStore_Sync_SkipsRecentFiles(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		// Write a file
-		_, err := s.Write("abcdefghijk0", strings.NewReader("file0"), 0)
-		require.Nil(t, err)
-
-		// Set the ID provider to return empty (no valid IDs)
-		s.attachmentsWithSizes = func() (map[string]int64, error) {
-			return map[string]int64{}, nil
-		}
-
-		// File was just created, so it should NOT be deleted (< 1 hour old)
-		require.Nil(t, s.sync())
-
-		// File should still exist
-		reader, _, err := s.Read("abcdefghijk0")
-		require.Nil(t, err)
-		reader.Close()
-	})
-}
-
-// forEachBackend runs f against both the file and S3 backends. It also provides a makeOld
-// callback that makes a specific object's timestamp old enough for orphan cleanup (> 1 hour).
-// For the file backend, this uses os.Chtimes; for the S3 backend, it overrides the object's
-// LastModified time via a modTimeOverrideBackend wrapper. Objects start with recent timestamps
-// by default. The S3 subtest is skipped if NTFY_TEST_S3_URL is not set.
-func forEachBackend(t *testing.T, totalSizeLimit int64, f func(t *testing.T, s *Store, makeOld func(string))) {
-	t.Run("file", func(t *testing.T) {
-		dir, s := newTestFileStore(t, totalSizeLimit)
-		makeOld := func(id string) {
-			oldTime := time.Unix(1, 0)
-			os.Chtimes(filepath.Join(dir, id), oldTime, oldTime)
-		}
-		f(t, s, makeOld)
-	})
-	t.Run("s3", func(t *testing.T) {
-		s, wrapper := newTestRealS3Store(t, totalSizeLimit)
-		makeOld := func(id string) {
-			wrapper.setModTime(id, time.Unix(1, 0))
-		}
-		f(t, s, makeOld)
-	})
-}

ban/service.go

@@ -1,185 +0,0 @@
-// Package ban implements the abuse ban-feed: it tracks per-prefix weighted "strikes" from rejected
-// requests and appends breaching prefixes to a ban file that fail2ban tails. Keying by prefix (not
-// by visitor) makes the accounting match the unit fail2ban bans, even for shared account visitors.
-package ban
-
-import (
-	"fmt"
-	"net/netip"
-	"os"
-	"sync"
-	"time"
-
-	"golang.org/x/time/rate"
-	"heckel.io/ntfy/v2/log"
-)
-
-const (
-	tag           = "ban"
-	pruneInterval = 10 * time.Minute
-	writeInterval = 3 * time.Second
-)
-
-// Config is the Service's config, kept separate from server.Config to avoid an import cycle.
-type Config struct {
-	File           string        // Ban file that fail2ban tails (must be non-empty; the caller decides whether the feature is enabled)
-	Window         time.Duration // Rolling window over which weighted strikes are counted
-	Threshold      int           // Weighted strikes per Window before a prefix is banned
-	Weights        Weights       // Code matcher -> strike weight (0 = exempt)
-	PrefixBitsIPv4 int           // Mask width for the ban unit, e.g. 32 (matches rate-limiting granularity)
-	PrefixBitsIPv6 int           // Mask width for the ban unit, e.g. 64
-}
-
-// tracker is the per-prefix strike state: a weighted breach detector plus timestamps for pruning and throttling.
-type tracker struct {
-	limiter *rate.Limiter
-	seen    time.Time // Last strike, for pruning idle prefixes
-	emitted time.Time // Last ban-line write for this prefix, throttles re-emits to once per Window
-}
-
-// Service owns the ban-feed: per-prefix strike accounting, buffered file writes, and idle-prefix
-// pruning. The caller owns the enable/disable decision -- only construct a Service when the feature
-// is on (see server.New, which builds one only when a ban file is configured).
-type Service struct {
-	conf      *Config
-	mu        sync.Mutex // Guards trackers and pending
-	trackers  map[netip.Prefix]*tracker
-	pending   []string      // Formatted ban lines buffered by Record, flushed to the ban file by runWriteLoop
-	writeDone chan struct{} // Closed when runWriteLoop exits after its final flush
-	closeChan chan struct{}
-	closeOnce sync.Once
-}
-
-// NewService builds a Service and starts its background loops. The caller must only call it when the
-// feature is enabled (conf non-nil, File non-empty); the Service does not model a disabled state.
-func NewService(conf *Config) *Service {
-	s := &Service{
-		conf:      conf,
-		trackers:  make(map[netip.Prefix]*tracker),
-		closeChan: make(chan struct{}),
-		writeDone: make(chan struct{}),
-	}
-	go s.runPruneLoop()
-	go s.runWriteLoop()
-	return s
-}
-
-// Record counts one rejection against the IP's prefix bucket and, on breach, buffers a ban line
-// (throttled to once per Window per prefix). No-ops for a non-4xx/5xx status or a zero-weight code.
-func (s *Service) Record(ip netip.Addr, httpCode, errorCode int) {
-	if httpCode < 400 {
-		return
-	}
-	weight := s.conf.Weights.WeightFor(errorCode)
-	if weight == 0 {
-		return // Weight 0: exempt, no strike
-	}
-	prefix := s.prefix(ip)
-	now := time.Now()
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	t := s.trackers[prefix]
-	if t == nil {
-		t = &tracker{limiter: rate.NewLimiter(rate.Limit(float64(s.conf.Threshold)/s.conf.Window.Seconds()), s.conf.Threshold)}
-		s.trackers[prefix] = t
-	}
-	t.seen = now
-	if t.limiter.AllowN(now, weight) {
-		return // Within the strike budget, no breach
-	}
-	if !t.emitted.IsZero() && now.Sub(t.emitted) < s.conf.Window {
-		return // Already emitted this prefix within the window (one ban line per prefix per window)
-	}
-	t.emitted = now
-	s.pending = append(s.pending, formatBanLine(now, ip, prefix, httpCode, errorCode))
-}
-
-// prefix masks ip to the ban unit (PrefixBitsIPv4/IPv6) -- what fail2ban bans, e.g. a whole /64.
-func (s *Service) prefix(ip netip.Addr) netip.Prefix {
-	if ip.Is4() {
-		return netip.PrefixFrom(ip, s.conf.PrefixBitsIPv4).Masked()
-	}
-	return netip.PrefixFrom(ip, s.conf.PrefixBitsIPv6).Masked()
-}
-
-// formatBanLine builds the "<RFC3339-UTC> <ip> <prefix> <http> <ntfy>" line the fail2ban filter
-// parses. The timestamp is captured at breach time, not flush time.
-func formatBanLine(t time.Time, ip netip.Addr, prefix netip.Prefix, httpCode, errorCode int) string {
-	return fmt.Sprintf("%s %s %s %d %d\n", t.UTC().Format(time.RFC3339), ip.String(), prefix.String(), httpCode, errorCode)
-}
-
-// runPruneLoop prunes idle prefixes until Close.
-func (s *Service) runPruneLoop() {
-	ticker := time.NewTicker(pruneInterval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ticker.C:
-			s.prune()
-		case <-s.closeChan:
-			return
-		}
-	}
-}
-
-// runWriteLoop flushes buffered ban lines every writeInterval, plus a final flush on Close.
-func (s *Service) runWriteLoop() {
-	defer close(s.writeDone)
-	ticker := time.NewTicker(writeInterval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ticker.C:
-			s.flush()
-		case <-s.closeChan:
-			s.flush()
-			return
-		}
-	}
-}
-
-// flush appends the buffered lines to the file in one open/write. Best-effort: a batch is dropped on
-// error. Concurrent calls are safe -- pending is drained under mu, so only one flush writes a batch.
-func (s *Service) flush() {
-	s.mu.Lock()
-	lines := s.pending
-	s.pending = nil
-	s.mu.Unlock()
-	if len(lines) == 0 {
-		return
-	}
-	f, err := os.OpenFile(s.conf.File, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
-	if err != nil {
-		log.Tag(tag).Err(err).Warn("Cannot open ban file %s, dropped %d ban(s)", s.conf.File, len(lines))
-		return
-	}
-	defer f.Close()
-	for i, line := range lines {
-		if _, err := f.WriteString(line); err != nil {
-			log.Tag(tag).Err(err).Warn("Cannot write to ban file %s, dropped %d ban(s)", s.conf.File, len(lines)-i)
-			return
-		}
-	}
-}
-
-// prune drops prefixes idle for a full Window -- their bucket has refilled, so forgetting them is a
-// no-op that bounds memory under a flood of distinct IPs.
-func (s *Service) prune() {
-	now := time.Now()
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	for prefix, t := range s.trackers {
-		if now.Sub(t.seen) >= s.conf.Window {
-			delete(s.trackers, prefix)
-		}
-	}
-}
-
-// Close stops the loops and blocks until the final flush completes. Idempotent.
-func (s *Service) Close() {
-	s.closeOnce.Do(func() {
-		close(s.closeChan)
-		<-s.writeDone
-	})
-}

ban/service_test.go

@@ -1,253 +0,0 @@
-package ban
-
-import (
-	"net/netip"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-var testIP = netip.MustParseAddr("1.2.3.4")
-
-// newTestService creates a Service wired for testing, with the given ban file, weighted-bucket
-// threshold, and weights, plus a 1-minute window (so the emit throttle only fires once per test).
-func newTestService(t *testing.T, banFile string, threshold int, weights map[string]int) *Service {
-	t.Helper()
-	s := NewService(&Config{
-		File:           banFile,
-		Window:         time.Minute,
-		Threshold:      threshold,
-		Weights:        weights,
-		PrefixBitsIPv4: 32,
-		PrefixBitsIPv6: 64,
-	})
-	t.Cleanup(s.Close)
-	return s
-}
-
-// flushAndRead forces a synchronous flush of the buffered bans (writes are otherwise async, on the
-// runWriteLoop ticker) and returns the ban file's lines.
-func flushAndRead(t *testing.T, s *Service, path string) []string {
-	t.Helper()
-	s.flush()
-	data, err := os.ReadFile(path)
-	require.NoError(t, err)
-	return strings.Split(strings.TrimRight(string(data), "\n"), "\n")
-}
-
-func TestService_Record_Weight2BansAtHalfThreshold(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	// Threshold 10, code weight 2 -> the budget covers exactly 5 hits, so the 6th breaches.
-	s := newTestService(t, banFile, 10, map[string]int{"*": 2})
-	for i := 0; i < 5; i++ {
-		s.Record(testIP, 400, 40001)
-	}
-	s.flush()
-	require.NoFileExists(t, banFile) // 5 hits * weight 2 = 10 == budget, exactly at the limit, not over
-	s.Record(testIP, 400, 40001)     // 6th hit cannot be covered -> breach
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-	require.True(t, strings.HasSuffix(lines[0], " 1.2.3.4 1.2.3.4/32 400 40001")) // <ip> <prefix> <http> <ntfy-code>
-}
-
-func TestService_Record_Weight10BansFast(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	// Threshold 10, code weight 10 -> a single hit drains the whole budget, so the 2nd breaches.
-	s := newTestService(t, banFile, 10, map[string]int{"42909": 10, "*": 1})
-	s.Record(testIP, 429, 42909)
-	s.flush()
-	require.NoFileExists(t, banFile)
-	s.Record(testIP, 429, 42909) // 2nd hit cannot be covered -> breach
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-	require.True(t, strings.HasSuffix(lines[0], " 1.2.3.4 1.2.3.4/32 429 42909"))
-}
-
-func TestService_Record_Weight0NeverBans(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	// The legit-quota code is exempt (weight 0), so no number of hits ever bans.
-	s := newTestService(t, banFile, 10, map[string]int{"42908": 0, "*": 1})
-	for i := 0; i < 100; i++ {
-		s.Record(testIP, 429, 42908)
-	}
-	s.flush()
-	require.NoFileExists(t, banFile)
-}
-
-func TestService_Record_SingleBucketNoRelaxation(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	// One shared bucket per prefix: different codes draw down the SAME budget, so mixing them creates
-	// no extra headroom (unlike per-code buckets, which would relax the effective limit for a mixed
-	// offender).
-	s := newTestService(t, banFile, 10, map[string]int{"403*": 2, "*": 1})
-	s.Record(testIP, 403, 40301) // weight 2 -> 8 left
-	s.Record(testIP, 403, 40301) // weight 2 -> 6 left
-	s.Record(testIP, 403, 40301) // weight 2 -> 4 left
-	s.flush()
-	require.NoFileExists(t, banFile)
-	for i := 0; i < 4; i++ {
-		s.Record(testIP, 400, 40001) // weight 1 each -> drains the remaining 4 -> 0 left
-	}
-	s.flush()
-	require.NoFileExists(t, banFile) // 6 + 4 = 10 == budget exactly, still not over
-	s.Record(testIP, 400, 40001)     // one more cannot be covered -> breach
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-}
-
-func TestService_Record_ExactLineFormat(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 1, map[string]int{"*": 1})
-	before := time.Now().UTC().Truncate(time.Second)
-	for i := 0; i < 3; i++ {
-		s.Record(testIP, 429, 42901)
-	}
-	after := time.Now().UTC()
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-	parts := strings.Split(lines[0], " ")
-	require.Len(t, parts, 5) // "<timestamp> <ip> <prefix> <http-code> <ntfy-code>"
-	ts, err := time.Parse(time.RFC3339, parts[0])
-	require.NoError(t, err)
-	require.Equal(t, time.UTC, ts.Location())
-	require.False(t, ts.Before(before))
-	require.False(t, ts.After(after.Add(time.Second)))
-	require.Equal(t, "1.2.3.4", parts[1])    // full IP
-	require.Equal(t, "1.2.3.4/32", parts[2]) // masked to the default IPv4 prefix (/32)
-	require.Equal(t, "429", parts[3])        // HTTP status
-	require.Equal(t, "42901", parts[4])      // ntfy code
-}
-
-func TestService_Record_IPv6MaskedToPrefix(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 1, map[string]int{"*": 1})
-	ip := netip.MustParseAddr("2001:db8::abcd")
-	for i := 0; i < 3; i++ {
-		s.Record(ip, 429, 42901)
-	}
-	parts := strings.Split(flushAndRead(t, s, banFile)[0], " ")
-	require.Len(t, parts, 5)
-	require.Equal(t, "2001:db8::abcd", parts[1]) // full IPv6 address
-	require.Equal(t, "2001:db8::/64", parts[2])  // masked to the default IPv6 prefix (/64)
-}
-
-func TestService_Record_PerPrefixIsolation(t *testing.T) {
-	// Each source prefix gets its own bucket: one IP hammering to a breach must not push a different,
-	// quiet IP over the edge. This is the whole point of keying by prefix instead of by visitor.
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 2, map[string]int{"*": 1})
-	noisy := netip.MustParseAddr("1.1.1.1")
-	quiet := netip.MustParseAddr("2.2.2.2")
-	for i := 0; i < 5; i++ {
-		s.Record(noisy, 429, 42901) // breaches its own bucket
-	}
-	s.Record(quiet, 429, 42901) // single hit, well under threshold
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1) // only the noisy prefix is written
-	require.True(t, strings.HasSuffix(lines[0], " 1.1.1.1 1.1.1.1/32 429 42901"))
-}
-
-func TestService_Record_OncePerWindowThrottle(t *testing.T) {
-	// Once a prefix has been written, further breaches within the window must not re-append it, so a
-	// persistent offender produces exactly one line per window (mirrors the old per-visitor banEmit).
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 1, map[string]int{"*": 1})
-	for i := 0; i < 50; i++ {
-		s.Record(testIP, 429, 42901)
-	}
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-}
-
-func TestService_Record_BansPassedIP(t *testing.T) {
-	// The Service bans the exact IP passed to Record -- the caller passes the offending request's IP,
-	// which for an account-keyed visitor is not the visitor's stored IP.
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 1, map[string]int{"*": 1})
-	offender := netip.MustParseAddr("5.6.7.8")
-	for i := 0; i < 3; i++ {
-		s.Record(offender, 429, 42901)
-	}
-	parts := strings.Split(flushAndRead(t, s, banFile)[0], " ")
-	require.Equal(t, "5.6.7.8", parts[1])    // the IP passed to Record
-	require.Equal(t, "5.6.7.8/32", parts[2]) // its prefix
-}
-
-func TestService_Record_Ignores2xx3xx(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 3, map[string]int{"*": 1})
-	// Success and redirects must never count toward a ban, even over the threshold -- otherwise a
-	// legit high-volume publisher (lots of 200s) would get banned.
-	for i := 0; i < 20; i++ {
-		s.Record(testIP, 200, 20000)
-		s.Record(testIP, 302, 30000)
-	}
-	s.flush()
-	require.NoFileExists(t, banFile)
-	// A 4xx over the same budget still gets written.
-	for i := 0; i < 5; i++ {
-		s.Record(testIP, 400, 40001)
-	}
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-	require.True(t, strings.HasSuffix(lines[0], " 1.2.3.4 1.2.3.4/32 400 40001"))
-}
-
-func TestService_Record_BuffersUntilFlush(t *testing.T) {
-	// Writes are async: a breach buffers the ban line rather than writing it synchronously on the
-	// request path. The line only reaches the file when runWriteLoop (or an explicit flush) runs.
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 1, map[string]int{"*": 1})
-	for i := 0; i < 3; i++ {
-		s.Record(testIP, 429, 42901)
-	}
-	require.NoFileExists(t, banFile) // not written synchronously
-	s.mu.Lock()
-	require.Len(t, s.pending, 1) // one line buffered (throttled to once per window)
-	s.mu.Unlock()
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-	require.True(t, strings.HasSuffix(lines[0], " 1.2.3.4 1.2.3.4/32 429 42901"))
-}
-
-func TestService_Close_FlushesPending(t *testing.T) {
-	// Close must flush buffered bans so nothing is lost on shutdown, and must block until it has.
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := NewService(&Config{File: banFile, Window: time.Minute, Threshold: 1, Weights: Weights{"*": 1}, PrefixBitsIPv4: 32, PrefixBitsIPv6: 64})
-	for i := 0; i < 3; i++ {
-		s.Record(testIP, 429, 42901)
-	}
-	require.NoFileExists(t, banFile) // still buffered
-	s.Close()                        // blocks until the final flush completes
-	data, err := os.ReadFile(banFile)
-	require.NoError(t, err)
-	require.Len(t, strings.Split(strings.TrimRight(string(data), "\n"), "\n"), 1)
-}
-
-func TestService_Prune_DropsIdlePrefixes(t *testing.T) {
-	// A prefix idle for a full window has a refilled bucket, so prune drops it to bound memory. An
-	// active prefix (seen within the window) is kept.
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 10, map[string]int{"*": 1})
-	idle := netip.MustParseAddr("9.9.9.9")
-	s.Record(idle, 400, 40001)
-	s.Record(testIP, 400, 40001)
-	require.Len(t, s.trackers, 2)
-
-	// Backdate the idle prefix past the window, then prune.
-	idlePrefix := s.prefix(idle)
-	s.mu.Lock()
-	s.trackers[idlePrefix].seen = time.Now().Add(-2 * time.Minute)
-	s.mu.Unlock()
-	s.prune()
-
-	require.Len(t, s.trackers, 1)
-	_, ok := s.trackers[idlePrefix]
-	require.False(t, ok) // idle prefix dropped
-	_, ok = s.trackers[s.prefix(testIP)]
-	require.True(t, ok) // active prefix kept
-}

ban/weights.go

@@ -1,83 +0,0 @@
-package ban
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-)
-
-// Weights maps a matcher key to a strike weight for the abuse ban-feed (see ParseWeights, WeightFor).
-type Weights map[string]int
-
-// ParseWeights normalizes a list like ["42909:10","403:2","*:1"] into a Weights map. A key is an
-// exact ntfy code, a family ("429*"), a bare HTTP status ("403" -> "403*"), or "*"; weights are ints
-// >= 0 (0 = exempt). Malformed entries are rejected so misconfiguration fails at startup.
-func ParseWeights(entries []string) (Weights, error) {
-	out := make(Weights, len(entries))
-	for _, entry := range entries {
-		key, weightStr, ok := strings.Cut(entry, ":")
-		if !ok {
-			return nil, fmt.Errorf("invalid ban-weight %q, want KEY:WEIGHT", entry)
-		}
-		weight, err := strconv.Atoi(strings.TrimSpace(weightStr))
-		if err != nil || weight < 0 {
-			return nil, fmt.Errorf("invalid ban-weight value in %q, want a non-negative integer", entry)
-		}
-		key = strings.TrimSpace(key)
-		if !validWeightKey(key) {
-			return nil, fmt.Errorf("invalid ban-weight key in %q, want %q, an ntfy code, an HTTP status, or a PREFIX*", entry, "*")
-		}
-		// A bare 3-digit HTTP status is shorthand for the whole family (e.g. "403" -> "403*").
-		if len(key) == 3 && isAllDigits(key) {
-			key += "*"
-		}
-		out[key] = weight
-	}
-	return out, nil
-}
-
-// WeightFor returns the strike weight for an ntfy error code, longest-match-wins (exact > family > "*").
-// If nothing matches (no "*" catch-all) it returns the implied default 1, so a forgotten "*" still
-// bans; use "*:0" to exempt everything not explicitly weighted.
-func (w Weights) WeightFor(errorCode int) int {
-	code := strconv.Itoa(errorCode)
-	weight, bestLen, matched := 0, -1, false
-	for key, wt := range w {
-		matchLen := -1
-		switch {
-		case key == "*":
-			matchLen = 0
-		case strings.HasSuffix(key, "*"):
-			if prefix := strings.TrimSuffix(key, "*"); strings.HasPrefix(code, prefix) {
-				matchLen = len(prefix)
-			}
-		case key == code:
-			matchLen = len(code)
-		}
-		if matchLen > bestLen {
-			weight, bestLen, matched = wt, matchLen, true
-		}
-	}
-	if !matched {
-		return 1
-	}
-	return weight
-}
-
-// validWeightKey reports whether key is a legal matcher: "*", an all-digits code, or DIGITS*.
-func validWeightKey(key string) bool {
-	if key == "*" {
-		return true
-	}
-	digits := strings.TrimSuffix(key, "*")
-	return digits != "" && isAllDigits(digits)
-}
-
-func isAllDigits(s string) bool {
-	for _, r := range s {
-		if r < '0' || r > '9' {
-			return false
-		}
-	}
-	return s != ""
-}

ban/weights_test.go

@@ -1,73 +0,0 @@
-package ban
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestParseWeights(t *testing.T) {
-	// Exact codes, a bare 3-digit HTTP status (normalized to a family), an exempt code, and "*".
-	weights, err := ParseWeights([]string{"42909:10", "403:2", "42908:0", "*:1"})
-	require.NoError(t, err)
-	require.Equal(t, Weights{"42909": 10, "403*": 2, "42908": 0, "*": 1}, weights)
-
-	// A bare 3-digit HTTP status normalizes to its family.
-	weights, err = ParseWeights([]string{"429:5"})
-	require.NoError(t, err)
-	require.Equal(t, Weights{"429*": 5}, weights)
-
-	// An explicit family key stays as-is.
-	weights, err = ParseWeights([]string{"429*:5"})
-	require.NoError(t, err)
-	require.Equal(t, Weights{"429*": 5}, weights)
-
-	// Weight 0 is valid and means exempt.
-	weights, err = ParseWeights([]string{"42908:0"})
-	require.NoError(t, err)
-	require.Equal(t, Weights{"42908": 0}, weights)
-
-	_, err = ParseWeights([]string{"401"}) // Missing weight
-	require.Error(t, err)
-	_, err = ParseWeights([]string{"401:-1"}) // Negative weight
-	require.Error(t, err)
-	_, err = ParseWeights([]string{"401:abc"}) // Non-integer weight
-	require.Error(t, err)
-	_, err = ParseWeights([]string{"abc:10"}) // Non-numeric key
-	require.Error(t, err)
-	_, err = ParseWeights([]string{"4*3:10"}) // Star not at the end
-	require.Error(t, err)
-}
-
-func TestWeights_WeightFor(t *testing.T) {
-	weights, err := ParseWeights([]string{"42908:0", "42903:0", "42905:0", "42910:0", "42909:10", "429*:1", "403*:2", "4*:1", "5*:1"})
-	require.NoError(t, err)
-	// Longest-match-wins: exact 5-digit beats "429*" beats "4*" beats "*".
-	require.Equal(t, 0, weights.WeightFor(42908))
-	require.Equal(t, 10, weights.WeightFor(42909))
-	require.Equal(t, 1, weights.WeightFor(42901))
-	require.Equal(t, 2, weights.WeightFor(40311))
-	require.Equal(t, 1, weights.WeightFor(40011))
-	require.Equal(t, 1, weights.WeightFor(50312))
-	// No rule matches (this config has 4*/5* but no "*"), so the implied default weight 1 applies.
-	require.Equal(t, 1, weights.WeightFor(30012))
-}
-
-func TestWeights_WeightFor_NoStarRuleImpliesWeight1(t *testing.T) {
-	// With no "*" rule, a code that matches nothing defaults to weight 1 (can be banned), so the
-	// feature can't be silently turned into a no-op by forgetting "*". Explicit codes still win.
-	weights, err := ParseWeights([]string{"42908:0", "42909:10"})
-	require.NoError(t, err)
-	require.Equal(t, 0, weights.WeightFor(42908))  // explicitly exempt
-	require.Equal(t, 10, weights.WeightFor(42909)) // explicit
-	require.Equal(t, 1, weights.WeightFor(42901))  // unmatched -> implied 1
-	require.Equal(t, 1, weights.WeightFor(40001))  // unmatched -> implied 1
-}
-
-func TestWeights_WeightFor_ExplicitStarZeroExemptsAll(t *testing.T) {
-	// An explicit "*:0" is the opt-out: exempt everything not otherwise weighted.
-	weights, err := ParseWeights([]string{"42909:10", "*:0"})
-	require.NoError(t, err)
-	require.Equal(t, 10, weights.WeightFor(42909)) // explicit
-	require.Equal(t, 0, weights.WeightFor(42901))  // *:0 -> exempt everything else
-}

client/client.go

@@ -7,8 +7,8 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/log"
+	"heckel.io/ntfy/util"
 	"io"
 	"net/http"
 	"regexp"

client/client.yml

@@ -7,10 +7,7 @@
 
 # Default credentials will be used with "ntfy publish" and "ntfy subscribe" if no other credentials are provided.
 # You can set a default token to use or a default user:password combination, but not both. For an empty password,
-# use empty double-quotes ("").
-#
-# To override the default user:password combination or default token for a particular subscription (e.g., to send
-# no Authorization header), set the user:pass/token for the subscription to empty double-quotes ("").
+# use empty double-quotes ("")
 
 # default-token:
 
@@ -21,7 +18,7 @@
 # default-command:
 
 # Subscriptions to topics and their actions. This option is primarily used by the systemd service,
-# or if you can "ntfy subscribe --from-config" directly.
+# or if you cann "ntfy subscribe --from-config" directly.
 #
 # Example:
 #     subscribe:

client/client_test.go

@@ -3,9 +3,9 @@ package client_test
 import (
 	"fmt"
 	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/client"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/test"
+	"heckel.io/ntfy/client"
+	"heckel.io/ntfy/log"
+	"heckel.io/ntfy/test"
 	"os"
 	"testing"
 	"time"

client/config.go

@@ -2,7 +2,6 @@ package client
 
 import (
 	"gopkg.in/yaml.v2"
-	"heckel.io/ntfy/v2/log"
 	"os"
 )
 
@@ -11,9 +10,6 @@ const (
 	DefaultBaseURL = "https://ntfy.sh"
 )
 
-// DefaultConfigFile is the default path to the client config file (set in config_*.go)
-var DefaultConfigFile string
-
 // Config is the config struct for a Client
 type Config struct {
 	DefaultHost     string      `yaml:"default-host"`
@@ -27,9 +23,9 @@ type Config struct {
 // Subscribe is the struct for a Subscription within Config
 type Subscribe struct {
 	Topic    string            `yaml:"topic"`
-	User     *string           `yaml:"user"`
+	User     string            `yaml:"user"`
 	Password *string           `yaml:"password"`
-	Token    *string           `yaml:"token"`
+	Token    string            `yaml:"token"`
 	Command  string            `yaml:"command"`
 	If       map[string]string `yaml:"if"`
 }
@@ -48,7 +44,6 @@ func NewConfig() *Config {
 
 // LoadConfig loads the Client config from a yaml file
 func LoadConfig(filename string) (*Config, error) {
-	log.Debug("Loading client config from %s", filename)
 	b, err := os.ReadFile(filename)
 	if err != nil {
 		return nil, err

client/config_darwin.go

@@ -1,18 +0,0 @@
-//go:build darwin
-
-package client
-
-import (
-	"os"
-	"os/user"
-	"path/filepath"
-)
-
-func init() {
-	u, err := user.Current()
-	if err == nil && u.Uid == "0" {
-		DefaultConfigFile = "/etc/ntfy/client.yml"
-	} else if configDir, err := os.UserConfigDir(); err == nil {
-		DefaultConfigFile = filepath.Join(configDir, "ntfy", "client.yml")
-	}
-}

client/config_test.go

@@ -2,7 +2,7 @@ package client_test
 
 import (
 	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/client"
+	"heckel.io/ntfy/client"
 	"os"
 	"path/filepath"
 	"testing"
@@ -37,7 +37,7 @@ subscribe:
 	require.Equal(t, 4, len(conf.Subscribe))
 	require.Equal(t, "no-command-with-auth", conf.Subscribe[0].Topic)
 	require.Equal(t, "", conf.Subscribe[0].Command)
-	require.Equal(t, "phil", *conf.Subscribe[0].User)
+	require.Equal(t, "phil", conf.Subscribe[0].User)
 	require.Equal(t, "mypass", *conf.Subscribe[0].Password)
 	require.Equal(t, "echo-this", conf.Subscribe[1].Topic)
 	require.Equal(t, `echo "Message received: $message"`, conf.Subscribe[1].Command)
@@ -67,7 +67,7 @@ subscribe:
 	require.Equal(t, 1, len(conf.Subscribe))
 	require.Equal(t, "no-command-with-auth", conf.Subscribe[0].Topic)
 	require.Equal(t, "", conf.Subscribe[0].Command)
-	require.Equal(t, "phil", *conf.Subscribe[0].User)
+	require.Equal(t, "phil", conf.Subscribe[0].User)
 	require.Equal(t, "", *conf.Subscribe[0].Password)
 }
 
@@ -91,7 +91,7 @@ subscribe:
 	require.Equal(t, 1, len(conf.Subscribe))
 	require.Equal(t, "no-command-with-auth", conf.Subscribe[0].Topic)
 	require.Equal(t, "", conf.Subscribe[0].Command)
-	require.Equal(t, "phil", *conf.Subscribe[0].User)
+	require.Equal(t, "phil", conf.Subscribe[0].User)
 	require.Nil(t, conf.Subscribe[0].Password)
 }
 
@@ -113,7 +113,7 @@ subscribe:
 	require.Equal(t, 1, len(conf.Subscribe))
 	require.Equal(t, "no-command-with-auth", conf.Subscribe[0].Topic)
 	require.Equal(t, "", conf.Subscribe[0].Command)
-	require.Equal(t, "phil", *conf.Subscribe[0].User)
+	require.Equal(t, "phil", conf.Subscribe[0].User)
 	require.Nil(t, conf.Subscribe[0].Password)
 }
 
@@ -134,7 +134,7 @@ subscribe:
 	require.Equal(t, "tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", conf.DefaultToken)
 	require.Equal(t, 1, len(conf.Subscribe))
 	require.Equal(t, "mytopic", conf.Subscribe[0].Topic)
-	require.Nil(t, conf.Subscribe[0].User)
+	require.Equal(t, "", conf.Subscribe[0].User)
 	require.Nil(t, conf.Subscribe[0].Password)
-	require.Nil(t, conf.Subscribe[0].Token)
+	require.Equal(t, "", conf.Subscribe[0].Token)
 }

client/config_unix.go

@@ -1,18 +0,0 @@
-//go:build linux || dragonfly || freebsd || netbsd || openbsd
-
-package client
-
-import (
-	"os"
-	"os/user"
-	"path/filepath"
-)
-
-func init() {
-	u, err := user.Current()
-	if err == nil && u.Uid == "0" {
-		DefaultConfigFile = "/etc/ntfy/client.yml"
-	} else if configDir, err := os.UserConfigDir(); err == nil {
-		DefaultConfigFile = filepath.Join(configDir, "ntfy", "client.yml")
-	}
-}

client/config_windows.go

@@ -1,14 +0,0 @@
-//go:build windows
-
-package client
-
-import (
-	"os"
-	"path/filepath"
-)
-
-func init() {
-	if configDir, err := os.UserConfigDir(); err == nil {
-		DefaultConfigFile = filepath.Join(configDir, "ntfy", "client.yml")
-	}
-}

client/options.go

@@ -2,7 +2,7 @@ package client
 
 import (
 	"fmt"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/util"
 	"net/http"
 	"strings"
 	"time"
@@ -77,22 +77,11 @@ func WithMarkdown() PublishOption {
 	return WithHeader("X-Markdown", "yes")
 }
 
-// WithTemplate instructs the server to use a specific template for the message. If templateName is is "yes" or "1",
-// the server will interpret the message and title as a template.
-func WithTemplate(templateName string) PublishOption {
-	return WithHeader("X-Template", templateName)
-}
-
 // WithFilename sets a filename for the attachment, and/or forces the HTTP body to interpreted as an attachment
 func WithFilename(filename string) PublishOption {
 	return WithHeader("X-Filename", filename)
 }
 
-// WithSequenceID sets a sequence ID for the message, allowing updates to existing notifications
-func WithSequenceID(sequenceID string) PublishOption {
-	return WithHeader("X-Sequence-ID", sequenceID)
-}
-
 // WithEmail instructs the server to also send the message to the given e-mail address
 func WithEmail(email string) PublishOption {
 	return WithHeader("X-Email", email)
@@ -108,11 +97,6 @@ func WithBearerAuth(token string) PublishOption {
 	return WithHeader("Authorization", fmt.Sprintf("Bearer %s", token))
 }
 
-// WithEmptyAuth clears the Authorization header
-func WithEmptyAuth() PublishOption {
-	return RemoveHeader("Authorization")
-}
-
 // WithNoCache instructs the server not to cache the message server-side
 func WithNoCache() PublishOption {
 	return WithHeader("X-Cache", "no")
@@ -203,13 +187,3 @@ func WithQueryParam(param, value string) RequestOption {
 		return nil
 	}
 }
-
-// RemoveHeader is a generic option to remove a header from a request
-func RemoveHeader(header string) RequestOption {
-	return func(r *http.Request) error {
-		if header != "" {
-			delete(r.Header, header)
-		}
-		return nil
-	}
-}

client/user/ntfy-client.service

@@ -1,10 +0,0 @@
-[Unit]
-Description=ntfy client
-After=network.target
-
-[Service]
-ExecStart=/usr/bin/ntfy subscribe --config "%h/.config/ntfy/client.yml" --from-config
-Restart=on-failure
-
-[Install]
-WantedBy=default.target

cluster/cluster.go

@@ -1,113 +0,0 @@
-// Package cluster implements cross-node message delivery for a multi-node ntfy cluster. Nodes
-// register themselves in a PostgreSQL node registry (control plane) and fan published messages
-// out to each other directly over HTTP (data plane); PostgreSQL is never on the message path.
-// The single-node default is the nop cluster, which does nothing.
-package cluster
-
-import (
-	"errors"
-	"net/http"
-	"time"
-
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/model"
-)
-
-// The internal peer API: every kind of node-to-node communication is a path under
-// /v1/internal/, served only on the dedicated cluster listener. Future concerns (rate limit
-// counters, stats) become new paths or new sections of the state envelope.
-const (
-	// MessagePath receives batches of published messages (NDJSON, one apiMessage per line).
-	MessagePath = "/v1/internal/message"
-	// StatePath receives peer state (JSON apiState): full subscription snapshots and
-	// incremental updates.
-	StatePath = "/v1/internal/state"
-)
-
-// NodeID identifies a cluster node; it keys the registry, the per-peer queues, and the peer
-// state table.
-//
-// Naming convention: a "node" is any cluster member in the absolute sense (identity, registry,
-// config); a "peer" is another node as seen from this one (Peers, peerQueue, peerState). A peer
-// IS a node, which is why peer values carry a NodeID.
-type NodeID string
-
-const (
-	// secretHeader carries the shared secret authenticating node-to-node fan-out requests.
-	secretHeader = "X-Cluster-Secret"
-
-	// originHeader carries the sending node's ID on fan-out requests, so a node can skip
-	// requests that carry its own broadcasts (loop prevention).
-	originHeader = "X-Cluster-Origin"
-)
-
-// Content types of the peer API: message bodies are NDJSON (one JSON message per line, matching
-// the framing of ntfy's own /topic/json subscribe stream), state bodies are plain JSON. Future
-// node-to-node request types get their own paths on the cluster listener; an old node answering
-// 404 on an unknown path keeps mixed-version clusters working during rolling deploys.
-const (
-	contentTypeNDJSON = "application/x-ndjson"
-	contentTypeJSON   = "application/json"
-)
-
-const (
-	defaultHeartbeatInterval = 3 * time.Second  // How often a node refreshes its registry heartbeat
-	defaultNodeTTL           = 30 * time.Second // A node counts as live if its heartbeat is newer than this; generous to avoid false-dead flapping (see plans)
-	defaultStateInterval     = 15 * time.Second // How often the full subscription state is pushed to peers
-
-	// DefaultBatchLinger is how long a fan-out message may wait in a peer's queue for more
-	// messages to arrive, so they are delivered as one batch. It trades up to this much
-	// cross-node latency for a bounded request rate per peer.
-	DefaultBatchLinger = 500 * time.Millisecond
-)
-
-// Cluster fans published messages out to peer cluster nodes and receives their fan-out requests.
-// Local delivery to a node's own subscribers still happens inline in the server; the cluster
-// only covers the cross-node hop.
-type Cluster interface {
-	http.Handler
-	// ForwardMessage sends a locally published message on to the peer nodes that may have subscribers
-	// for its topic (all of them, when subscription knowledge is missing or stale). It is
-	// fire-and-forget and must not block the caller's request path.
-	ForwardMessage(m *model.Message) error
-	// BroadcastState pushes a subscription-state delta to ALL peers (unlike ForwardMessage,
-	// which routes), closing the routing-knowledge window to ~one round trip. Nop single-node.
-	BroadcastState(state *State)
-	// IsLeader reports whether this node holds the cluster leader lock. Singleton background
-	// jobs (e.g. the Firebase keepaliver) are gated on the leader.
-	IsLeader() bool
-	// Healthy reports whether this node is fit to serve: its registry heartbeat is fresh
-	// enough (within NodeTTL) that peers still forward messages to it. Health checkers must
-	// fail open (never pull ALL nodes): during a full database outage every node reports
-	// unhealthy while the mesh keeps delivering on stale peer caches.
-	Healthy() bool
-	// Close stops the cluster and releases its resources.
-	Close() error
-}
-
-// New creates the cluster for the given config: the nop cluster when clustering is disabled (the
-// single-node default), or the peer-mesh cluster otherwise.
-func New(conf *Config, pool *db.DB, deliver DeliverFunc, topics TopicsFunc) (Cluster, error) {
-	if !conf.Enabled {
-		return &nopCluster{}, nil
-	}
-	if pool == nil {
-		return nil, errors.New("cluster mode requires a PostgreSQL database (set database-url)")
-	}
-	if conf.AdvertiseURL == "" {
-		return nil, errors.New("cluster mode requires an advertise URL (set cluster-advertise-url)")
-	}
-	if conf.NodeID == "" {
-		return nil, errors.New("cluster mode requires a stable node ID (set cluster-node-id)")
-	}
-	if conf.HeartbeatInterval == 0 {
-		conf.HeartbeatInterval = defaultHeartbeatInterval
-	}
-	if conf.NodeTTL == 0 {
-		conf.NodeTTL = defaultNodeTTL
-	}
-	if conf.StateInterval == 0 {
-		conf.StateInterval = defaultStateInterval
-	}
-	return newMeshCluster(conf, pool, deliver, topics)
-}

cluster/cluster_load_test.go

@@ -1,133 +0,0 @@
-package cluster
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	dbtest "heckel.io/ntfy/v2/db/test"
-	"heckel.io/ntfy/v2/model"
-)
-
-// TestMesh_Soak floods the mesh with concurrent publishers and asserts exact delivery: every
-// message reaches the peer exactly once, nothing is dropped, and batching keeps the request
-// count far below the message count. Skipped unless NTFY_TEST_SOAK is set (it takes a few
-// seconds and is meant for pre-deploy verification, not the regular suite).
-func TestMesh_Soak(t *testing.T) {
-	if os.Getenv("NTFY_TEST_SOAK") == "" {
-		t.Skip("NTFY_TEST_SOAK not set")
-	}
-	// ~1000 msg/s aggregate (10x the ntfy.sh peak of ~88 msg/s): each publisher paces itself to
-	// 100 msg/s. Unthrottled publishing intentionally overruns the bounded per-peer queue (load
-	// shedding by design), so a zero-drop assertion only holds below the drain ceiling.
-	const (
-		publishers           = 10
-		messagesPerPublisher = 300
-		publishInterval      = 10 * time.Millisecond
-		total                = publishers * messagesPerPublisher
-	)
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	received := make(map[string]int, total) // message body -> count, to catch duplicates
-	requests := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		require.Nil(t, err)
-		messages, err := unmarshalMessageBody(body, 1<<20)
-		require.Nil(t, err)
-		mu.Lock()
-		requests++
-		for _, m := range messages {
-			received[m.Message]++
-		}
-		mu.Unlock()
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-	conf := newTestMeshConfig("node-a", "http://127.0.0.1:1")
-	conf.BatchLinger = 50 * time.Millisecond
-	conf.NodeTTL = time.Minute // The fake peer never heartbeats; liveness is not under test here
-	registerFakePeer(t, pool, "node-peer", srv.URL)
-	mesh, err := newMeshCluster(conf, pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	start := time.Now()
-	var wg sync.WaitGroup
-	for p := 0; p < publishers; p++ {
-		wg.Add(1)
-		go func(p int) {
-			defer wg.Done()
-			ticker := time.NewTicker(publishInterval)
-			defer ticker.Stop()
-			for i := 0; i < messagesPerPublisher; i++ {
-				require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", fmt.Sprintf("p%d-m%d", p, i))))
-				<-ticker.C
-			}
-		}(p)
-	}
-	wg.Wait()
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return len(received) == total
-	})
-	elapsed := time.Since(start)
-	mu.Lock()
-	defer mu.Unlock()
-	for body, count := range received {
-		require.Equalf(t, 1, count, "message %s delivered %d times", body, count)
-	}
-	require.Less(t, requests, total/10, "expected strong batching under load")
-	t.Logf("soak: %d messages, %d requests (%.1f msgs/request), %.0f msgs/s",
-		total, requests, float64(total)/float64(requests), float64(total)/elapsed.Seconds())
-}
-
-// BenchmarkForwardMessage measures the publish-path cost of ForwardMessage: marshal + peer lookup (cached)
-// + enqueue. The peer never drains, so enqueued fragments are dropped once the queue fills;
-// the benchmark measures the hot path, not HTTP delivery.
-func BenchmarkForwardMessage(b *testing.B) {
-	if os.Getenv("NTFY_TEST_DATABASE_URL") == "" {
-		b.Skip("NTFY_TEST_DATABASE_URL not set")
-	}
-	schemaDSN := dbtest.CreateTestPostgresSchema(b)
-	pool := openTestPool(b, schemaDSN)
-	conf := newTestMeshConfig("node-a", "http://127.0.0.1:1")
-	conf.BatchLinger = time.Minute // Never flush; we measure enqueue only
-	mesh, err := newMeshCluster(conf, pool, nil, nil)
-	require.Nil(b, err)
-	defer mesh.Close()
-	registerFakePeer(b, pool, "node-peer", "http://127.0.0.1:1")
-	m := model.NewDefaultMessage("mytopic", "benchmark message body of typical size for a push")
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if err := mesh.ForwardMessage(m); err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-// BenchmarkDecodeFanout measures the receive-path cost of decoding a 100-message NDJSON body.
-func BenchmarkDecodeFanout(b *testing.B) {
-	frags := make([][]byte, 100)
-	for i := range frags {
-		frag, err := marshalMessage(model.NewDefaultMessage("mytopic", fmt.Sprintf("benchmark message %d", i)))
-		require.Nil(b, err)
-		frags[i] = frag
-	}
-	body := assembleMessageBody(frags)
-	b.SetBytes(int64(len(body)))
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		messages, err := unmarshalMessageBody(body, 1<<20)
-		if err != nil || len(messages) != 100 {
-			b.Fatal("decode failed")
-		}
-	}
-}

cluster/cluster_mesh.go

@@ -1,498 +0,0 @@
-package cluster
-
-import (
-	"bytes"
-	"context"
-	"crypto/subtle"
-	"encoding/json"
-	"io"
-	"net/http"
-	"sync"
-	"time"
-
-	"heckel.io/ntfy/v2/cluster/registry"
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/db/pg"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/metrics"
-	"heckel.io/ntfy/v2/model"
-	"heckel.io/ntfy/v2/util"
-)
-
-const (
-	meshHTTPTimeout   = 5 * time.Second
-	peerQueueSize     = 1024            // Bounded per-peer fan-out queue (drop on overflow)
-	batchMaxMessages  = 100             // Flush a batch early when it reaches this many messages
-	batchMaxBytes     = 256 * 1024      // Flush a batch early when it reaches this size
-	stateMaxBytes     = 4 * 1024 * 1024 // Upper bound for inbound state bodies (filter over ~1M topics)
-	stateFilterFPRate = 0.01            // Bloom false-positive rate; a false positive is one wasted send
-	tag               = "cluster"
-)
-
-// meshCluster fans messages out directly to peer nodes over HTTP (the data plane), using
-// PostgreSQL only as a control plane: the node_registry table for membership/discovery, and a
-// Postgres advisory lock for singleton-job leader election. Fan-out never touches the database on
-// the message path (only the cached peer list does). See plans/260715-scale-out-mesh.md.
-//
-// Each peer has its own bounded send queue and delivery worker, so a slow or wedged peer only
-// backs up (and eventually drops) its own queue and never delays delivery to healthy peers.
-type meshCluster struct {
-	conf           *Config
-	deliver        DeliverFunc
-	topics         TopicsFunc
-	registry       *registry.Registry
-	leader         *pg.Leader
-	httpClient     *http.Client
-	mux            *http.ServeMux        // The internal peer API; Cluster is an http.Handler
-	queues         map[NodeID]*peerQueue // per-peer send queues; reconciled against the registry
-	closed         bool                  // Guards against ForwardMessage spawning new workers after Close
-	states         map[NodeID]*peerState // what each peer last told us (subscription knowledge)
-	lastStatePush  time.Time             // Only touched by the heartbeat goroutine
-	knownPeers     map[NodeID]string     // Peers seen in the last reconcile, for join/leave logging
-	lastRegistered time.Time             // Last successful registry heartbeat, for Healthy
-	ctx            context.Context
-	cancel         context.CancelFunc
-	wg             sync.WaitGroup
-	mu             sync.Mutex // Protects queues, closed, knownPeers and lastRegistered
-	statesMu       sync.Mutex // Protects states
-}
-
-// newMeshCluster creates the mesh cluster: it sets up the registry schema, registers this node
-// (synchronously, so it is discoverable before New returns), and starts the heartbeat loop.
-// Peer delivery workers are started lazily as peers appear in the registry.
-func newMeshCluster(conf *Config, pool *db.DB, deliver DeliverFunc, topics TopicsFunc) (*meshCluster, error) {
-	if topics == nil {
-		topics = func() []string { return nil } // No known topics; peers will broadcast to us
-	}
-	reg, err := registry.New(pool, string(conf.NodeID), conf.AdvertiseURL, conf.NodeTTL)
-	if err != nil {
-		return nil, err
-	}
-	// Register synchronously so the node is discoverable before the constructor returns; the
-	// heartbeat loop refreshes the registration from here on
-	if err := reg.Register(); err != nil {
-		return nil, err
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	c := &meshCluster{
-		conf:     conf,
-		deliver:  deliver,
-		topics:   topics,
-		registry: reg,
-		// Renews its lease on its own fixed cadence; see pg.Leader for the semantics
-		leader:         pg.NewLeader(pool.Primary(), pg.LeaderLockKey, conf.LeaderRenewInterval),
-		httpClient:     &http.Client{Timeout: meshHTTPTimeout},
-		queues:         make(map[NodeID]*peerQueue),
-		lastRegistered: time.Now(), // The synchronous Register above just succeeded
-		states:         make(map[NodeID]*peerState),
-		knownPeers:     make(map[NodeID]string),
-		ctx:            ctx,
-		cancel:         cancel,
-	}
-	c.mux = http.NewServeMux()
-	c.mux.HandleFunc("POST "+MessagePath, c.authenticated(c.handleMessage))
-	c.mux.HandleFunc("POST "+StatePath, c.authenticated(c.handleState))
-	c.wg.Add(1)
-	go c.heartbeatLoop()
-	return c, nil
-}
-
-// ServeHTTP serves the internal peer API. Auth lives in the authenticated middleware, so every
-// endpoint gets the same shared-secret and origin handling.
-func (c *meshCluster) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	c.mux.ServeHTTP(w, r)
-}
-
-// authenticated wraps a peer API handler with the checks every endpoint needs: the shared
-// secret (constant-time compare, rejected before any body is read), a present origin, and the
-// origin self-skip (a request carrying this node's own traffic is acknowledged but ignored).
-func (c *meshCluster) authenticated(h func(origin NodeID, w http.ResponseWriter, r *http.Request)) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		if c.conf.Secret == "" || subtle.ConstantTimeCompare([]byte(r.Header.Get(secretHeader)), []byte(c.conf.Secret)) != 1 {
-			w.WriteHeader(http.StatusUnauthorized)
-			return
-		}
-		origin := NodeID(r.Header.Get(originHeader))
-		if origin == "" {
-			w.WriteHeader(http.StatusBadRequest)
-			return
-		}
-		if origin == c.conf.NodeID {
-			w.WriteHeader(http.StatusOK) // Our own traffic; nothing to do
-			return
-		}
-		h(origin, w, r)
-	}
-}
-
-// heartbeatLoop runs one heartbeat immediately (the ticker first fires a full interval after
-// startup, and a fresh node should be leader-capable and state-visible right away), then one per
-// interval until shutdown.
-func (c *meshCluster) heartbeatLoop() {
-	defer c.wg.Done()
-	ticker := time.NewTicker(c.conf.HeartbeatInterval)
-	defer ticker.Stop()
-	if err := c.heartbeat(); err != nil {
-		log.Tag(tag).Err(err).Warn("Cluster heartbeat failed")
-	}
-	for {
-		select {
-		case <-c.ctx.Done():
-			return
-		case <-ticker.C:
-			if err := c.heartbeat(); err != nil {
-				log.Tag(tag).Err(err).Warn("Cluster heartbeat failed")
-			}
-		}
-	}
-}
-
-// heartbeat is one control-plane tick: refresh this node's registry row, retry/confirm the
-// leader lock, prune long-dead registry rows (as leader), reconcile the per-peer queues, and
-// periodically push our subscription state to peers.
-//
-// A node that cannot even register itself aborts the tick: the remaining database work would
-// fail against the same database, and everything downstream degrades safely without it -- ForwardMessage
-// serves the stale peer cache on its own, and peers fall back to broadcasting to us once our
-// last pushed state expires.
-func (c *meshCluster) heartbeat() error {
-	if err := c.registry.Register(); err != nil {
-		return err
-	}
-	c.mu.Lock()
-	c.lastRegistered = time.Now()
-	c.mu.Unlock()
-	// Effective leadership: pg.Leader's lease semantics guarantee a no-leader gap on
-	// failover, never two leaders
-	if c.leader.IsLeader() {
-		metrics.ClusterLeader.Set(1)
-		if err := c.registry.Prune(); err != nil {
-			log.Tag(tag).Err(err).Warn("Failed to prune stale nodes") // Housekeeping only; not fatal for the tick
-		}
-	} else {
-		metrics.ClusterLeader.Set(0)
-	}
-	peers, err := c.registry.Peers()
-	if err != nil {
-		return err
-	}
-	c.reconcilePeers(peers)
-	if time.Since(c.lastStatePush) >= c.conf.StateInterval {
-		c.pushState(peers)
-		c.lastStatePush = time.Now()
-	}
-	return nil
-}
-
-// reconcilePeers aligns this node's per-peer attachments with the live peer set: it retires the
-// queues (and workers) of peers that have left the registry or re-registered under a new
-// advertise URL (the retired queue's remainder was headed for a dead address anyway), and prunes
-// the stale state of departed peers. New and replacement queues are created lazily by ForwardMessage, not
-// here, so a freshly joined peer is reachable immediately.
-func (c *meshCluster) reconcilePeers(peers []*registry.Peer) {
-	metrics.ClusterPeers.Set(float64(len(peers)))
-	alive := make(map[NodeID]string, len(peers)) // node ID -> advertise URL
-	for _, p := range peers {
-		alive[NodeID(p.NodeID)] = p.AdvertiseURL
-	}
-	c.mu.Lock()
-	// Log joins and leaves (as seen through the up-to-NodeTTL-stale registry view)
-	for nodeID, url := range alive {
-		if _, ok := c.knownPeers[nodeID]; !ok {
-			log.Tag(tag).Info("Peer %s (%s) joined the cluster", nodeID, url)
-		}
-	}
-	for nodeID := range c.knownPeers {
-		if _, ok := alive[nodeID]; !ok {
-			log.Tag(tag).Info("Peer %s left the cluster", nodeID)
-		}
-	}
-	c.knownPeers = alive
-	for nodeID, q := range c.queues {
-		if url, ok := alive[nodeID]; !ok || q.advertiseURL != url {
-			q.queue.Close() // Flushes the remainder; the worker exits when the queue is drained
-			delete(c.queues, nodeID)
-		}
-	}
-	c.mu.Unlock()
-	// Prune the state of departed peers, but only once stale: state is push-driven and can
-	// arrive before a new peer is visible in the (up to NodeTTL stale) registry view, so fresh
-	// state must survive even when its peer is not in the live set. Without this, the states of
-	// long-gone nodes would accumulate forever.
-	c.statesMu.Lock()
-	for nodeID, state := range c.states {
-		if _, ok := alive[nodeID]; !ok && time.Since(state.updatedAt) > 3*c.conf.StateInterval {
-			delete(c.states, nodeID)
-		}
-	}
-	c.statesMu.Unlock()
-}
-
-// queueFor returns the send queue for the given peer, creating it (and its delivery worker) if it
-// does not exist yet. The caller must hold c.mu.
-func (c *meshCluster) queueFor(p *registry.Peer) *peerQueue {
-	nodeID := NodeID(p.NodeID)
-	q, ok := c.queues[nodeID]
-	if ok {
-		return q
-	}
-	q = &peerQueue{
-		advertiseURL: p.AdvertiseURL,
-		queue: util.NewLingerQueue(peerQueueSize, batchMaxMessages, batchMaxBytes,
-			func(frag []byte) int { return len(frag) }, c.conf.BatchLinger),
-	}
-	c.queues[nodeID] = q
-	c.wg.Add(1)
-	go c.peerWorker(nodeID, q)
-	return q
-}
-
-// ForwardMessage enqueues the message for delivery to every live peer node that may have subscribers for
-// its topic (all of them, absent fresh knowledge). Delivery is fire-and-forget via each peer's
-// bounded batching queue; if a peer's queue is full the message is dropped for that peer
-// (subscribers reconnect and re-poll history from the database).
-func (c *meshCluster) ForwardMessage(msg *model.Message) error {
-	peers, err := c.registry.Peers()
-	if err != nil {
-		return err
-	}
-	if len(peers) == 0 {
-		return nil // Cluster of one; skip the marshal
-	}
-	frag, err := marshalMessage(msg)
-	if err != nil {
-		return err
-	}
-	metrics.ClusterMessagesForwarded.Inc()
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	if c.closed {
-		return nil // Shutting down; the message is dropped like any other in-flight fan-out
-	}
-	for _, p := range peers {
-		// Route around peers whose fresh state provably excludes this topic; anything less
-		// certain (no state, stale state) falls back to broadcasting
-		if !c.mayNeed(NodeID(p.NodeID), msg.Topic) {
-			metrics.ClusterRouteSkipped.Inc()
-			if ev := log.Tag(tag); ev.IsTrace() {
-				ev.Trace("Skipping peer %s for message %s: no subscribers for topic %s", p.NodeID, msg.ID, msg.Topic)
-			}
-			continue
-		}
-		if !c.queueFor(p).queue.TryEnqueue(frag) {
-			metrics.ClusterQueueDropped.Inc()
-			log.Tag(tag).Warn("Fan-out queue for peer %s full, dropping message %s", p.NodeID, msg.ID)
-		} else if ev := log.Tag(tag); ev.IsTrace() {
-			ev.Trace("Enqueued message %s (topic %s) for peer %s", msg.ID, msg.Topic, p.NodeID)
-		}
-	}
-	return nil
-}
-
-// mayNeed reports whether the peer may have a subscriber for the topic. Conservative by
-// construction: it returns false only when a fresh state snapshot provably excludes the topic.
-// A false positive costs one wasted send; a false negative would lose a message and cannot
-// happen for topics a peer has reported (Bloom filters have no false negatives).
-func (c *meshCluster) mayNeed(peer NodeID, topic string) bool {
-	c.statesMu.Lock()
-	defer c.statesMu.Unlock()
-	state, ok := c.states[peer]
-	if !ok || time.Since(state.updatedAt) > 3*c.conf.StateInterval {
-		return true // No knowledge, or too old to trust for skipping
-	}
-	return state.topics.Contains(topic)
-}
-
-// peerWorker delivers batches of queued fan-out messages to a single peer. Batches form in the
-// peer's LingerQueue (up to BatchLinger delay, flushed early on size/count caps); the worker
-// exits when the queue is closed (peer left the registry, or mesh shutdown) and drained.
-func (c *meshCluster) peerWorker(nodeID NodeID, q *peerQueue) {
-	defer c.wg.Done()
-	for frags := range q.queue.Dequeue() {
-		body := assembleMessageBody(frags)
-		log.Tag(tag).Debug("Sending batch of %d message(s) (%d bytes) to peer %s", len(frags), len(body), nodeID)
-		c.postToPeer(nodeID, messageURL(q.advertiseURL), contentTypeNDJSON, body)
-		metrics.ClusterBatchesSent.Inc()
-	}
-}
-
-// postToPeer POSTs a peer API payload, authenticated with the shared cluster secret. Failures
-// are logged and counted, never retried: peer traffic is best-effort by design (messages are
-// recovered via since= replay, state via the next periodic push).
-func (c *meshCluster) postToPeer(nodeID NodeID, url, contentType string, payload []byte) {
-	req, err := http.NewRequestWithContext(c.ctx, http.MethodPost, url, bytes.NewReader(payload))
-	if err != nil {
-		metrics.ClusterSendErrors.Inc()
-		log.Tag(tag).Err(err).Warn("Failed to build request for peer %s", nodeID)
-		return
-	}
-	req.Header.Set("Content-Type", contentType)
-	req.Header.Set(secretHeader, c.conf.Secret)
-	req.Header.Set(originHeader, string(c.conf.NodeID))
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		if c.ctx.Err() == nil {
-			metrics.ClusterSendErrors.Inc()
-			log.Tag(tag).Err(err).Warn("Failed to send to peer %s (%s)", nodeID, url)
-		}
-		return
-	}
-	resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		metrics.ClusterSendErrors.Inc()
-		log.Tag(tag).Warn("Peer %s (%s) rejected request with HTTP %d", nodeID, url, resp.StatusCode)
-	}
-}
-
-// handleMessage receives a batch of peer messages (NDJSON) and streams them to local
-// subscribers line by line, delivering each message as it is decoded.
-func (c *meshCluster) handleMessage(origin NodeID, w http.ResponseWriter, r *http.Request) {
-	// A batch can exceed its byte cap by one message, plus framing overhead
-	maxBodyBytes := int64(batchMaxBytes) + c.conf.MaxMessageBytes + 1024
-	received := 0
-	deliver := func(m *model.Message) {
-		received++
-		if ev := log.Tag(tag); ev.IsTrace() {
-			ev.Trace("Delivering message %s (topic %s) from peer %s", m.ID, m.Topic, origin)
-		}
-		c.deliver(m)
-	}
-	if err := decodeMessageBody(io.LimitReader(r.Body, maxBodyBytes), int(c.conf.MaxMessageBytes), deliver); err != nil {
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-	log.Tag(tag).Debug("Received batch of %d message(s) from peer %s", received, origin)
-	w.WriteHeader(http.StatusOK)
-}
-
-// handleState receives a peer's state envelope and applies each section it carries.
-func (c *meshCluster) handleState(origin NodeID, w http.ResponseWriter, r *http.Request) {
-	body, err := io.ReadAll(io.LimitReader(r.Body, stateMaxBytes))
-	if err != nil {
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-	var state apiState
-	if err := json.Unmarshal(body, &state); err != nil {
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-	if state.Topics != nil {
-		if err := c.applyTopicState(origin, state.Topics); err != nil {
-			w.WriteHeader(http.StatusBadRequest)
-			return
-		}
-	}
-	w.WriteHeader(http.StatusOK)
-}
-
-// applyTopicState updates what we know about a peer's subscriptions: a full snapshot replaces
-// all prior knowledge, an incremental add merges into it. Increments without a baseline are
-// ignored on purpose -- without a snapshot the peer is broadcast to anyway.
-func (c *meshCluster) applyTopicState(origin NodeID, topics *apiStateTopics) error {
-	c.statesMu.Lock()
-	defer c.statesMu.Unlock()
-	if len(topics.Filter) > 0 {
-		filter, err := util.UnmarshalBloomFilter(topics.Filter)
-		if err != nil {
-			return err
-		}
-		c.states[origin] = &peerState{topics: filter, updatedAt: time.Now()}
-		log.Tag(tag).Debug("Received subscription state from peer %s (%d filter bytes)", origin, len(topics.Filter))
-		return nil
-	}
-	if state, ok := c.states[origin]; ok {
-		for _, topic := range topics.Added {
-			state.topics.Add(topic)
-		}
-		state.updatedAt = time.Now()
-		log.Tag(tag).Debug("Received %d announced topic(s) from peer %s", len(topics.Added), origin)
-	}
-	return nil
-}
-
-// pushState sends a full state snapshot to every live peer: a Bloom filter over the topics that
-// currently have local subscribers. Sent directly (not via the linger queues -- state must not
-// wait behind message batches); a lost push self-heals at the next interval. Topics without
-// subscribers disappear simply by not being in the next snapshot.
-func (c *meshCluster) pushState(peers []*registry.Peer) {
-	if len(peers) == 0 {
-		return
-	}
-	topics := c.topics()
-	filter := util.NewBloomFilter(len(topics), stateFilterFPRate)
-	for _, topic := range topics {
-		filter.Add(topic)
-	}
-	data, err := filter.MarshalBinary()
-	if err != nil {
-		return
-	}
-	body, err := json.Marshal(&apiState{Topics: &apiStateTopics{Filter: data}})
-	if err != nil {
-		return
-	}
-	log.Tag(tag).Debug("Pushing subscription state (%d topics, %d bytes) to %d peer(s)", len(topics), len(body), len(peers))
-	for _, p := range peers {
-		go c.postToPeer(NodeID(p.NodeID), stateURL(p.AdvertiseURL), contentTypeJSON, body)
-	}
-	metrics.ClusterStatePushes.Inc()
-}
-
-// BroadcastState immediately tells all live peers that these topics gained their first local
-// subscriber, shrinking the window in which a publisher could wrongly skip this node from a
-// full state interval down to about one round trip.
-func (c *meshCluster) BroadcastState(state *State) {
-	if len(state.AddedTopics) == 0 {
-		return
-	}
-	peers, err := c.registry.Peers()
-	if err != nil || len(peers) == 0 {
-		return
-	}
-	body, err := json.Marshal(&apiState{Topics: &apiStateTopics{Added: state.AddedTopics}})
-	if err != nil {
-		return
-	}
-	log.Tag(tag).Debug("Broadcasting state (%d new topics) to %d peer(s)", len(state.AddedTopics), len(peers))
-	for _, p := range peers {
-		go c.postToPeer(NodeID(p.NodeID), stateURL(p.AdvertiseURL), contentTypeJSON, body)
-	}
-}
-
-// IsLeader reports whether this node currently holds singleton-job leadership.
-func (c *meshCluster) IsLeader() bool {
-	return c.leader.IsLeader()
-}
-
-// Healthy reports whether this node's registry heartbeat is fresh enough that peers still
-// forward messages to it (see the Cluster interface for the checker's fail-open duty).
-func (c *meshCluster) Healthy() bool {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return time.Since(c.lastRegistered) < c.conf.NodeTTL
-}
-
-// Close stops the mesh: it deregisters this node, releases leadership, stops all peer workers,
-// and waits for them to exit.
-func (c *meshCluster) Close() error {
-	c.cancel() // Stops the heartbeat loop and aborts in-flight peer deliveries
-	// Close the peer queues so their workers flush and exit; final sends are best-effort since
-	// the context is already canceled (parity with fire-and-forget delivery)
-	c.mu.Lock()
-	c.closed = true
-	for nodeID, q := range c.queues {
-		q.queue.Close()
-		delete(c.queues, nodeID)
-	}
-	c.mu.Unlock()
-	// Wait for the loops BEFORE deregistering: an in-flight heartbeat's Register would otherwise
-	// re-insert our row right after Deregister deleted it
-	c.wg.Wait()
-	if err := c.registry.Deregister(); err != nil {
-		log.Tag(tag).Err(err).Warn("Failed to deregister node")
-	}
-	c.leader.Close()
-	metrics.ClusterLeader.Set(0)
-	return nil
-}

cluster/cluster_mesh_test.go

@@ -1,590 +0,0 @@
-package cluster
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/cluster/registry"
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/db/pg"
-	dbtest "heckel.io/ntfy/v2/db/test"
-	"heckel.io/ntfy/v2/model"
-	"heckel.io/ntfy/v2/util"
-)
-
-const (
-	testSecret = "s3cret"
-)
-
-// openTestPool opens a dedicated connection pool to the given test schema, so that each simulated
-// node has its own pool like real nodes would.
-func openTestPool(t testing.TB, dsn string) *db.DB {
-	host, err := pg.Open(dsn)
-	require.Nil(t, err)
-	d := db.New(host, nil)
-	t.Cleanup(func() { d.Close() })
-	return d
-}
-
-func newTestMeshConfig(nodeID, advertiseURL string) *Config {
-	return &Config{
-		Enabled:             true,
-		NodeID:              NodeID(nodeID),
-		AdvertiseURL:        advertiseURL,
-		Secret:              testSecret,
-		HeartbeatInterval:   100 * time.Millisecond,
-		LeaderRenewInterval: 20 * time.Millisecond, // Lease duration 60ms, hold-off 120ms; keeps leadership tests fast
-		NodeTTL:             time.Second,           // Also the peer cache bound; short so fake peers registered mid-test are seen quickly
-		MaxMessageBytes:     1 << 20,
-		StateInterval:       time.Minute, // Individual tests lower this to exercise state pushes
-	}
-}
-
-// registerFakePeer registers a fake peer via the registry (creating the table if the mesh has
-// not been constructed yet): tests register fakes before the mesh boots, since its first
-// heartbeat caches the peer list. The fake never refreshes its heartbeat.
-func registerFakePeer(t testing.TB, pool *db.DB, nodeID NodeID, url string) {
-	t.Helper()
-	reg, err := registry.New(pool, string(nodeID), url, time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, reg.Register())
-}
-
-func waitFor(t *testing.T, f func() bool) {
-	t.Helper()
-	for i := 0; i < 100; i++ {
-		if f() {
-			return
-		}
-		time.Sleep(50 * time.Millisecond)
-	}
-	t.Fatal("timed out waiting for condition")
-}
-
-func TestMesh_CrossNodeDelivery(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	poolA, poolB := openTestPool(t, schemaDSN), openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	var received []*model.Message
-	var meshB *meshCluster
-	srvB := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		meshB.ServeHTTP(w, r)
-	}))
-	defer srvB.Close()
-	meshB, err := newMeshCluster(newTestMeshConfig("node-b", srvB.URL), poolB, func(m *model.Message) {
-		mu.Lock()
-		defer mu.Unlock()
-		received = append(received, m)
-	}, nil)
-	require.Nil(t, err)
-	defer meshB.Close()
-	meshA, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), poolA, func(m *model.Message) {
-		t.Error("node A must not receive its own relayed message")
-	}, nil)
-	require.Nil(t, err)
-	defer meshA.Close()
-	msg := model.NewDefaultMessage("mytopic", "hello cross-node")
-	require.Nil(t, meshA.ForwardMessage(msg))
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return len(received) == 1
-	})
-	mu.Lock()
-	defer mu.Unlock()
-	require.Equal(t, "mytopic", received[0].Topic)
-	require.Equal(t, "hello cross-node", received[0].Message)
-}
-
-func TestMesh_PeerAPI_Auth(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var delivered int
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, func(m *model.Message) {
-		delivered++
-	}, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	frag, err := marshalMessage(model.NewDefaultMessage("mytopic", "hi"))
-	require.Nil(t, err)
-	payload := assembleMessageBody([][]byte{frag})
-
-	// Wrong secret -> 401, not delivered
-	rr := httptest.NewRecorder()
-	req := httptest.NewRequest("POST", MessagePath, strings.NewReader(string(payload)))
-	req.Header.Set(secretHeader, "wrong")
-	req.Header.Set(originHeader, "node-b")
-	mesh.ServeHTTP(rr, req)
-	require.Equal(t, 401, rr.Code)
-
-	// Missing secret -> 401, not delivered
-	rr = httptest.NewRecorder()
-	mesh.ServeHTTP(rr, httptest.NewRequest("POST", MessagePath, strings.NewReader(string(payload))))
-	require.Equal(t, 401, rr.Code)
-	require.Equal(t, 0, delivered)
-
-	// Missing origin -> 400, not delivered
-	rr = httptest.NewRecorder()
-	req = httptest.NewRequest("POST", MessagePath, strings.NewReader(string(payload)))
-	req.Header.Set(secretHeader, testSecret)
-	mesh.ServeHTTP(rr, req)
-	require.Equal(t, 400, rr.Code)
-	require.Equal(t, 0, delivered)
-
-	// Correct secret and origin -> 200, delivered
-	rr = httptest.NewRecorder()
-	req = httptest.NewRequest("POST", MessagePath, strings.NewReader(string(payload)))
-	req.Header.Set(secretHeader, testSecret)
-	req.Header.Set(originHeader, "node-b")
-	mesh.ServeHTTP(rr, req)
-	require.Equal(t, 200, rr.Code)
-	require.Equal(t, 1, delivered)
-}
-
-func TestMesh_PeerAPI_SelfOrigin(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var delivered int
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, func(m *model.Message) {
-		delivered++
-	}, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-
-	// A request that carries this node's own broadcasts must not be re-delivered (loop prevention)
-	frag, err := marshalMessage(model.NewDefaultMessage("mytopic", "loop"))
-	require.Nil(t, err)
-	payload := assembleMessageBody([][]byte{frag})
-	rr := httptest.NewRecorder()
-	req := httptest.NewRequest("POST", MessagePath, strings.NewReader(string(payload)))
-	req.Header.Set(secretHeader, testSecret)
-	req.Header.Set(originHeader, "node-a") // Same as the receiving node's ID
-	mesh.ServeHTTP(rr, req)
-	require.Equal(t, 200, rr.Code)
-	require.Equal(t, 0, delivered)
-}
-
-func TestMesh_SlowPeerIsolation(t *testing.T) {
-	// A wedged peer must not delay delivery to healthy peers: each peer has its own queue and
-	// delivery worker. With a shared send queue (the design this replaces), the slow peer's
-	// requests would occupy all delivery workers and starve the fast peer.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	fastReceived := 0 // Messages, not requests: with batching, one request can carry many
-	srvFast := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		require.Nil(t, err)
-		messages, err := unmarshalMessageBody(body, 1<<20)
-		require.Nil(t, err)
-		mu.Lock()
-		fastReceived += len(messages)
-		mu.Unlock()
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srvFast.Close()
-	release := make(chan struct{})
-	srvSlow := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		<-release // Wedged until the end of the test
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srvSlow.Close()
-	defer close(release)
-	// Register the fake peers before the mesh boots; its first heartbeat caches the peer list
-	for i, url := range []string{srvFast.URL, srvSlow.URL} {
-		registerFakePeer(t, pool, NodeID(fmt.Sprintf("node-fake-%d", i)), url)
-	}
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	const n = 20
-	for i := 0; i < n; i++ {
-		require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", fmt.Sprintf("message %d", i))))
-	}
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return fastReceived == n
-	})
-}
-
-func TestMesh_BatchCoalescing(t *testing.T) {
-	// Messages published within the linger window arrive as batches: fewer HTTP requests than
-	// messages, with nothing lost. Fails against a one-request-per-message sender.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	requests, messages := 0, 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		require.Nil(t, err)
-		decoded, err := unmarshalMessageBody(body, 1<<20)
-		require.Nil(t, err)
-		mu.Lock()
-		requests++
-		messages += len(decoded)
-		mu.Unlock()
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-	registerFakePeer(t, pool, "node-fake", srv.URL)
-	conf := newTestMeshConfig("node-a", "http://127.0.0.1:1")
-	conf.BatchLinger = 150 * time.Millisecond
-	mesh, err := newMeshCluster(conf, pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	const n = 20
-	for i := 0; i < n; i++ {
-		require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", fmt.Sprintf("message %d", i))))
-	}
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return messages == n
-	})
-	mu.Lock()
-	defer mu.Unlock()
-	require.Less(t, requests, 5, "expected %d messages coalesced into few requests, got %d", n, requests)
-}
-
-func TestMesh_DeadPeerRemovedAndRejoin(t *testing.T) {
-	// A peer that dies ungracefully (no Deregister) stops refreshing its heartbeat: after the
-	// TTL it no longer counts as live (no more sends), its queue/worker are reconciled away, the
-	// leader prunes its registry row, and a re-registered peer starts receiving again.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	received := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		require.Nil(t, err)
-		messages, err := unmarshalMessageBody(body, 1<<20)
-		require.Nil(t, err)
-		mu.Lock()
-		received += len(messages)
-		mu.Unlock()
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-	conf := newTestMeshConfig("node-a", "http://127.0.0.1:1")
-	conf.NodeTTL = 300 * time.Millisecond // Fast expiry so the test observes TTL-based removal
-	mesh, err := newMeshCluster(conf, pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	// The fake peer registers once and then "dies": its heartbeat is never refreshed
-	registerFakePeer(t, pool, "node-dead", srv.URL)
-	require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", "while alive")))
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return received == 1
-	})
-	// After the TTL, the peer is no longer live: its queue is reconciled away and its registry
-	// row is pruned by the leader (this mesh is the only real node, so it holds the lock)
-	waitFor(t, func() bool {
-		mesh.mu.Lock()
-		defer mesh.mu.Unlock()
-		return len(mesh.queues) == 0
-	})
-	waitFor(t, func() bool {
-		var count int
-		require.Nil(t, pool.QueryRow(`SELECT COUNT(*) FROM node_registry WHERE node_id = 'node-dead'`).Scan(&count))
-		return count == 0
-	})
-	require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", "while dead")))
-	time.Sleep(250 * time.Millisecond) // Give a wrong implementation time to deliver anyway
-	mu.Lock()
-	require.Equal(t, 1, received) // Only the first message arrived
-	mu.Unlock()
-	// The peer comes back (same node ID, fresh heartbeat) and receives messages again; the
-	// relay retries because the peer list is cached for up to the node TTL
-	registerFakePeer(t, pool, "node-dead", srv.URL)
-	waitFor(t, func() bool {
-		require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", "after rejoin")))
-		mu.Lock()
-		defer mu.Unlock()
-		return received > 1
-	})
-}
-
-func TestMesh_ForwardAfterClose(t *testing.T) {
-	// A ForwardMessage racing shutdown (e.g. an in-flight publish during server Stop) must not spawn
-	// a new peer queue and worker after Close: the worker would never exit (its queue is never
-	// closed) and nothing waits for it.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	registerFakePeer(t, pool, "node-peer", "http://127.0.0.1:1")
-	require.Nil(t, mesh.Close())
-	require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", "too late"))) // Dropped silently
-	mesh.mu.Lock()
-	defer mesh.mu.Unlock()
-	require.Empty(t, mesh.queues)
-}
-
-func TestMesh_LeaderFailover(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	poolA, poolB := openTestPool(t, schemaDSN), openTestPool(t, schemaDSN)
-	meshA, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), poolA, nil, nil)
-	require.Nil(t, err)
-	defer meshA.Close()
-	meshB, err := newMeshCluster(newTestMeshConfig("node-b", "http://127.0.0.1:1"), poolB, nil, nil)
-	require.Nil(t, err)
-	defer meshB.Close()
-	// Exactly one node becomes leader
-	waitFor(t, func() bool {
-		return meshA.IsLeader() != meshB.IsLeader() // Exactly one
-	})
-	// The leader steps down; the follower takes over
-	leader, follower := meshA, meshB
-	if meshB.IsLeader() {
-		leader, follower = meshB, meshA
-	}
-	require.Nil(t, leader.Close())
-	waitFor(t, follower.IsLeader)
-}
-
-func TestMesh_CloseDeregisters(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	var count int
-	require.Nil(t, pool.QueryRow(`SELECT COUNT(*) FROM node_registry WHERE node_id = 'node-a'`).Scan(&count))
-	require.Equal(t, 1, count)
-	require.Nil(t, mesh.Close())
-	require.Nil(t, pool.QueryRow(`SELECT COUNT(*) FROM node_registry WHERE node_id = 'node-a'`).Scan(&count))
-	require.Equal(t, 0, count)
-}
-
-// postState delivers a state envelope to a mesh's peer API, as a peer would.
-func postState(c *meshCluster, origin NodeID, state *apiState) *httptest.ResponseRecorder {
-	body, err := json.Marshal(state)
-	if err != nil {
-		panic(err)
-	}
-	rr := httptest.NewRecorder()
-	req := httptest.NewRequest("POST", StatePath, bytes.NewReader(body))
-	req.Header.Set(secretHeader, testSecret)
-	req.Header.Set(originHeader, string(origin))
-	c.ServeHTTP(rr, req)
-	return rr
-}
-
-// topicFilter builds a marshaled Bloom filter over the given topics.
-func topicFilter(t *testing.T, topics ...string) []byte {
-	t.Helper()
-	filter := util.NewBloomFilter(len(topics), 0.01)
-	for _, topic := range topics {
-		filter.Add(topic)
-	}
-	data, err := filter.MarshalBinary()
-	require.Nil(t, err)
-	return data
-}
-
-func TestMesh_RouteSkipsUnsubscribedPeer(t *testing.T) {
-	// A peer whose fresh state provably excludes a topic is not contacted for it; a topic in its
-	// state is delivered as usual.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	received := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		require.Nil(t, err)
-		messages, err := unmarshalMessageBody(body, 1<<20)
-		require.Nil(t, err)
-		mu.Lock()
-		received += len(messages)
-		mu.Unlock()
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-	registerFakePeer(t, pool, "node-b", srv.URL)
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	// node-b reports subscribers only for "subscribed-topic"
-	rr := postState(mesh, "node-b", &apiState{Topics: &apiStateTopics{Filter: topicFilter(t, "subscribed-topic")}})
-	require.Equal(t, 200, rr.Code)
-	// A topic outside the peer's state is skipped
-	require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("other-topic", "skipped")))
-	time.Sleep(300 * time.Millisecond) // Give a wrong implementation time to deliver anyway
-	mu.Lock()
-	require.Equal(t, 0, received)
-	mu.Unlock()
-	// A topic inside the peer's state is delivered
-	require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("subscribed-topic", "delivered")))
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return received == 1
-	})
-}
-
-func TestMesh_RouteBroadcastsOnStaleState(t *testing.T) {
-	// State too old to trust cannot justify skipping: the peer is broadcast to as if unknown.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	received := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == MessagePath { // The mesh also pushes state here; count only messages
-			mu.Lock()
-			received++
-			mu.Unlock()
-		}
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-	registerFakePeer(t, pool, "node-b", srv.URL)
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	rr := postState(mesh, "node-b", &apiState{Topics: &apiStateTopics{Filter: topicFilter(t, "subscribed-topic")}})
-	require.Equal(t, 200, rr.Code)
-	// Age the state beyond the trust window
-	mesh.statesMu.Lock()
-	mesh.states["node-b"].updatedAt = time.Now().Add(-time.Hour)
-	mesh.statesMu.Unlock()
-	require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("other-topic", "broadcast anyway")))
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return received == 1
-	})
-}
-
-func TestMesh_StatePushReplacesAndRemoves(t *testing.T) {
-	// Node A periodically pushes a full snapshot of its live topics to node B; each snapshot
-	// REPLACES B's knowledge, so topics that lost their subscribers disappear without any
-	// explicit removal protocol.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	poolA, poolB := openTestPool(t, schemaDSN), openTestPool(t, schemaDSN)
-	var topicsMu sync.Mutex
-	topicsA := []string{"topic-1"}
-	source := func() []string {
-		topicsMu.Lock()
-		defer topicsMu.Unlock()
-		return append([]string{}, topicsA...)
-	}
-	var meshB *meshCluster
-	srvB := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		meshB.ServeHTTP(w, r)
-	}))
-	defer srvB.Close()
-	meshB, err := newMeshCluster(newTestMeshConfig("node-b", srvB.URL), poolB, nil, nil)
-	require.Nil(t, err)
-	defer meshB.Close()
-	confA := newTestMeshConfig("node-a", "http://127.0.0.1:1")
-	confA.StateInterval = 200 * time.Millisecond
-	meshA, err := newMeshCluster(confA, poolA, nil, source)
-	require.Nil(t, err)
-	defer meshA.Close()
-	// B learns A's topics via the periodic push
-	knows := func(topic string) func() bool {
-		return func() bool {
-			meshB.statesMu.Lock()
-			defer meshB.statesMu.Unlock()
-			state, ok := meshB.states["node-a"]
-			return ok && state.topics.Contains(topic)
-		}
-	}
-	waitFor(t, knows("topic-1"))
-	// A's subscribers change; the next snapshot replaces the old knowledge entirely
-	topicsMu.Lock()
-	topicsA = []string{"topic-2"}
-	topicsMu.Unlock()
-	waitFor(t, knows("topic-2"))
-	waitFor(t, func() bool { return !knows("topic-1")() })
-}
-
-func TestMesh_AnnounceClosesWindow(t *testing.T) {
-	// A topic gaining its first subscriber is announced immediately, so peers learn about it
-	// without waiting for the next full state push.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	poolA, poolB := openTestPool(t, schemaDSN), openTestPool(t, schemaDSN)
-	var meshB *meshCluster
-	srvB := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		meshB.ServeHTTP(w, r)
-	}))
-	defer srvB.Close()
-	meshB, err := newMeshCluster(newTestMeshConfig("node-b", srvB.URL), poolB, nil, nil)
-	require.Nil(t, err)
-	defer meshB.Close()
-	confA := newTestMeshConfig("node-a", "http://127.0.0.1:1")
-	confA.StateInterval = 200 * time.Millisecond // One full push establishes the baseline
-	meshA, err := newMeshCluster(confA, poolA, nil, func() []string { return []string{"existing"} })
-	require.Nil(t, err)
-	defer meshA.Close()
-	waitFor(t, func() bool {
-		meshB.statesMu.Lock()
-		defer meshB.statesMu.Unlock()
-		_, ok := meshB.states["node-a"]
-		return ok
-	})
-	// Announcements merge into the baseline right away
-	meshA.BroadcastState(&State{AddedTopics: []string{"fresh-topic"}})
-	waitFor(t, func() bool {
-		meshB.statesMu.Lock()
-		defer meshB.statesMu.Unlock()
-		state, ok := meshB.states["node-a"]
-		return ok && state.topics.Contains("fresh-topic")
-	})
-}
-
-func TestMesh_StateOfDepartedPeerPruned(t *testing.T) {
-	// peerState is push-driven and can arrive before the peer is visible in the registry, so it
-	// must survive reconcile while fresh -- but a departed peer's state must not leak forever:
-	// once it is both absent from the registry and stale past the trust window, it is pruned.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	rr := postState(mesh, "node-gone", &apiState{Topics: &apiStateTopics{Filter: topicFilter(t, "some-topic")}})
-	require.Equal(t, 200, rr.Code)
-	// Fresh state of an unknown peer survives reconcile (the new-node visibility window)
-	mesh.reconcilePeers(nil)
-	mesh.statesMu.Lock()
-	_, ok := mesh.states["node-gone"]
-	mesh.statesMu.Unlock()
-	require.True(t, ok)
-	// Stale state of an absent peer is pruned
-	mesh.statesMu.Lock()
-	mesh.states["node-gone"].updatedAt = time.Now().Add(-time.Hour)
-	mesh.statesMu.Unlock()
-	mesh.reconcilePeers(nil)
-	mesh.statesMu.Lock()
-	_, ok = mesh.states["node-gone"]
-	mesh.statesMu.Unlock()
-	require.False(t, ok)
-}
-
-func TestMesh_HealthyReflectsRegistration(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	require.True(t, mesh.Healthy()) // Registered synchronously at construction
-	// Stale heartbeat: peers stop forwarding to this node, so it must report unhealthy
-	mesh.mu.Lock()
-	mesh.lastRegistered = time.Now().Add(-2 * mesh.conf.NodeTTL)
-	mesh.mu.Unlock()
-	require.False(t, mesh.Healthy())
-	// A successful heartbeat restores health
-	require.Nil(t, mesh.heartbeat())
-	require.True(t, mesh.Healthy())
-}

cluster/cluster_nop.go

@@ -1,26 +0,0 @@
-package cluster
-
-import (
-	"net/http"
-
-	"heckel.io/ntfy/v2/model"
-)
-
-// nopCluster is the single-node default: it drops all relayed messages, rejects peer API requests, and
-// reports this node as leader (a single node is trivially the leader, so leader-gated jobs need
-// no special-casing in single-node mode).
-type nopCluster struct{}
-
-func (c *nopCluster) ForwardMessage(_ *model.Message) error { return nil }
-
-func (c *nopCluster) ServeHTTP(w http.ResponseWriter, _ *http.Request) {
-	w.WriteHeader(http.StatusNotFound)
-}
-
-func (c *nopCluster) BroadcastState(_ *State) {}
-
-func (c *nopCluster) IsLeader() bool { return true }
-
-func (c *nopCluster) Healthy() bool { return true }
-
-func (c *nopCluster) Close() error { return nil }

cluster/cluster_test.go

@@ -1,84 +0,0 @@
-package cluster
-
-import (
-	"bytes"
-	"net/http/httptest"
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/model"
-)
-
-func TestDeliver_RoundTrip(t *testing.T) {
-	// The fan-out body is NDJSON: one apiDeliverMessage per line, joined from pre-marshaled
-	// fragments; the origin travels in a header, not the body
-	m1 := model.NewDefaultMessage("mytopic", "my message")
-	m1.Sender = netip.MustParseAddr("1.2.3.4")
-	m1.User = "u_abc"
-	m2 := model.NewDefaultMessage("othertopic", "other message")
-	frag1, err := marshalMessage(m1)
-	require.Nil(t, err)
-	frag2, err := marshalMessage(m2)
-	require.Nil(t, err)
-	messages, err := unmarshalMessageBody(assembleMessageBody([][]byte{frag1, frag2}), 1<<20)
-	require.Nil(t, err)
-	require.Len(t, messages, 2)
-	require.Equal(t, "mytopic", messages[0].Topic)
-	require.Equal(t, "my message", messages[0].Message)
-	// Sender and User are json:"-" on model.Message; the lines must carry and reattach them
-	require.Equal(t, netip.MustParseAddr("1.2.3.4"), messages[0].Sender)
-	require.Equal(t, "u_abc", messages[0].User)
-	require.Equal(t, "othertopic", messages[1].Topic)
-	require.False(t, messages[1].Sender.IsValid())
-}
-
-func TestDeliver_SingleMessage(t *testing.T) {
-	// A single message is just a one-line body; there is no separate single-message format
-	frag, err := marshalMessage(model.NewDefaultMessage("mytopic", "hi"))
-	require.Nil(t, err)
-	messages, err := unmarshalMessageBody(assembleMessageBody([][]byte{frag}), 1<<20)
-	require.Nil(t, err)
-	require.Len(t, messages, 1)
-}
-
-func TestDeliver_MalformedLinesSkipped(t *testing.T) {
-	// Fan-out is fire-and-forget: a malformed or message-less line is skipped (and logged), the
-	// remaining lines are still delivered
-	frag, err := marshalMessage(model.NewDefaultMessage("mytopic", "good"))
-	require.Nil(t, err)
-	body := []byte("this is not json\n{\"sender\":\"1.2.3.4\"}\n" + string(frag) + "\n\n")
-	messages, err := unmarshalMessageBody(body, 1<<20)
-	require.Nil(t, err)
-	require.Len(t, messages, 1)
-	require.Equal(t, "good", messages[0].Message)
-}
-
-// unmarshalMessageBody is a test helper collecting the messages of an NDJSON message body.
-func unmarshalMessageBody(body []byte, maxLineBytes int) ([]*model.Message, error) {
-	var messages []*model.Message
-	err := decodeMessageBody(bytes.NewReader(body), maxLineBytes, func(m *model.Message) {
-		messages = append(messages, m)
-	})
-	return messages, err
-}
-
-func TestNop(t *testing.T) {
-	b, err := New(&Config{}, nil, nil, nil) // not enabled -> nop cluster, no database required
-	require.Nil(t, err)
-	require.IsType(t, &nopCluster{}, b)
-	require.Nil(t, b.ForwardMessage(model.NewDefaultMessage("mytopic", "hi")))
-	// A single node is trivially the leader, so leader-gated jobs run without special-casing
-	require.True(t, b.IsLeader())
-	require.True(t, b.Healthy())
-	rr := httptest.NewRecorder()
-	b.ServeHTTP(rr, httptest.NewRequest("POST", MessagePath, nil))
-	require.Equal(t, 404, rr.Code)
-	require.Nil(t, b.Close())
-}
-
-func TestNew_EnabledRequiresDatabase(t *testing.T) {
-	_, err := New(&Config{Enabled: true, Secret: "secret"}, nil, nil, nil)
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "database")
-}

cluster/registry/registry.go

@@ -1,149 +0,0 @@
-// Package registry implements cluster membership: each node upserts its own row into the
-// node_registry table with a fresh heartbeat, and discovers its peers by reading the other
-// fresh rows. Node IDs are plain strings here; the cluster package layers its NodeID type on
-// top.
-package registry
-
-import (
-	"sync"
-	"time"
-
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/db/schema"
-)
-
-// Registry queries
-const (
-	upsertNodeQuery = `
-		INSERT INTO node_registry (node_id, advertise_url, last_heartbeat)
-		VALUES ($1, $2, $3)
-		ON CONFLICT (node_id) DO UPDATE SET advertise_url = EXCLUDED.advertise_url, last_heartbeat = EXCLUDED.last_heartbeat
-	`
-	selectPeersQuery     = `SELECT node_id, advertise_url FROM node_registry WHERE last_heartbeat >= $1 AND node_id != $2`
-	pruneStaleNodesQuery = `DELETE FROM node_registry WHERE last_heartbeat < $1`
-	deleteNodeQuery      = `DELETE FROM node_registry WHERE node_id = $1`
-)
-
-// Schema version and queries
-
-const (
-	schemaVersion  = 1
-	schemaStoreKey = "node_registry"
-)
-
-var (
-	createTable = schema.AsMigrateFunc(`
-		CREATE TABLE IF NOT EXISTS node_registry (
-			node_id        TEXT PRIMARY KEY,
-			advertise_url  TEXT NOT NULL,
-			last_heartbeat BIGINT NOT NULL
-		)
-	`)
-)
-
-// Peer is a live remote node as read from the registry.
-type Peer struct {
-	NodeID       string
-	AdvertiseURL string
-}
-
-// Registry is the node membership table (control plane): each node upserts its own row with a
-// fresh heartbeat every few seconds, and peers are the other rows with a heartbeat newer than
-// the TTL. Stale rows are pruned by the leader. The TTL bounds membership staleness in BOTH
-// directions: how long a silent node still counts as live, and how long the cached peer list is
-// served before a re-read -- so a new node may take up to a TTL to become visible.
-type Registry struct {
-	pool         *db.DB
-	nodeID       string
-	advertiseURL string
-	ttl          time.Duration
-	peers        []*Peer // cached peer list
-	peersFetched time.Time
-	mu           sync.Mutex // Protects peers and peersFetched
-}
-
-// New creates or migrates the registry schema and returns this node's membership handle. It
-// does NOT register the node: joining the cluster is an explicit Register call, owned by the
-// caller, so read-only uses of the registry stay side-effect free.
-func New(pool *db.DB, nodeID, advertiseURL string, ttl time.Duration) (*Registry, error) {
-	if err := schema.Migrate(pool.Primary(), schema.Postgres, schemaStoreKey, schemaVersion, createTable, nil); err != nil {
-		return nil, err
-	}
-	return &Registry{
-		pool:         pool,
-		nodeID:       nodeID,
-		advertiseURL: advertiseURL,
-		ttl:          ttl,
-	}, nil
-}
-
-// Register upserts this node into the registry with a fresh heartbeat. It is a pure write: it
-// does not touch the peer cache, because our own row is excluded from Peers() anyway.
-func (r *Registry) Register() error {
-	_, err := r.pool.Exec(upsertNodeQuery, r.nodeID, r.advertiseURL, time.Now().Unix())
-	return err
-}
-
-// Peers returns the current set of live peer nodes (all registry rows with a fresh heartbeat,
-// excluding this node), cached for the TTL.
-func (r *Registry) Peers() ([]*Peer, error) {
-	r.mu.Lock()
-	if r.peers != nil && time.Since(r.peersFetched) < r.ttl {
-		peers := r.peers
-		r.mu.Unlock()
-		return peers, nil
-	}
-	r.mu.Unlock()
-	peers, err := r.queryPeers()
-	if err != nil {
-		// Serve the last-known peer list during database hiccups: fan-out keeps flowing to
-		// known peers instead of erroring (and logging) once per published message for the
-		// duration of the outage. Dead peers in the stale list only cost failed sends.
-		r.mu.Lock()
-		defer r.mu.Unlock()
-		if r.peers != nil {
-			return r.peers, nil
-		}
-		return nil, err
-	}
-	r.mu.Lock()
-	r.peers = peers
-	r.peersFetched = time.Now()
-	r.mu.Unlock()
-	return peers, nil
-}
-
-// Prune deletes registry rows whose heartbeat is long expired. Only the leader calls this; the
-// grace period of 3x the TTL avoids deleting rows of nodes that are merely slow to heartbeat.
-func (r *Registry) Prune() error {
-	_, err := r.pool.Exec(pruneStaleNodesQuery, time.Now().Add(-3*r.ttl).Unix())
-	return err
-}
-
-// Deregister deletes this node's registry row; called on shutdown.
-func (r *Registry) Deregister() error {
-	_, err := r.pool.Exec(deleteNodeQuery, r.nodeID)
-	return err
-}
-
-// queryPeers reads the current live peer set from the registry table.
-func (r *Registry) queryPeers() ([]*Peer, error) {
-	cutoff := time.Now().Add(-r.ttl).Unix()
-	rows, err := r.pool.Query(selectPeersQuery, cutoff, r.nodeID)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	peers := make([]*Peer, 0)
-	for rows.Next() {
-		p := &Peer{}
-		if err := rows.Scan(&p.NodeID, &p.AdvertiseURL); err != nil {
-			return nil, err
-		}
-		peers = append(peers, p)
-	}
-	if err := rows.Err(); err != nil {
-		return nil, err
-	}
-	return peers, nil
-}

cluster/registry/registry_test.go

@@ -1,222 +0,0 @@
-package registry
-
-import (
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/db/pg"
-	dbtest "heckel.io/ntfy/v2/db/test"
-)
-
-func openTestPool(t *testing.T, dsn string) *db.DB {
-	t.Helper()
-	host, err := pg.Open(dsn)
-	require.Nil(t, err)
-	d := db.New(host, nil)
-	t.Cleanup(func() { d.Close() })
-	return d
-}
-
-func TestRegistry_NewDoesNotRegister(t *testing.T) {
-	// New only sets up the schema and the identity handle; joining the cluster is an explicit
-	// Register call, owned by the caller (the mesh registers synchronously at construction).
-	// This keeps read-only uses (ops tooling, future admin endpoints) side-effect free.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	require.Equal(t, 0, countRows(t, pool, "node-1"))
-	require.Nil(t, r1.Register())
-	require.Equal(t, 1, countRows(t, pool, "node-1"))
-}
-
-func TestRegistry_RegisterAndPeers(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, r1.Register())
-	r2, err := New(pool, "node-2", "http://10.0.0.2:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, r2.Register())
-	// Each node sees the other, never itself
-	peers, err := r1.Peers()
-	require.Nil(t, err)
-	require.Len(t, peers, 1)
-	require.Equal(t, "node-2", peers[0].NodeID)
-	require.Equal(t, "http://10.0.0.2:2587", peers[0].AdvertiseURL)
-	peers, err = r2.Peers()
-	require.Nil(t, err)
-	require.Len(t, peers, 1)
-	require.Equal(t, "node-1", peers[0].NodeID)
-}
-
-func TestRegistry_ReRegisterUpdatesAdvertiseURL(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	// The same node comes back under a new address; the upsert replaces the row
-	old, err := New(pool, "node-2", "http://old:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, old.Register())
-	renewed, err := New(pool, "node-2", "http://new:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, renewed.Register())
-	expireCache(r1)
-	peers, err := r1.Peers()
-	require.Nil(t, err)
-	require.Len(t, peers, 1)
-	require.Equal(t, "http://new:2587", peers[0].AdvertiseURL)
-}
-
-func TestRegistry_PeersCachedForTTL(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	peers, err := r1.Peers()
-	require.Nil(t, err)
-	require.Empty(t, peers)
-	// A node joining after the cache was populated is invisible until the cache expires
-	r2, err := New(pool, "node-2", "http://10.0.0.2:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, r2.Register())
-	peers, err = r1.Peers()
-	require.Nil(t, err)
-	require.Empty(t, peers)
-	expireCache(r1)
-	peers, err = r1.Peers()
-	require.Nil(t, err)
-	require.Len(t, peers, 1)
-}
-
-func TestRegistry_TTLExcludesSilentNodes(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	// A node whose heartbeat is older than the TTL does not count as live
-	_, err = pool.Exec(upsertNodeQuery, "node-silent", "http://10.0.0.9:2587", time.Now().Add(-2*time.Minute).Unix())
-	require.Nil(t, err)
-	peers, err := r1.Peers()
-	require.Nil(t, err)
-	require.Empty(t, peers)
-}
-
-func TestRegistry_PruneDeletesLongDeadOnly(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	// One node beyond the 3x TTL grace period, one merely stale
-	_, err = pool.Exec(upsertNodeQuery, "node-long-dead", "http://10.0.0.8:2587", time.Now().Add(-4*time.Minute).Unix())
-	require.Nil(t, err)
-	_, err = pool.Exec(upsertNodeQuery, "node-slow", "http://10.0.0.9:2587", time.Now().Add(-2*time.Minute).Unix())
-	require.Nil(t, err)
-	require.Nil(t, r1.Prune())
-	require.Equal(t, 0, countRows(t, pool, "node-long-dead"))
-	require.Equal(t, 1, countRows(t, pool, "node-slow")) // Slow, not dead: kept
-}
-
-func TestRegistry_Deregister(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, r1.Register())
-	require.Equal(t, 1, countRows(t, pool, "node-1"))
-	require.Nil(t, r1.Deregister())
-	require.Equal(t, 0, countRows(t, pool, "node-1"))
-}
-
-func TestRegistry_PeersStaleCacheOnError(t *testing.T) {
-	// During a database hiccup, Peers serves the last-known peer list instead of erroring:
-	// fan-out keeps flowing to known peers, and the publish path does not log a warning per
-	// message for the duration of the outage.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	r2, err := New(pool, "node-2", "http://10.0.0.2:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, r2.Register())
-	peers, err := r1.Peers()
-	require.Nil(t, err)
-	require.Len(t, peers, 1)
-	// Expire the cache and break the database; the stale list must still be served
-	expireCache(r1)
-	require.Nil(t, pool.Close())
-	peers, err = r1.Peers()
-	require.Nil(t, err)
-	require.Len(t, peers, 1)
-	require.Equal(t, "node-2", peers[0].NodeID)
-}
-
-func TestRegistry_ConcurrentCreate(t *testing.T) {
-	// Multiple nodes cold-booting on a fresh database must not race on table creation: CREATE
-	// TABLE IF NOT EXISTS is not atomic in PostgreSQL, so creation is serialized via an advisory
-	// lock. Without it, this test fails sporadically with a duplicate-key error on pg_class.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	const n = 8
-	errs := make(chan error, n)
-	for i := 0; i < n; i++ {
-		go func(i int) {
-			pool, err := pg.Open(schemaDSN)
-			if err != nil {
-				errs <- err
-				return
-			}
-			defer pool.DB.Close()
-			_, err = New(db.New(pool, nil), fmt.Sprintf("node-%d", i), "http://127.0.0.1:1", time.Second)
-			errs <- err
-		}(i)
-	}
-	for i := 0; i < n; i++ {
-		require.Nil(t, <-errs)
-	}
-}
-
-func TestRegistry_SchemaVersionWritten(t *testing.T) {
-	// The registry participates in the shared schema_version framework like every other store,
-	// so future table changes can be applied as migrations.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	_, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	var version int
-	require.Nil(t, pool.QueryRow(`SELECT version FROM schema_version WHERE store = $1`, schemaStoreKey).Scan(&version))
-	require.Equal(t, schemaVersion, version)
-	// Setup is idempotent: a second node boots against the migrated schema
-	_, err = New(pool, "node-2", "http://10.0.0.2:2587", time.Minute)
-	require.Nil(t, err)
-}
-
-func TestRegistry_SchemaVersionFromTheFuture(t *testing.T) {
-	// A node running older code must refuse to touch a schema migrated by newer code
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	_, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	_, err = pool.Exec(`UPDATE schema_version SET version = 99 WHERE store = $1`, schemaStoreKey)
-	require.Nil(t, err)
-	_, err = New(pool, "node-2", "http://10.0.0.2:2587", time.Minute)
-	require.Error(t, err)
-}
-
-// expireCache forces the next Peers() call to re-read the registry table.
-func expireCache(r *Registry) {
-	r.mu.Lock()
-	r.peersFetched = time.Time{}
-	r.mu.Unlock()
-}
-
-func countRows(t *testing.T, pool *db.DB, nodeID string) int {
-	t.Helper()
-	var count int
-	require.Nil(t, pool.QueryRow(`SELECT COUNT(*) FROM node_registry WHERE node_id = $1`, nodeID).Scan(&count))
-	return count
-}

cluster/types.go

@@ -1,76 +0,0 @@
-package cluster
-
-import (
-	"time"
-
-	"heckel.io/ntfy/v2/model"
-	"heckel.io/ntfy/v2/util"
-)
-
-// Config configures the cluster. It is assembled by the server from its own config, which keeps
-// this package free of server types.
-type Config struct {
-	Enabled             bool          // Master switch; when false, New returns the nop cluster
-	NodeID              NodeID        // Stable per-node identifier; required
-	AdvertiseURL        string        // Base URL peers use to reach this node's fan-out endpoint
-	Secret              string        // Shared secret authenticating node-to-node fan-out requests
-	HeartbeatInterval   time.Duration // How often the node registry heartbeat is refreshed
-	NodeTTL             time.Duration // Registry rows older than this do not count as live peers
-	BatchLinger         time.Duration // How long messages wait in a peer queue to form a batch; 0 = send immediately
-	StateInterval       time.Duration // How often the full subscription state is pushed to peers
-	MaxMessageBytes     int64         // Upper bound for a single message on the wire (batch limits derive from this)
-	LeaderRenewInterval time.Duration // Overrides the leader lease renewal cadence; tests only, 0 = default
-}
-
-// DeliverFunc hands a message received from a peer node to this node's local subscribers. The
-// server supplies it, which inverts the dependency: this package never imports the server.
-type DeliverFunc func(m *model.Message)
-
-// State is a subscription-state delta for Cluster.BroadcastState.
-type State struct {
-	AddedTopics []string // Topics that just gained their first local subscriber on this node
-}
-
-// TopicsFunc returns the topics that currently have at least one live subscriber, computed
-// fresh on every call: membership is never tracked as a list, so topics "leave" simply by not
-// appearing in the next snapshot. The server supplies it (same inversion as DeliverFunc).
-type TopicsFunc func() []string
-
-// apiMessage is one line of a message request body (NDJSON: one message per line; a single
-// message is just a one-line body). It carries the two fields that model.Message does not
-// serialize to JSON (Sender and User), which are needed to reconstruct the visitor on the
-// receiving node. The origin node travels in a request header, not in the body.
-type apiMessage struct {
-	Sender  string         `json:"sender,omitempty"`
-	User    string         `json:"user,omitempty"`
-	Message *model.Message `json:"message"`
-}
-
-// apiState is the peer state-exchange envelope. Each concern is an optional section; future
-// concerns (rate limit counters, stats) become siblings of Topics.
-type apiState struct {
-	Topics *apiStateTopics `json:"topics,omitempty"`
-}
-
-// apiStateTopics carries a peer's subscription knowledge: either a full snapshot (Filter, a
-// marshaled Bloom filter over the topics with live subscribers) replacing all prior knowledge,
-// or an incremental update (Added) merged into it.
-type apiStateTopics struct {
-	Filter []byte   `json:"filter,omitempty"`
-	Added  []string `json:"added,omitempty"`
-}
-
-// peerState is what a peer last told us about itself; ForwardMessage routes around peers whose
-// fresh state provably excludes a topic.
-type peerState struct {
-	topics    *util.BloomFilter
-	updatedAt time.Time
-}
-
-// peerQueue is the bounded, batching send queue for a single peer, pinned to the advertise URL
-// the peer was created with: a peer re-registering under a different advertise URL is treated
-// as a replacement (reconcile retires the old queue; ForwardMessage creates a fresh one on demand).
-type peerQueue struct {
-	advertiseURL string
-	queue        *util.LingerQueue[[]byte] // pre-marshaled apiMessage fragments
-}

cluster/util.go

@@ -1,69 +0,0 @@
-package cluster
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/json"
-	"io"
-	"net/netip"
-	"strings"
-
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/model"
-)
-
-// messageURL derives the peer's message endpoint URL from its advertise URL.
-func messageURL(advertiseURL string) string {
-	return strings.TrimRight(advertiseURL, "/") + MessagePath
-}
-
-// stateURL derives the peer's state endpoint URL from its advertise URL.
-func stateURL(advertiseURL string) string {
-	return strings.TrimRight(advertiseURL, "/") + StatePath
-}
-
-// marshalMessage serializes one message and its non-JSON fields (Sender, User) as an
-// apiMessage line. Lines are marshaled once per publish and shared across all per-peer
-// queues; assembleMessageBody joins them without re-marshaling.
-func marshalMessage(m *model.Message) ([]byte, error) {
-	apiMsg := &apiMessage{User: m.User, Message: m}
-	if m.Sender.IsValid() {
-		apiMsg.Sender = m.Sender.String()
-	}
-	return json.Marshal(apiMsg)
-}
-
-// assembleMessageBody builds an NDJSON fan-out request body from pre-marshaled apiMessage
-// lines, avoiding a second JSON marshal of the messages.
-func assembleMessageBody(frags [][]byte) []byte {
-	return append(bytes.Join(frags, []byte("\n")), '\n')
-}
-
-// decodeMessageBody reads NDJSON apiMessage lines from r, reattaches the non-JSON fields
-// (Sender, User) onto each message, and hands them to deliver. Malformed or message-less lines
-// are skipped and logged, not fatal: fan-out is fire-and-forget, so the valid remainder of a
-// request is still delivered. It returns an error only for stream-level failures (e.g. a line
-// exceeding maxLineBytes).
-func decodeMessageBody(r io.Reader, maxLineBytes int, deliver DeliverFunc) error {
-	scanner := bufio.NewScanner(r)
-	scanner.Buffer(make([]byte, 64*1024), maxLineBytes)
-	for scanner.Scan() {
-		line := bytes.TrimSpace(scanner.Bytes())
-		if len(line) == 0 {
-			continue
-		}
-		var apiMsg apiMessage
-		if err := json.Unmarshal(line, &apiMsg); err != nil || apiMsg.Message == nil {
-			log.Tag(tag).Warn("Skipping malformed fan-out line")
-			continue
-		}
-		apiMsg.Message.User = apiMsg.User
-		if apiMsg.Sender != "" {
-			if addr, err := netip.ParseAddr(apiMsg.Sender); err == nil {
-				apiMsg.Message.Sender = addr
-			}
-		}
-		deliver(apiMsg.Message)
-	}
-	return scanner.Err()
-}

cmd/access.go

@@ -6,8 +6,8 @@ import (
 	"errors"
 	"fmt"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/user"
+	"heckel.io/ntfy/util"
 )
 
 func init() {
@@ -105,10 +105,8 @@ func changeAccess(c *cli.Context, manager *user.Manager, username string, topic
 		return err
 	}
 	u, err := manager.User(username)
-	if errors.Is(err, user.ErrUserNotFound) {
+	if err == user.ErrUserNotFound {
 		return fmt.Errorf("user %s does not exist", username)
-	} else if err != nil {
-		return err
 	} else if u.Role == user.RoleAdmin {
 		return fmt.Errorf("user %s is an admin user, access control entries have no effect", username)
 	}
@@ -116,13 +114,13 @@ func changeAccess(c *cli.Context, manager *user.Manager, username string, topic
 		return err
 	}
 	if permission.IsReadWrite() {
-		fmt.Fprintf(c.App.Writer, "granted read-write access to topic %s\n\n", topic)
+		fmt.Fprintf(c.App.ErrWriter, "granted read-write access to topic %s\n\n", topic)
 	} else if permission.IsRead() {
-		fmt.Fprintf(c.App.Writer, "granted read-only access to topic %s\n\n", topic)
+		fmt.Fprintf(c.App.ErrWriter, "granted read-only access to topic %s\n\n", topic)
 	} else if permission.IsWrite() {
-		fmt.Fprintf(c.App.Writer, "granted write-only access to topic %s\n\n", topic)
+		fmt.Fprintf(c.App.ErrWriter, "granted write-only access to topic %s\n\n", topic)
 	} else {
-		fmt.Fprintf(c.App.Writer, "revoked all access to topic %s\n\n", topic)
+		fmt.Fprintf(c.App.ErrWriter, "revoked all access to topic %s\n\n", topic)
 	}
 	return showUserAccess(c, manager, username)
 }
@@ -140,7 +138,7 @@ func resetAllAccess(c *cli.Context, manager *user.Manager) error {
 	if err := manager.ResetAccess("", ""); err != nil {
 		return err
 	}
-	fmt.Fprintln(c.App.Writer, "reset access for all users")
+	fmt.Fprintln(c.App.ErrWriter, "reset access for all users")
 	return nil
 }
 
@@ -148,7 +146,7 @@ func resetUserAccess(c *cli.Context, manager *user.Manager, username string) err
 	if err := manager.ResetAccess(username, ""); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "reset access for user %s\n\n", username)
+	fmt.Fprintf(c.App.ErrWriter, "reset access for user %s\n\n", username)
 	return showUserAccess(c, manager, username)
 }
 
@@ -156,7 +154,7 @@ func resetUserTopicAccess(c *cli.Context, manager *user.Manager, username string
 	if err := manager.ResetAccess(username, topic); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "reset access for user %s and topic %s\n\n", username, topic)
+	fmt.Fprintf(c.App.ErrWriter, "reset access for user %s and topic %s\n\n", username, topic)
 	return showUserAccess(c, manager, username)
 }
 
@@ -177,7 +175,7 @@ func showAllAccess(c *cli.Context, manager *user.Manager) error {
 
 func showUserAccess(c *cli.Context, manager *user.Manager, username string) error {
 	users, err := manager.User(username)
-	if errors.Is(err, user.ErrUserNotFound) {
+	if err == user.ErrUserNotFound {
 		return fmt.Errorf("user %s does not exist", username)
 	} else if err != nil {
 		return err
@@ -195,42 +193,34 @@ func showUsers(c *cli.Context, manager *user.Manager, users []*user.User) error
 		if u.Tier != nil {
 			tier = u.Tier.Name
 		}
-		provisioned := ""
-		if u.Provisioned {
-			provisioned = ", server config"
-		}
-		fmt.Fprintf(c.App.Writer, "user %s (role: %s, tier: %s%s)\n", u.Name, u.Role, tier, provisioned)
+		fmt.Fprintf(c.App.ErrWriter, "user %s (role: %s, tier: %s)\n", u.Name, u.Role, tier)
 		if u.Role == user.RoleAdmin {
-			fmt.Fprintf(c.App.Writer, "- read-write access to all topics (admin role)\n")
+			fmt.Fprintf(c.App.ErrWriter, "- read-write access to all topics (admin role)\n")
 		} else if len(grants) > 0 {
 			for _, grant := range grants {
-				grantProvisioned := ""
-				if grant.Provisioned {
-					grantProvisioned = " (server config)"
-				}
-				if grant.Permission.IsReadWrite() {
-					fmt.Fprintf(c.App.Writer, "- read-write access to topic %s%s\n", grant.TopicPattern, grantProvisioned)
-				} else if grant.Permission.IsRead() {
-					fmt.Fprintf(c.App.Writer, "- read-only access to topic %s%s\n", grant.TopicPattern, grantProvisioned)
-				} else if grant.Permission.IsWrite() {
-					fmt.Fprintf(c.App.Writer, "- write-only access to topic %s%s\n", grant.TopicPattern, grantProvisioned)
+				if grant.Allow.IsReadWrite() {
+					fmt.Fprintf(c.App.ErrWriter, "- read-write access to topic %s\n", grant.TopicPattern)
+				} else if grant.Allow.IsRead() {
+					fmt.Fprintf(c.App.ErrWriter, "- read-only access to topic %s\n", grant.TopicPattern)
+				} else if grant.Allow.IsWrite() {
+					fmt.Fprintf(c.App.ErrWriter, "- write-only access to topic %s\n", grant.TopicPattern)
 				} else {
-					fmt.Fprintf(c.App.Writer, "- no access to topic %s%s\n", grant.TopicPattern, grantProvisioned)
+					fmt.Fprintf(c.App.ErrWriter, "- no access to topic %s\n", grant.TopicPattern)
 				}
 			}
 		} else {
-			fmt.Fprintf(c.App.Writer, "- no topic-specific permissions\n")
+			fmt.Fprintf(c.App.ErrWriter, "- no topic-specific permissions\n")
 		}
 		if u.Name == user.Everyone {
 			access := manager.DefaultAccess()
 			if access.IsReadWrite() {
-				fmt.Fprintln(c.App.Writer, "- read-write access to all (other) topics (server config)")
+				fmt.Fprintln(c.App.ErrWriter, "- read-write access to all (other) topics (server config)")
 			} else if access.IsRead() {
-				fmt.Fprintln(c.App.Writer, "- read-only access to all (other) topics (server config)")
+				fmt.Fprintln(c.App.ErrWriter, "- read-only access to all (other) topics (server config)")
 			} else if access.IsWrite() {
-				fmt.Fprintln(c.App.Writer, "- write-only access to all (other) topics (server config)")
+				fmt.Fprintln(c.App.ErrWriter, "- write-only access to all (other) topics (server config)")
 			} else {
-				fmt.Fprintln(c.App.Writer, "- no access to any (other) topics (server config)")
+				fmt.Fprintln(c.App.ErrWriter, "- no access to any (other) topics (server config)")
 			}
 		}
 	}

cmd/access_test.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"github.com/stretchr/testify/require"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/server"
-	"heckel.io/ntfy/v2/test"
+	"heckel.io/ntfy/server"
+	"heckel.io/ntfy/test"
 	"testing"
 )
 
@@ -13,9 +13,9 @@ func TestCLI_Access_Show(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
 	defer test.StopServer(t, s, port)
 
-	app, _, stdout, _ := newTestApp()
+	app, _, _, stderr := newTestApp()
 	require.Nil(t, runAccessCommand(app, conf))
-	require.Contains(t, stdout.String(), "user * (role: anonymous, tier: none)\n- no topic-specific permissions\n- no access to any (other) topics (server config)")
+	require.Contains(t, stderr.String(), "user * (role: anonymous, tier: none)\n- no topic-specific permissions\n- no access to any (other) topics (server config)")
 }
 
 func TestCLI_Access_Grant_And_Publish(t *testing.T) {
@@ -30,7 +30,7 @@ func TestCLI_Access_Grant_And_Publish(t *testing.T) {
 	require.Nil(t, runAccessCommand(app, conf, "ben", "sometopic", "read"))
 	require.Nil(t, runAccessCommand(app, conf, "everyone", "announcements", "read"))
 
-	app, _, stdout, _ := newTestApp()
+	app, _, _, stderr := newTestApp()
 	require.Nil(t, runAccessCommand(app, conf))
 	expected := `user phil (role: admin, tier: none)
 - read-write access to all topics (admin role)
@@ -41,7 +41,7 @@ user * (role: anonymous, tier: none)
 - read-only access to topic announcements
 - no access to any (other) topics (server config)
 `
-	require.Equal(t, expected, stdout.String())
+	require.Equal(t, expected, stderr.String())
 
 	// See if access permissions match
 	app, _, _, _ = newTestApp()

cmd/app.go

@@ -3,12 +3,11 @@ package cmd
 
 import (
 	"fmt"
-	"os"
-	"regexp"
-
 	"github.com/urfave/cli/v2"
 	"github.com/urfave/cli/v2/altsrc"
-	"heckel.io/ntfy/v2/log"
+	"heckel.io/ntfy/log"
+	"os"
+	"regexp"
 )
 
 const (
@@ -16,12 +15,6 @@ const (
 	categoryServer = "Server commands"
 )
 
-// Build metadata keys for app.Metadata
-const (
-	MetadataKeyCommit = "commit"
-	MetadataKeyDate   = "date"
-)
-
 var commands = make([]*cli.Command, 0)
 
 var flagsDefault = []cli.Flag{
@@ -44,7 +37,7 @@ func New() *cli.App {
 		Name:                   "ntfy",
 		Usage:                  "Simple pub-sub notification service",
 		UsageText:              "ntfy [OPTION..]",
-		HideVersion:            false,
+		HideVersion:            true,
 		UseShortOptionHandling: true,
 		Reader:                 os.Stdin,
 		Writer:                 os.Stdout,

cmd/app_test.go

@@ -4,8 +4,8 @@ import (
 	"bytes"
 	"encoding/json"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/client"
-	"heckel.io/ntfy/v2/log"
+	"heckel.io/ntfy/client"
+	"heckel.io/ntfy/log"
 	"os"
 	"strings"
 	"testing"

cmd/config_loader.go

@@ -5,7 +5,7 @@ import (
 	"github.com/urfave/cli/v2"
 	"github.com/urfave/cli/v2/altsrc"
 	"gopkg.in/yaml.v2"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/util"
 	"os"
 )
 

cmd/publish.go

@@ -4,9 +4,9 @@ import (
 	"errors"
 	"fmt"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/client"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/client"
+	"heckel.io/ntfy/log"
+	"heckel.io/ntfy/util"
 	"io"
 	"os"
 	"os/exec"
@@ -32,9 +32,7 @@ var flagsPublish = append(
 	&cli.StringFlag{Name: "actions", Aliases: []string{"A"}, EnvVars: []string{"NTFY_ACTIONS"}, Usage: "actions JSON array or simple definition"},
 	&cli.StringFlag{Name: "attach", Aliases: []string{"a"}, EnvVars: []string{"NTFY_ATTACH"}, Usage: "URL to send as an external attachment"},
 	&cli.BoolFlag{Name: "markdown", Aliases: []string{"md"}, EnvVars: []string{"NTFY_MARKDOWN"}, Usage: "Message is formatted as Markdown"},
-	&cli.StringFlag{Name: "template", Aliases: []string{"tpl"}, EnvVars: []string{"NTFY_TEMPLATE"}, Usage: "use templates to transform JSON message body"},
 	&cli.StringFlag{Name: "filename", Aliases: []string{"name", "n"}, EnvVars: []string{"NTFY_FILENAME"}, Usage: "filename for the attachment"},
-	&cli.StringFlag{Name: "sequence-id", Aliases: []string{"sequence_id", "sid", "S"}, EnvVars: []string{"NTFY_SEQUENCE_ID"}, Usage: "sequence ID for updating notifications"},
 	&cli.StringFlag{Name: "file", Aliases: []string{"f"}, EnvVars: []string{"NTFY_FILE"}, Usage: "file to upload as an attachment"},
 	&cli.StringFlag{Name: "email", Aliases: []string{"mail", "e"}, EnvVars: []string{"NTFY_EMAIL"}, Usage: "also send to e-mail address"},
 	&cli.StringFlag{Name: "user", Aliases: []string{"u"}, EnvVars: []string{"NTFY_USER"}, Usage: "username[:password] used to auth against the server"},
@@ -71,8 +69,6 @@ Examples:
   ntfy pub --icon="http://some.tld/icon.png" 'Icon!'      # Send notification with custom icon
   ntfy pub --attach="http://some.tld/file.zip" files      # Send ZIP archive from URL as attachment
   ntfy pub --file=flower.jpg flowers 'Nice!'              # Send image.jpg as attachment
-  ntfy pub -S my-id mytopic 'Update me'                   # Send with sequence ID for updates
-  echo 'message' | ntfy publish mytopic                   # Send message from stdin
   ntfy pub -u phil:mypass secret Psst                     # Publish with username/password
   ntfy pub --wait-pid 1234 mytopic                        # Wait for process 1234 to exit before publishing
   ntfy pub --wait-cmd mytopic rsync -av ./ /tmp/a         # Run command and publish after it completes
@@ -101,9 +97,7 @@ func execPublish(c *cli.Context) error {
 	actions := c.String("actions")
 	attach := c.String("attach")
 	markdown := c.Bool("markdown")
-	template := c.String("template")
 	filename := c.String("filename")
-	sequenceID := c.String("sequence-id")
 	file := c.String("file")
 	email := c.String("email")
 	user := c.String("user")
@@ -151,15 +145,9 @@ func execPublish(c *cli.Context) error {
 	if markdown {
 		options = append(options, client.WithMarkdown())
 	}
-	if template != "" {
-		options = append(options, client.WithTemplate(template))
-	}
 	if filename != "" {
 		options = append(options, client.WithFilename(filename))
 	}
-	if sequenceID != "" {
-		options = append(options, client.WithSequenceID(sequenceID))
-	}
 	if email != "" {
 		options = append(options, client.WithEmail(email))
 	}
@@ -266,15 +254,6 @@ func parseTopicMessageCommand(c *cli.Context) (topic string, message string, com
 	if c.String("message") != "" {
 		message = c.String("message")
 	}
-	if message == "" && isStdinRedirected() {
-		var data []byte
-		data, err = io.ReadAll(io.LimitReader(c.App.Reader, 1024*1024))
-		if err != nil {
-			log.Debug("Failed to read from stdin: %s", err.Error())
-			return
-		}
-		message = strings.TrimSpace(string(data))
-	}
 	return
 }
 
@@ -333,12 +312,3 @@ func runAndWaitForCommand(command []string) (message string, err error) {
 	log.Debug("Command succeeded after %s: %s", runtime, prettyCmd)
 	return fmt.Sprintf("Command succeeded after %s: %s", runtime, prettyCmd), nil
 }
-
-func isStdinRedirected() bool {
-	stat, err := os.Stdin.Stat()
-	if err != nil {
-		log.Debug("Failed to stat stdin: %s", err.Error())
-		return false
-	}
-	return (stat.Mode() & os.ModeCharDevice) == 0
-}

cmd/publish_test.go

@@ -2,6 +2,9 @@ package cmd
 
 import (
 	"fmt"
+	"github.com/stretchr/testify/require"
+	"heckel.io/ntfy/test"
+	"heckel.io/ntfy/util"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -11,14 +14,9 @@ import (
 	"strings"
 	"testing"
 	"time"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/test"
-	"heckel.io/ntfy/v2/util"
 )
 
 func TestCLI_Publish_Subscribe_Poll_Real_Server(t *testing.T) {
-	t.Skip("temporarily disabled") // FIXME
 	testMessage := util.RandomString(10)
 	app, _, _, _ := newTestApp()
 	require.Nil(t, app.Run([]string{"ntfy", "publish", "ntfytest", "ntfy unit test " + testMessage}))

cmd/publish_unix.go

@@ -1,4 +1,5 @@
 //go:build darwin || linux || dragonfly || freebsd || netbsd || openbsd
+// +build darwin linux dragonfly freebsd netbsd openbsd
 
 package cmd
 

cmd/serve.go

@@ -5,35 +5,37 @@ package cmd
 import (
 	"errors"
 	"fmt"
+	"github.com/stripe/stripe-go/v74"
+	"heckel.io/ntfy/user"
 	"io/fs"
 	"math"
 	"net"
 	"net/netip"
-	"net/url"
-	"path/filepath"
-	"runtime"
+	"os"
+	"os/signal"
 	"strings"
-	"text/template"
+	"syscall"
 	"time"
 
+	"heckel.io/ntfy/log"
+
 	"github.com/urfave/cli/v2"
 	"github.com/urfave/cli/v2/altsrc"
-	"heckel.io/ntfy/v2/ban"
-	"heckel.io/ntfy/v2/cluster"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/payments"
-	"heckel.io/ntfy/v2/server"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/server"
+	"heckel.io/ntfy/util"
 )
 
 func init() {
 	commands = append(commands, cmdServe)
 }
 
+const (
+	defaultServerConfigFile = "/etc/ntfy/server.yml"
+)
+
 var flagsServe = append(
 	append([]cli.Flag{}, flagsDefault...),
-	&cli.StringFlag{Name: "config", Aliases: []string{"c"}, EnvVars: []string{"NTFY_CONFIG_FILE"}, Value: server.DefaultConfigFile, Usage: "config file"},
+	&cli.StringFlag{Name: "config", Aliases: []string{"c"}, EnvVars: []string{"NTFY_CONFIG_FILE"}, Value: defaultServerConfigFile, DefaultText: defaultServerConfigFile, Usage: "config file"},
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "base-url", Aliases: []string{"base_url", "B"}, EnvVars: []string{"NTFY_BASE_URL"}, Usage: "externally visible base URL for this host (e.g. https://ntfy.sh)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "listen-http", Aliases: []string{"listen_http", "l"}, EnvVars: []string{"NTFY_LISTEN_HTTP"}, Value: server.DefaultListenHTTP, Usage: "ip:port used as HTTP listen address"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "listen-https", Aliases: []string{"listen_https", "L"}, EnvVars: []string{"NTFY_LISTEN_HTTPS"}, Usage: "ip:port used as HTTPS listen address"}),
@@ -42,45 +44,32 @@ var flagsServe = append(
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "key-file", Aliases: []string{"key_file", "K"}, EnvVars: []string{"NTFY_KEY_FILE"}, Usage: "private key file, if listen-https is set"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "cert-file", Aliases: []string{"cert_file", "E"}, EnvVars: []string{"NTFY_CERT_FILE"}, Usage: "certificate file, if listen-https is set"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "firebase-key-file", Aliases: []string{"firebase_key_file", "F"}, EnvVars: []string{"NTFY_FIREBASE_KEY_FILE"}, Usage: "Firebase credentials file; if set additionally publish to FCM topic"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "database-url", Aliases: []string{"database_url"}, EnvVars: []string{"NTFY_DATABASE_URL"}, Usage: "PostgreSQL connection string for database-backed stores (e.g. postgres://user:pass@host:5432/ntfy)"}),
-	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "database-replica-urls", Aliases: []string{"database_replica_urls"}, EnvVars: []string{"NTFY_DATABASE_REPLICA_URLS"}, Usage: "PostgreSQL read replica connection strings for offloading read queries"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cluster-node-id", Aliases: []string{"cluster_node_id"}, EnvVars: []string{"NTFY_CLUSTER_NODE_ID"}, Usage: "stable per-node identifier for the cluster node registry (required in cluster mode)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cluster-listen", Aliases: []string{"cluster_listen"}, EnvVars: []string{"NTFY_CLUSTER_LISTEN"}, Usage: "ip:port for the dedicated cluster fan-out listener; bind it to the private network (e.g. 10.0.0.5:2587)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cluster-advertise-url", Aliases: []string{"cluster_advertise_url"}, EnvVars: []string{"NTFY_CLUSTER_ADVERTISE_URL"}, Usage: "base URL peer nodes use to reach this node's fan-out listener (defaults to http://<cluster-listen>)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cluster-secret", Aliases: []string{"cluster_secret"}, EnvVars: []string{"NTFY_CLUSTER_SECRET"}, Usage: "shared secret authenticating node-to-node fan-out requests"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cluster-batch-linger", Aliases: []string{"cluster_batch_linger"}, EnvVars: []string{"NTFY_CLUSTER_BATCH_LINGER"}, Value: util.FormatDuration(cluster.DefaultBatchLinger), Usage: "how long fan-out messages wait to form a batch per peer node (0 = send immediately)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "cache-file", Aliases: []string{"cache_file", "C"}, EnvVars: []string{"NTFY_CACHE_FILE"}, Usage: "cache file used for message caching"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cache-duration", Aliases: []string{"cache_duration", "b"}, EnvVars: []string{"NTFY_CACHE_DURATION"}, Value: util.FormatDuration(server.DefaultCacheDuration), Usage: "buffer messages for this time to allow `since` requests"}),
+	altsrc.NewDurationFlag(&cli.DurationFlag{Name: "cache-duration", Aliases: []string{"cache_duration", "b"}, EnvVars: []string{"NTFY_CACHE_DURATION"}, Value: server.DefaultCacheDuration, Usage: "buffer messages for this time to allow `since` requests"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "cache-batch-size", Aliases: []string{"cache_batch_size"}, EnvVars: []string{"NTFY_BATCH_SIZE"}, Usage: "max size of messages to batch together when writing to message cache (if zero, writes are synchronous)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cache-batch-timeout", Aliases: []string{"cache_batch_timeout"}, EnvVars: []string{"NTFY_CACHE_BATCH_TIMEOUT"}, Value: util.FormatDuration(server.DefaultCacheBatchTimeout), Usage: "timeout for batched async writes to the message cache (if zero, writes are synchronous)"}),
+	altsrc.NewDurationFlag(&cli.DurationFlag{Name: "cache-batch-timeout", Aliases: []string{"cache_batch_timeout"}, EnvVars: []string{"NTFY_CACHE_BATCH_TIMEOUT"}, Usage: "timeout for batched async writes to the message cache (if zero, writes are synchronous)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "cache-startup-queries", Aliases: []string{"cache_startup_queries"}, EnvVars: []string{"NTFY_CACHE_STARTUP_QUERIES"}, Usage: "queries run when the cache database is initialized"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "auth-file", Aliases: []string{"auth_file", "H"}, EnvVars: []string{"NTFY_AUTH_FILE"}, Usage: "auth database file used for access control"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "auth-startup-queries", Aliases: []string{"auth_startup_queries"}, EnvVars: []string{"NTFY_AUTH_STARTUP_QUERIES"}, Usage: "queries run when the auth database is initialized"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "auth-default-access", Aliases: []string{"auth_default_access", "p"}, EnvVars: []string{"NTFY_AUTH_DEFAULT_ACCESS"}, Value: "read-write", Usage: "default permissions if no matching entries in the auth database are found"}),
-	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "auth-users", Aliases: []string{"auth_users"}, EnvVars: []string{"NTFY_AUTH_USERS"}, Usage: "pre-provisioned declarative users"}),
-	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "auth-access", Aliases: []string{"auth_access"}, EnvVars: []string{"NTFY_AUTH_ACCESS"}, Usage: "pre-provisioned declarative access control entries"}),
-	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "auth-tokens", Aliases: []string{"auth_tokens"}, EnvVars: []string{"NTFY_AUTH_TOKENS"}, Usage: "pre-provisioned declarative access tokens"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "auth-access-cache", Aliases: []string{"auth_access_cache"}, EnvVars: []string{"NTFY_AUTH_ACCESS_CACHE"}, Value: user.DefaultAccessCacheEnabled, Usage: "enables the in-memory ACL cache (high-volume servers only)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-cache-dir", Aliases: []string{"attachment_cache_dir"}, EnvVars: []string{"NTFY_ATTACHMENT_CACHE_DIR"}, Usage: "cache directory for attached files, or S3 URL (s3://ACCESS_KEY:SECRET_KEY@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT])"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-total-size-limit", Aliases: []string{"attachment_total_size_limit", "A"}, EnvVars: []string{"NTFY_ATTACHMENT_TOTAL_SIZE_LIMIT"}, Value: util.FormatSize(server.DefaultAttachmentTotalSizeLimit), Usage: "limit of the on-disk attachment cache"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-file-size-limit", Aliases: []string{"attachment_file_size_limit", "Y"}, EnvVars: []string{"NTFY_ATTACHMENT_FILE_SIZE_LIMIT"}, Value: util.FormatSize(server.DefaultAttachmentFileSizeLimit), Usage: "per-file attachment size limit (e.g. 300k, 2M, 100M)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-expiry-duration", Aliases: []string{"attachment_expiry_duration", "X"}, EnvVars: []string{"NTFY_ATTACHMENT_EXPIRY_DURATION"}, Value: util.FormatDuration(server.DefaultAttachmentExpiryDuration), Usage: "duration after which uploaded attachments will be deleted (e.g. 3h, 20h)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "template-dir", Aliases: []string{"template_dir"}, EnvVars: []string{"NTFY_TEMPLATE_DIR"}, Value: server.DefaultTemplateDir, Usage: "directory to load named message templates from"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "keepalive-interval", Aliases: []string{"keepalive_interval", "k"}, EnvVars: []string{"NTFY_KEEPALIVE_INTERVAL"}, Value: util.FormatDuration(server.DefaultKeepaliveInterval), Usage: "interval of keepalive messages"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "manager-interval", Aliases: []string{"manager_interval", "m"}, EnvVars: []string{"NTFY_MANAGER_INTERVAL"}, Value: util.FormatDuration(server.DefaultManagerInterval), Usage: "interval of for message pruning and stats printing"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "auth-user-header", Aliases: []string{"auth_user_header"}, EnvVars: []string{"NTFY_AUTH_USER_HEADER"}, Usage: "HTTP header that may be used to pass an authenticated user from a proxy, e.g. X-Forwarded-User"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-cache-dir", Aliases: []string{"attachment_cache_dir"}, EnvVars: []string{"NTFY_ATTACHMENT_CACHE_DIR"}, Usage: "cache directory for attached files"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-total-size-limit", Aliases: []string{"attachment_total_size_limit", "A"}, EnvVars: []string{"NTFY_ATTACHMENT_TOTAL_SIZE_LIMIT"}, DefaultText: "5G", Usage: "limit of the on-disk attachment cache"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-file-size-limit", Aliases: []string{"attachment_file_size_limit", "Y"}, EnvVars: []string{"NTFY_ATTACHMENT_FILE_SIZE_LIMIT"}, DefaultText: "15M", Usage: "per-file attachment size limit (e.g. 300k, 2M, 100M)"}),
+	altsrc.NewDurationFlag(&cli.DurationFlag{Name: "attachment-expiry-duration", Aliases: []string{"attachment_expiry_duration", "X"}, EnvVars: []string{"NTFY_ATTACHMENT_EXPIRY_DURATION"}, Value: server.DefaultAttachmentExpiryDuration, DefaultText: "3h", Usage: "duration after which uploaded attachments will be deleted (e.g. 3h, 20h)"}),
+	altsrc.NewDurationFlag(&cli.DurationFlag{Name: "keepalive-interval", Aliases: []string{"keepalive_interval", "k"}, EnvVars: []string{"NTFY_KEEPALIVE_INTERVAL"}, Value: server.DefaultKeepaliveInterval, Usage: "interval of keepalive messages"}),
+	altsrc.NewDurationFlag(&cli.DurationFlag{Name: "manager-interval", Aliases: []string{"manager_interval", "m"}, EnvVars: []string{"NTFY_MANAGER_INTERVAL"}, Value: server.DefaultManagerInterval, Usage: "interval of for message pruning and stats printing"}),
 	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "disallowed-topics", Aliases: []string{"disallowed_topics"}, EnvVars: []string{"NTFY_DISALLOWED_TOPICS"}, Usage: "topics that are not allowed to be used"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-root", Aliases: []string{"web_root"}, EnvVars: []string{"NTFY_WEB_ROOT"}, Value: "/", Usage: "sets root of the web app (e.g. /, or /app), or disables it (disable)"}),
 	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "enable-signup", Aliases: []string{"enable_signup"}, EnvVars: []string{"NTFY_ENABLE_SIGNUP"}, Value: false, Usage: "allows users to sign up via the web app, or API"}),
 	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "enable-login", Aliases: []string{"enable_login"}, EnvVars: []string{"NTFY_ENABLE_LOGIN"}, Value: false, Usage: "allows users to log in via the web app, or API"}),
 	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "enable-reservations", Aliases: []string{"enable_reservations"}, EnvVars: []string{"NTFY_ENABLE_RESERVATIONS"}, Value: false, Usage: "allows users to reserve topics (if their tier allows it)"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "require-login", Aliases: []string{"require_login"}, EnvVars: []string{"NTFY_REQUIRE_LOGIN"}, Value: false, Usage: "all actions via the web app requires a login"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "upstream-base-url", Aliases: []string{"upstream_base_url"}, EnvVars: []string{"NTFY_UPSTREAM_BASE_URL"}, Value: "", Usage: "forward poll request to an upstream server, this is needed for iOS push notifications for self-hosted servers"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "upstream-access-token", Aliases: []string{"upstream_access_token"}, EnvVars: []string{"NTFY_UPSTREAM_ACCESS_TOKEN"}, Value: "", Usage: "access token to use for the upstream server; needed only if upstream rate limits are exceeded or upstream server requires auth"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-addr", Aliases: []string{"smtp_sender_addr"}, EnvVars: []string{"NTFY_SMTP_SENDER_ADDR"}, Usage: "SMTP server address (host:port) for outgoing emails"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-user", Aliases: []string{"smtp_sender_user"}, EnvVars: []string{"NTFY_SMTP_SENDER_USER"}, Usage: "SMTP user (if e-mail sending is enabled)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-pass", Aliases: []string{"smtp_sender_pass"}, EnvVars: []string{"NTFY_SMTP_SENDER_PASS"}, Usage: "SMTP password (if e-mail sending is enabled)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-from", Aliases: []string{"smtp_sender_from"}, EnvVars: []string{"NTFY_SMTP_SENDER_FROM"}, Usage: "SMTP sender address (if e-mail sending is enabled)"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "smtp-sender-verify", Aliases: []string{"smtp_sender_verify"}, EnvVars: []string{"NTFY_SMTP_SENDER_VERIFY"}, Value: false, Usage: "require verified email addresses for sending email notifications"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-server-listen", Aliases: []string{"smtp_server_listen"}, EnvVars: []string{"NTFY_SMTP_SERVER_LISTEN"}, Usage: "SMTP server address (ip:port) for incoming emails, e.g. :25"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-server-domain", Aliases: []string{"smtp_server_domain"}, EnvVars: []string{"NTFY_SMTP_SERVER_DOMAIN"}, Usage: "SMTP domain for incoming e-mail, e.g. ntfy.sh"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-server-addr-prefix", Aliases: []string{"smtp_server_addr_prefix"}, EnvVars: []string{"NTFY_SMTP_SERVER_ADDR_PREFIX"}, Usage: "SMTP email address prefix for topics to prevent spam (e.g. 'ntfy-')"}),
@@ -88,31 +77,18 @@ var flagsServe = append(
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "twilio-auth-token", Aliases: []string{"twilio_auth_token"}, EnvVars: []string{"NTFY_TWILIO_AUTH_TOKEN"}, Usage: "Twilio auth token"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "twilio-phone-number", Aliases: []string{"twilio_phone_number"}, EnvVars: []string{"NTFY_TWILIO_PHONE_NUMBER"}, Usage: "Twilio number to use for outgoing calls"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "twilio-verify-service", Aliases: []string{"twilio_verify_service"}, EnvVars: []string{"NTFY_TWILIO_VERIFY_SERVICE"}, Usage: "Twilio Verify service ID, used for phone number verification"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "twilio-call-format", Aliases: []string{"twilio_call_format"}, EnvVars: []string{"NTFY_TWILIO_CALL_FORMAT"}, Usage: "Twilio/TwiML format string for phone calls"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "message-size-limit", Aliases: []string{"message_size_limit"}, EnvVars: []string{"NTFY_MESSAGE_SIZE_LIMIT"}, Value: util.FormatSize(server.DefaultMessageSizeLimit), Usage: "size limit for the message (see docs for limitations)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "message-delay-limit", Aliases: []string{"message_delay_limit"}, EnvVars: []string{"NTFY_MESSAGE_DELAY_LIMIT"}, Value: util.FormatDuration(server.DefaultMessageDelayMax), Usage: "max duration a message can be scheduled into the future"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "global-topic-limit", Aliases: []string{"global_topic_limit", "T"}, EnvVars: []string{"NTFY_GLOBAL_TOPIC_LIMIT"}, Value: server.DefaultTotalTopicLimit, Usage: "total number of topics allowed"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-subscription-limit", Aliases: []string{"visitor_subscription_limit"}, EnvVars: []string{"NTFY_VISITOR_SUBSCRIPTION_LIMIT"}, Value: server.DefaultVisitorSubscriptionLimit, Usage: "number of subscriptions per visitor"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "visitor-subscriber-rate-limiting", Aliases: []string{"visitor_subscriber_rate_limiting"}, EnvVars: []string{"NTFY_VISITOR_SUBSCRIBER_RATE_LIMITING"}, Value: false, Usage: "enables subscriber-based rate limiting"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-attachment-total-size-limit", Aliases: []string{"visitor_attachment_total_size_limit"}, EnvVars: []string{"NTFY_VISITOR_ATTACHMENT_TOTAL_SIZE_LIMIT"}, Value: util.FormatSize(server.DefaultVisitorAttachmentTotalSizeLimit), Usage: "total storage limit used for attachments per visitor"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-attachment-total-size-limit", Aliases: []string{"visitor_attachment_total_size_limit"}, EnvVars: []string{"NTFY_VISITOR_ATTACHMENT_TOTAL_SIZE_LIMIT"}, Value: "100M", Usage: "total storage limit used for attachments per visitor"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-attachment-daily-bandwidth-limit", Aliases: []string{"visitor_attachment_daily_bandwidth_limit"}, EnvVars: []string{"NTFY_VISITOR_ATTACHMENT_DAILY_BANDWIDTH_LIMIT"}, Value: "500M", Usage: "total daily attachment download/upload bandwidth limit per visitor"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-request-limit-burst", Aliases: []string{"visitor_request_limit_burst"}, EnvVars: []string{"NTFY_VISITOR_REQUEST_LIMIT_BURST"}, Value: server.DefaultVisitorRequestLimitBurst, Usage: "initial limit of requests per visitor"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-request-limit-replenish", Aliases: []string{"visitor_request_limit_replenish"}, EnvVars: []string{"NTFY_VISITOR_REQUEST_LIMIT_REPLENISH"}, Value: util.FormatDuration(server.DefaultVisitorRequestLimitReplenish), Usage: "interval at which burst limit is replenished (one per x)"}),
+	altsrc.NewDurationFlag(&cli.DurationFlag{Name: "visitor-request-limit-replenish", Aliases: []string{"visitor_request_limit_replenish"}, EnvVars: []string{"NTFY_VISITOR_REQUEST_LIMIT_REPLENISH"}, Value: server.DefaultVisitorRequestLimitReplenish, Usage: "interval at which burst limit is replenished (one per x)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-request-limit-exempt-hosts", Aliases: []string{"visitor_request_limit_exempt_hosts"}, EnvVars: []string{"NTFY_VISITOR_REQUEST_LIMIT_EXEMPT_HOSTS"}, Value: "", Usage: "hostnames and/or IP addresses of hosts that will be exempt from the visitor request limit"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-message-daily-limit", Aliases: []string{"visitor_message_daily_limit"}, EnvVars: []string{"NTFY_VISITOR_MESSAGE_DAILY_LIMIT"}, Value: server.DefaultVisitorMessageDailyLimit, Usage: "max messages per visitor per day, derived from request limit if unset"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-email-limit-burst", Aliases: []string{"visitor_email_limit_burst"}, EnvVars: []string{"NTFY_VISITOR_EMAIL_LIMIT_BURST"}, Value: server.DefaultVisitorEmailLimitBurst, Usage: "initial limit of e-mails per visitor"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-email-limit-replenish", Aliases: []string{"visitor_email_limit_replenish"}, EnvVars: []string{"NTFY_VISITOR_EMAIL_LIMIT_REPLENISH"}, Value: util.FormatDuration(server.DefaultVisitorEmailLimitReplenish), Usage: "interval at which burst limit is replenished (one per x)"}),
-	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-topic-creation-limit-burst", Aliases: []string{"visitor_topic_creation_limit_burst"}, EnvVars: []string{"NTFY_VISITOR_TOPIC_CREATION_LIMIT_BURST"}, Value: server.DefaultVisitorTopicCreationLimitBurst, Usage: "burst of new topic creations per visitor (0 = disabled)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-topic-creation-limit-replenish", Aliases: []string{"visitor_topic_creation_limit_replenish"}, EnvVars: []string{"NTFY_VISITOR_TOPIC_CREATION_LIMIT_REPLENISH"}, Value: util.FormatDuration(server.DefaultVisitorTopicCreationLimitReplenish), Usage: "interval at which topic-creation tokens are refilled (one per x)"}),
-	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-prefix-bits-ipv4", Aliases: []string{"visitor_prefix_bits_ipv4"}, EnvVars: []string{"NTFY_VISITOR_PREFIX_BITS_IPV4"}, Value: server.DefaultVisitorPrefixBitsIPv4, Usage: "number of bits of the IPv4 address to use for rate limiting (default: 32, full address)"}),
-	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-prefix-bits-ipv6", Aliases: []string{"visitor_prefix_bits_ipv6"}, EnvVars: []string{"NTFY_VISITOR_PREFIX_BITS_IPV6"}, Value: server.DefaultVisitorPrefixBitsIPv6, Usage: "number of bits of the IPv6 address to use for rate limiting (default: 64, /64 subnet)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "ban-file", Aliases: []string{"ban_file"}, EnvVars: []string{"NTFY_BAN_FILE"}, Value: "", Usage: "if set, append IPs of abusive visitors to this file for fail2ban to tail (empty disables)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "ban-window", Aliases: []string{"ban_window"}, EnvVars: []string{"NTFY_BAN_WINDOW"}, Value: util.FormatDuration(server.DefaultBanWindow), Usage: "rolling window over which weighted strikes are counted for the ban file"}),
-	altsrc.NewIntFlag(&cli.IntFlag{Name: "ban-threshold", Aliases: []string{"ban_threshold"}, EnvVars: []string{"NTFY_BAN_THRESHOLD"}, Value: server.DefaultBanThreshold, Usage: "weighted strikes per window before an offender is banned"}),
-	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "ban-weights", Aliases: []string{"ban_weights"}, EnvVars: []string{"NTFY_BAN_WEIGHTS"}, Value: cli.NewStringSlice(server.DefaultBanWeights...), Usage: "per-code strike weights as KEY:WEIGHT, where KEY is an ntfy code, an HTTP status, a PREFIX*, or '*' (weight 0 exempts)"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "behind-proxy", Aliases: []string{"behind_proxy", "P"}, EnvVars: []string{"NTFY_BEHIND_PROXY"}, Value: false, Usage: "if set, use forwarded header (e.g. X-Forwarded-For, X-Client-IP) to determine visitor IP address (for rate limiting)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "proxy-forwarded-header", Aliases: []string{"proxy_forwarded_header"}, EnvVars: []string{"NTFY_PROXY_FORWARDED_HEADER"}, Value: "X-Forwarded-For", Usage: "use specified header to determine visitor IP address (for rate limiting)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "proxy-trusted-hosts", Aliases: []string{"proxy_trusted_hosts"}, EnvVars: []string{"NTFY_PROXY_TRUSTED_HOSTS"}, Value: "", Usage: "comma-separated list of trusted IP addresses, hosts, or CIDRs to remove from forwarded header"}),
+	altsrc.NewDurationFlag(&cli.DurationFlag{Name: "visitor-email-limit-replenish", Aliases: []string{"visitor_email_limit_replenish"}, EnvVars: []string{"NTFY_VISITOR_EMAIL_LIMIT_REPLENISH"}, Value: server.DefaultVisitorEmailLimitReplenish, Usage: "interval at which burst limit is replenished (one per x)"}),
+	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "visitor-subscriber-rate-limiting", Aliases: []string{"visitor_subscriber_rate_limiting"}, EnvVars: []string{"NTFY_VISITOR_SUBSCRIBER_RATE_LIMITING"}, Value: false, Usage: "enables subscriber-based rate limiting"}),
+	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "behind-proxy", Aliases: []string{"behind_proxy", "P"}, EnvVars: []string{"NTFY_BEHIND_PROXY"}, Value: false, Usage: "if set, use X-Forwarded-For header to determine visitor IP address (for rate limiting)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "stripe-secret-key", Aliases: []string{"stripe_secret_key"}, EnvVars: []string{"NTFY_STRIPE_SECRET_KEY"}, Value: "", Usage: "key used for the Stripe API communication, this enables payments"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "stripe-webhook-key", Aliases: []string{"stripe_webhook_key"}, EnvVars: []string{"NTFY_STRIPE_WEBHOOK_KEY"}, Value: "", Usage: "key required to validate the authenticity of incoming webhooks from Stripe"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "billing-contact", Aliases: []string{"billing_contact"}, EnvVars: []string{"NTFY_BILLING_CONTACT"}, Value: "", Usage: "e-mail or website to display in upgrade dialog (only if payments are enabled)"}),
@@ -124,8 +100,6 @@ var flagsServe = append(
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-push-file", Aliases: []string{"web_push_file"}, EnvVars: []string{"NTFY_WEB_PUSH_FILE"}, Usage: "file used to store web push subscriptions"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-push-email-address", Aliases: []string{"web_push_email_address"}, EnvVars: []string{"NTFY_WEB_PUSH_EMAIL_ADDRESS"}, Usage: "e-mail address of sender, required to use browser push services"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-push-startup-queries", Aliases: []string{"web_push_startup_queries"}, EnvVars: []string{"NTFY_WEB_PUSH_STARTUP_QUERIES"}, Usage: "queries run when the web push database is initialized"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-push-expiry-duration", Aliases: []string{"web_push_expiry_duration"}, EnvVars: []string{"NTFY_WEB_PUSH_EXPIRY_DURATION"}, Value: util.FormatDuration(server.DefaultWebPushExpiryDuration), Usage: "automatically expire unused subscriptions after this time"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-push-expiry-warning-duration", Aliases: []string{"web_push_expiry_warning_duration"}, EnvVars: []string{"NTFY_WEB_PUSH_EXPIRY_WARNING_DURATION"}, Value: util.FormatDuration(server.DefaultWebPushExpiryWarningDuration), Usage: "send web push warning notification after this time before expiring unused subscriptions"}),
 )
 
 var cmdServe = &cli.Command{
@@ -153,7 +127,7 @@ func execServe(c *cli.Context) error {
 
 	// Read all the options
 	config := c.String("config")
-	baseURL := strings.TrimSuffix(c.String("base-url"), "/")
+	baseURL := c.String("base-url")
 	listenHTTP := c.String("listen-http")
 	listenHTTPS := c.String("listen-https")
 	listenUnix := c.String("listen-unix")
@@ -161,44 +135,30 @@ func execServe(c *cli.Context) error {
 	keyFile := c.String("key-file")
 	certFile := c.String("cert-file")
 	firebaseKeyFile := c.String("firebase-key-file")
-	databaseURL := c.String("database-url")
-	databaseReplicaURLs := c.StringSlice("database-replica-urls")
-	clusterNodeID := c.String("cluster-node-id")
-	clusterListen := c.String("cluster-listen")
-	clusterAdvertiseURL := c.String("cluster-advertise-url")
-	clusterSecret := c.String("cluster-secret")
-	clusterBatchLingerStr := c.String("cluster-batch-linger")
 	webPushPrivateKey := c.String("web-push-private-key")
 	webPushPublicKey := c.String("web-push-public-key")
 	webPushFile := c.String("web-push-file")
 	webPushEmailAddress := c.String("web-push-email-address")
 	webPushStartupQueries := c.String("web-push-startup-queries")
-	webPushExpiryDurationStr := c.String("web-push-expiry-duration")
-	webPushExpiryWarningDurationStr := c.String("web-push-expiry-warning-duration")
 	cacheFile := c.String("cache-file")
-	cacheDurationStr := c.String("cache-duration")
+	cacheDuration := c.Duration("cache-duration")
 	cacheStartupQueries := c.String("cache-startup-queries")
 	cacheBatchSize := c.Int("cache-batch-size")
-	cacheBatchTimeoutStr := c.String("cache-batch-timeout")
+	cacheBatchTimeout := c.Duration("cache-batch-timeout")
 	authFile := c.String("auth-file")
 	authStartupQueries := c.String("auth-startup-queries")
 	authDefaultAccess := c.String("auth-default-access")
-	authUsersRaw := c.StringSlice("auth-users")
-	authAccessRaw := c.StringSlice("auth-access")
-	authTokensRaw := c.StringSlice("auth-tokens")
-	authAccessCacheEnabled := c.Bool("auth-access-cache")
+	authUserHeader := c.String("auth-user-header")
 	attachmentCacheDir := c.String("attachment-cache-dir")
 	attachmentTotalSizeLimitStr := c.String("attachment-total-size-limit")
 	attachmentFileSizeLimitStr := c.String("attachment-file-size-limit")
-	attachmentExpiryDurationStr := c.String("attachment-expiry-duration")
-	templateDir := c.String("template-dir")
-	keepaliveIntervalStr := c.String("keepalive-interval")
-	managerIntervalStr := c.String("manager-interval")
+	attachmentExpiryDuration := c.Duration("attachment-expiry-duration")
+	keepaliveInterval := c.Duration("keepalive-interval")
+	managerInterval := c.Duration("manager-interval")
 	disallowedTopics := c.StringSlice("disallowed-topics")
 	webRoot := c.String("web-root")
 	enableSignup := c.Bool("enable-signup")
 	enableLogin := c.Bool("enable-login")
-	requireLogin := c.Bool("require-login")
 	enableReservations := c.Bool("enable-reservations")
 	upstreamBaseURL := c.String("upstream-base-url")
 	upstreamAccessToken := c.String("upstream-access-token")
@@ -206,7 +166,6 @@ func execServe(c *cli.Context) error {
 	smtpSenderUser := c.String("smtp-sender-user")
 	smtpSenderPass := c.String("smtp-sender-pass")
 	smtpSenderFrom := c.String("smtp-sender-from")
-	smtpSenderVerify := c.Bool("smtp-sender-verify")
 	smtpServerListen := c.String("smtp-server-listen")
 	smtpServerDomain := c.String("smtp-server-domain")
 	smtpServerAddrPrefix := c.String("smtp-server-addr-prefix")
@@ -214,31 +173,18 @@ func execServe(c *cli.Context) error {
 	twilioAuthToken := c.String("twilio-auth-token")
 	twilioPhoneNumber := c.String("twilio-phone-number")
 	twilioVerifyService := c.String("twilio-verify-service")
-	twilioCallFormat := c.String("twilio-call-format")
-	messageSizeLimitStr := c.String("message-size-limit")
-	messageDelayLimitStr := c.String("message-delay-limit")
 	totalTopicLimit := c.Int("global-topic-limit")
 	visitorSubscriptionLimit := c.Int("visitor-subscription-limit")
 	visitorSubscriberRateLimiting := c.Bool("visitor-subscriber-rate-limiting")
 	visitorAttachmentTotalSizeLimitStr := c.String("visitor-attachment-total-size-limit")
 	visitorAttachmentDailyBandwidthLimitStr := c.String("visitor-attachment-daily-bandwidth-limit")
 	visitorRequestLimitBurst := c.Int("visitor-request-limit-burst")
-	visitorRequestLimitReplenishStr := c.String("visitor-request-limit-replenish")
+	visitorRequestLimitReplenish := c.Duration("visitor-request-limit-replenish")
 	visitorRequestLimitExemptHosts := util.SplitNoEmpty(c.String("visitor-request-limit-exempt-hosts"), ",")
 	visitorMessageDailyLimit := c.Int("visitor-message-daily-limit")
 	visitorEmailLimitBurst := c.Int("visitor-email-limit-burst")
-	visitorEmailLimitReplenishStr := c.String("visitor-email-limit-replenish")
-	visitorTopicCreationLimitBurst := c.Int("visitor-topic-creation-limit-burst")
-	visitorTopicCreationLimitReplenishStr := c.String("visitor-topic-creation-limit-replenish")
-	visitorPrefixBitsIPv4 := c.Int("visitor-prefix-bits-ipv4")
-	visitorPrefixBitsIPv6 := c.Int("visitor-prefix-bits-ipv6")
-	banFile := c.String("ban-file")
-	banWindowStr := c.String("ban-window")
-	banThreshold := c.Int("ban-threshold")
-	banWeightsRaw := c.StringSlice("ban-weights")
+	visitorEmailLimitReplenish := c.Duration("visitor-email-limit-replenish")
 	behindProxy := c.Bool("behind-proxy")
-	proxyForwardedHeader := c.String("proxy-forwarded-header")
-	proxyTrustedHosts := util.SplitNoEmpty(c.String("proxy-trusted-hosts"), ",")
 	stripeSecretKey := c.String("stripe-secret-key")
 	stripeWebhookKey := c.String("stripe-webhook-key")
 	billingContact := c.String("billing-contact")
@@ -246,113 +192,11 @@ func execServe(c *cli.Context) error {
 	enableMetrics := c.Bool("enable-metrics") || metricsListenHTTP != ""
 	profileListenHTTP := c.String("profile-listen-http")
 
-	// Convert durations
-	cacheDuration, err := util.ParseDuration(cacheDurationStr)
-	if err != nil {
-		return fmt.Errorf("invalid cache duration: %s", cacheDurationStr)
-	}
-	cacheBatchTimeout, err := util.ParseDuration(cacheBatchTimeoutStr)
-	if err != nil {
-		return fmt.Errorf("invalid cache batch timeout: %s", cacheBatchTimeoutStr)
-	}
-	attachmentExpiryDuration, err := util.ParseDuration(attachmentExpiryDurationStr)
-	if err != nil {
-		return fmt.Errorf("invalid attachment expiry duration: %s", attachmentExpiryDurationStr)
-	}
-	keepaliveInterval, err := util.ParseDuration(keepaliveIntervalStr)
-	if err != nil {
-		return fmt.Errorf("invalid keepalive interval: %s", keepaliveIntervalStr)
-	}
-	clusterBatchLinger, err := util.ParseDuration(clusterBatchLingerStr)
-	if err != nil || clusterBatchLinger < 0 {
-		return fmt.Errorf("invalid cluster batch linger: %s", clusterBatchLingerStr)
-	}
-	managerInterval, err := util.ParseDuration(managerIntervalStr)
-	if err != nil {
-		return fmt.Errorf("invalid manager interval: %s", managerIntervalStr)
-	}
-	messageDelayLimit, err := util.ParseDuration(messageDelayLimitStr)
-	if err != nil {
-		return fmt.Errorf("invalid message delay limit: %s", messageDelayLimitStr)
-	}
-	visitorRequestLimitReplenish, err := util.ParseDuration(visitorRequestLimitReplenishStr)
-	if err != nil {
-		return fmt.Errorf("invalid visitor request limit replenish: %s", visitorRequestLimitReplenishStr)
-	}
-	visitorEmailLimitReplenish, err := util.ParseDuration(visitorEmailLimitReplenishStr)
-	if err != nil {
-		return fmt.Errorf("invalid visitor email limit replenish: %s", visitorEmailLimitReplenishStr)
-	}
-	visitorTopicCreationLimitReplenish, err := util.ParseDuration(visitorTopicCreationLimitReplenishStr)
-	if err != nil {
-		return fmt.Errorf("invalid visitor topic creation limit replenish: %s", visitorTopicCreationLimitReplenishStr)
-	}
-	webPushExpiryDuration, err := util.ParseDuration(webPushExpiryDurationStr)
-	if err != nil {
-		return fmt.Errorf("invalid web push expiry duration: %s", webPushExpiryDurationStr)
-	}
-	webPushExpiryWarningDuration, err := util.ParseDuration(webPushExpiryWarningDurationStr)
-	if err != nil {
-		return fmt.Errorf("invalid web push expiry warning duration: %s", webPushExpiryWarningDurationStr)
-	}
-	banWindow, err := util.ParseDuration(banWindowStr)
-	if err != nil {
-		return fmt.Errorf("invalid ban window: %s", banWindowStr)
-	}
-
-	// Parse abuse ban-feed weights ("KEY:WEIGHT" list, "*" fallback)
-	banWeights, err := ban.ParseWeights(banWeightsRaw)
-	if err != nil {
-		return err
-	}
-
-	// Convert sizes to bytes
-	messageSizeLimit, err := util.ParseSize(messageSizeLimitStr)
-	if err != nil {
-		return fmt.Errorf("invalid message size limit: %s", messageSizeLimitStr)
-	}
-	attachmentTotalSizeLimit, err := util.ParseSize(attachmentTotalSizeLimitStr)
-	if err != nil {
-		return fmt.Errorf("invalid attachment total size limit: %s", attachmentTotalSizeLimitStr)
-	}
-	attachmentFileSizeLimit, err := util.ParseSize(attachmentFileSizeLimitStr)
-	if err != nil {
-		return fmt.Errorf("invalid attachment file size limit: %s", attachmentFileSizeLimitStr)
-	}
-	visitorAttachmentTotalSizeLimit, err := util.ParseSize(visitorAttachmentTotalSizeLimitStr)
-	if err != nil {
-		return fmt.Errorf("invalid visitor attachment total size limit: %s", visitorAttachmentTotalSizeLimitStr)
-	}
-	visitorAttachmentDailyBandwidthLimit, err := util.ParseSize(visitorAttachmentDailyBandwidthLimitStr)
-	if err != nil {
-		return fmt.Errorf("invalid visitor attachment daily bandwidth limit: %s", visitorAttachmentDailyBandwidthLimitStr)
-	} else if visitorAttachmentDailyBandwidthLimit > math.MaxInt {
-		return fmt.Errorf("config option visitor-attachment-daily-bandwidth-limit must be lower than %d", math.MaxInt)
-	}
-
 	// Check values
-	if databaseURL != "" && !strings.HasPrefix(databaseURL, "postgres://") && !strings.HasPrefix(databaseURL, "postgresql://") {
-		return errors.New("if database-url is set, it must start with postgres:// or postgresql://")
-	} else if databaseURL != "" && (authFile != "" || cacheFile != "" || webPushFile != "") {
-		return errors.New("if database-url is set, auth-file, cache-file, and web-push-file must not be set")
-	} else if len(databaseReplicaURLs) > 0 && databaseURL == "" {
-		return errors.New("database-replica-urls can only be used if database-url is also set")
-	} else if clusterListen != "" && databaseURL == "" {
-		return errors.New("cluster-listen requires database-url to be set")
-	} else if clusterListen != "" && clusterSecret == "" {
-		return errors.New("cluster-listen requires cluster-secret to be set")
-	} else if clusterListen != "" && clusterNodeID == "" {
-		return errors.New("cluster-listen requires cluster-node-id to be set")
-	} else if clusterListen == "" && clusterSecret != "" {
-		return errors.New("cluster-secret can only be used if cluster-listen is set")
-	} else if clusterListen != "" && clusterAdvertiseURL == "" && wildcardAddr(clusterListen) {
-		return errors.New("cluster-advertise-url must be set if cluster-listen binds a wildcard address")
-	} else if firebaseKeyFile != "" && !util.FileExists(firebaseKeyFile) {
+	if firebaseKeyFile != "" && !util.FileExists(firebaseKeyFile) {
 		return errors.New("if set, FCM key file must exist")
-	} else if firebaseKeyFile != "" && !server.FirebaseAvailable {
-		return errors.New("cannot set firebase-key-file, support for Firebase is not available (nofirebase)")
-	} else if webPushPublicKey != "" && (webPushPrivateKey == "" || (webPushFile == "" && databaseURL == "") || webPushEmailAddress == "" || baseURL == "") {
-		return errors.New("if web push is enabled, web-push-private-key, web-push-public-key, web-push-file (or database-url), web-push-email-address, and base-url should be set. run 'ntfy webpush keys' to generate keys")
+	} else if webPushPublicKey != "" && (webPushPrivateKey == "" || webPushFile == "" || webPushEmailAddress == "" || baseURL == "") {
+		return errors.New("if web push is enabled, web-push-private-key, web-push-public-key, web-push-file, web-push-email-address, and base-url should be set. run 'ntfy webpush keys' to generate keys")
 	} else if keepaliveInterval < 5*time.Second {
 		return errors.New("keepalive interval cannot be lower than five seconds")
 	} else if managerInterval < 5*time.Second {
@@ -367,21 +211,14 @@ func execServe(c *cli.Context) error {
 		return errors.New("if listen-https is set, both key-file and cert-file must be set")
 	} else if smtpSenderAddr != "" && (baseURL == "" || smtpSenderFrom == "") {
 		return errors.New("if smtp-sender-addr is set, base-url, and smtp-sender-from must also be set")
-	} else if smtpSenderVerify && smtpSenderAddr == "" {
-		return errors.New("if smtp-sender-verify is set, smtp-sender-addr must also be set")
 	} else if smtpServerListen != "" && smtpServerDomain == "" {
 		return errors.New("if smtp-server-listen is set, smtp-server-domain must also be set")
 	} else if attachmentCacheDir != "" && baseURL == "" {
 		return errors.New("if attachment-cache-dir is set, base-url must also be set")
-	} else if baseURL != "" {
-		u, err := url.Parse(baseURL)
-		if err != nil {
-			return fmt.Errorf("if set, base-url must be a valid URL, e.g. https://ntfy.mydomain.com: %v", err)
-		} else if u.Scheme != "http" && u.Scheme != "https" {
-			return errors.New("if set, base-url must be a valid URL starting with http:// or https://, e.g. https://ntfy.mydomain.com")
-		} else if u.Path != "" {
-			return fmt.Errorf("if set, base-url must not have a path (%s), as hosting ntfy on a sub-path is not supported, e.g. https://ntfy.mydomain.com", u.Path)
-		}
+	} else if baseURL != "" && !strings.HasPrefix(baseURL, "http://") && !strings.HasPrefix(baseURL, "https://") {
+		return errors.New("if set, base-url must start with http:// or https://")
+	} else if baseURL != "" && strings.HasSuffix(baseURL, "/") {
+		return errors.New("if set, base-url must not end with a slash (/)")
 	} else if upstreamBaseURL != "" && !strings.HasPrefix(upstreamBaseURL, "http://") && !strings.HasPrefix(upstreamBaseURL, "https://") {
 		return errors.New("if set, upstream-base-url must start with http:// or https://")
 	} else if upstreamBaseURL != "" && strings.HasSuffix(upstreamBaseURL, "/") {
@@ -390,43 +227,16 @@ func execServe(c *cli.Context) error {
 		return errors.New("if upstream-base-url is set, base-url must also be set")
 	} else if upstreamBaseURL != "" && baseURL != "" && baseURL == upstreamBaseURL {
 		return errors.New("base-url and upstream-base-url cannot be identical, you'll likely want to set upstream-base-url to https://ntfy.sh, see https://ntfy.sh/docs/config/#ios-instant-notifications")
-	} else if authFile == "" && databaseURL == "" && (enableSignup || enableLogin || requireLogin || enableReservations || stripeSecretKey != "") {
-		return errors.New("cannot set enable-signup, enable-login, require-login, enable-reserve-topics, or stripe-secret-key if auth-file or database-url is not set")
+	} else if authFile == "" && (enableSignup || enableLogin || enableReservations || stripeSecretKey != "") {
+		return errors.New("cannot set enable-signup, enable-login, enable-reserve-topics, or stripe-secret-key if auth-file is not set")
+	} else if authUserHeader != "" && !behindProxy {
+		return errors.New("if auth-user-header is set, behind-proxy must also be set; this is a security measure")
 	} else if enableSignup && !enableLogin {
 		return errors.New("cannot set enable-signup without also setting enable-login")
-	} else if requireLogin && !enableLogin {
-		return errors.New("cannot set require-login without also setting enable-login")
-	} else if !payments.Available && (stripeSecretKey != "" || stripeWebhookKey != "") {
-		return errors.New("cannot set stripe-secret-key or stripe-webhook-key, support for payments is not available in this build (nopayments)")
 	} else if stripeSecretKey != "" && (stripeWebhookKey == "" || baseURL == "") {
 		return errors.New("if stripe-secret-key is set, stripe-webhook-key and base-url must also be set")
-	} else if twilioAccount != "" && (twilioAuthToken == "" || twilioPhoneNumber == "" || twilioVerifyService == "" || baseURL == "" || (authFile == "" && databaseURL == "")) {
-		return errors.New("if twilio-account is set, twilio-auth-token, twilio-phone-number, twilio-verify-service, base-url, and auth-file (or database-url) must also be set")
-	} else if messageSizeLimit > server.DefaultMessageSizeLimit {
-		log.Warn("message-size-limit is greater than 4K, this is not recommended and largely untested, and may lead to issues with some clients")
-		if messageSizeLimit > 5*1024*1024 {
-			return errors.New("message-size-limit cannot be higher than 5M")
-		}
-	} else if !server.WebPushAvailable && (webPushPrivateKey != "" || webPushPublicKey != "" || webPushFile != "") {
-		return errors.New("cannot enable WebPush, support is not available in this build (nowebpush)")
-	} else if webPushExpiryWarningDuration > 0 && webPushExpiryWarningDuration > webPushExpiryDuration {
-		return errors.New("web push expiry warning duration cannot be higher than web push expiry duration")
-	} else if behindProxy && proxyForwardedHeader == "" {
-		return errors.New("if behind-proxy is set, proxy-forwarded-header must also be set")
-	} else if visitorPrefixBitsIPv4 < 1 || visitorPrefixBitsIPv4 > 32 {
-		return errors.New("visitor-prefix-bits-ipv4 must be between 1 and 32")
-	} else if visitorPrefixBitsIPv6 < 1 || visitorPrefixBitsIPv6 > 128 {
-		return errors.New("visitor-prefix-bits-ipv6 must be between 1 and 128")
-	} else if banFile != "" && banWindow <= 0 {
-		return errors.New("if ban-file is set, ban-window must be greater than zero")
-	} else if banFile != "" && banThreshold <= 0 {
-		return errors.New("if ban-file is set, ban-threshold must be greater than zero")
-	} else if banFile != "" && len(banWeights) == 0 {
-		return errors.New("if ban-file is set, ban-weights must not be empty")
-	} else if banFile != "" && !util.FileExists(filepath.Dir(banFile)) {
-		return fmt.Errorf("if ban-file is set, its directory (%s) must exist", filepath.Dir(banFile))
-	} else if runtime.GOOS == "windows" && listenUnix != "" {
-		return errors.New("listen-unix is not supported on Windows")
+	} else if twilioAccount != "" && (twilioAuthToken == "" || twilioPhoneNumber == "" || twilioVerifyService == "" || baseURL == "" || authFile == "") {
+		return errors.New("if twilio-account is set, twilio-auth-token, twilio-phone-number, twilio-verify-service, base-url, and auth-file must also be set")
 	}
 
 	// Backwards compatibility
@@ -440,62 +250,52 @@ func execServe(c *cli.Context) error {
 		webRoot = "/" + webRoot
 	}
 
-	// Convert default auth permission, read provisioned users
+	// Default auth permissions
 	authDefault, err := user.ParsePermission(authDefaultAccess)
 	if err != nil {
 		return errors.New("if set, auth-default-access must start set to 'read-write', 'read-only', 'write-only' or 'deny-all'")
 	}
-	authUsers, err := parseUsers(authUsersRaw)
-	if err != nil {
-		return err
-	}
-	authAccess, err := parseAccess(authUsers, authAccessRaw)
-	if err != nil {
-		return err
-	}
-	authTokens, err := parseTokens(authUsers, authTokensRaw)
-	if err != nil {
-		return err
-	}
 
 	// Special case: Unset default
 	if listenHTTP == "-" {
 		listenHTTP = ""
 	}
 
+	// Convert sizes to bytes
+	attachmentTotalSizeLimit, err := parseSize(attachmentTotalSizeLimitStr, server.DefaultAttachmentTotalSizeLimit)
+	if err != nil {
+		return err
+	}
+	attachmentFileSizeLimit, err := parseSize(attachmentFileSizeLimitStr, server.DefaultAttachmentFileSizeLimit)
+	if err != nil {
+		return err
+	}
+	visitorAttachmentTotalSizeLimit, err := parseSize(visitorAttachmentTotalSizeLimitStr, server.DefaultVisitorAttachmentTotalSizeLimit)
+	if err != nil {
+		return err
+	}
+	visitorAttachmentDailyBandwidthLimit, err := parseSize(visitorAttachmentDailyBandwidthLimitStr, server.DefaultVisitorAttachmentDailyBandwidthLimit)
+	if err != nil {
+		return err
+	} else if visitorAttachmentDailyBandwidthLimit > math.MaxInt {
+		return fmt.Errorf("config option visitor-attachment-daily-bandwidth-limit must be lower than %d", math.MaxInt)
+	}
+
 	// Resolve hosts
-	visitorRequestLimitExemptPrefixes := make([]netip.Prefix, 0)
+	visitorRequestLimitExemptIPs := make([]netip.Prefix, 0)
 	for _, host := range visitorRequestLimitExemptHosts {
-		prefixes, err := parseIPHostPrefix(host)
+		ips, err := parseIPHostPrefix(host)
 		if err != nil {
 			log.Warn("cannot resolve host %s: %s, ignoring visitor request exemption", host, err.Error())
 			continue
 		}
-		visitorRequestLimitExemptPrefixes = append(visitorRequestLimitExemptPrefixes, prefixes...)
-	}
-
-	// Parse trusted prefixes
-	trustedProxyPrefixes := make([]netip.Prefix, 0)
-	for _, host := range proxyTrustedHosts {
-		prefixes, err := parseIPHostPrefix(host)
-		if err != nil {
-			return fmt.Errorf("cannot resolve trusted proxy host %s: %s", host, err.Error())
-		}
-		trustedProxyPrefixes = append(trustedProxyPrefixes, prefixes...)
+		visitorRequestLimitExemptIPs = append(visitorRequestLimitExemptIPs, ips...)
 	}
 
 	// Stripe things
 	if stripeSecretKey != "" {
-		payments.Setup(stripeSecretKey)
-	}
-
-	// Parse Twilio template
-	var twilioCallFormatTemplate *template.Template
-	if twilioCallFormat != "" {
-		twilioCallFormatTemplate, err = template.New("").Parse(twilioCallFormat)
-		if err != nil {
-			return fmt.Errorf("failed to parse twilio-call-format template: %w", err)
-		}
+		stripe.EnableTelemetry = false // Whoa!
+		stripe.Key = stripeSecretKey
 	}
 
 	// Add default forbidden topics
@@ -520,15 +320,11 @@ func execServe(c *cli.Context) error {
 	conf.AuthFile = authFile
 	conf.AuthStartupQueries = authStartupQueries
 	conf.AuthDefault = authDefault
-	conf.AuthUsers = authUsers
-	conf.AuthAccess = authAccess
-	conf.AuthTokens = authTokens
-	conf.AuthAccessCacheEnabled = authAccessCacheEnabled
+	conf.AuthUserHeader = authUserHeader
 	conf.AttachmentCacheDir = attachmentCacheDir
 	conf.AttachmentTotalSizeLimit = attachmentTotalSizeLimit
 	conf.AttachmentFileSizeLimit = attachmentFileSizeLimit
 	conf.AttachmentExpiryDuration = attachmentExpiryDuration
-	conf.TemplateDir = templateDir
 	conf.KeepaliveInterval = keepaliveInterval
 	conf.ManagerInterval = managerInterval
 	conf.DisallowedTopics = disallowedTopics
@@ -539,7 +335,6 @@ func execServe(c *cli.Context) error {
 	conf.SMTPSenderUser = smtpSenderUser
 	conf.SMTPSenderPass = smtpSenderPass
 	conf.SMTPSenderFrom = smtpSenderFrom
-	conf.SMTPSenderVerify = smtpSenderVerify
 	conf.SMTPServerListen = smtpServerListen
 	conf.SMTPServerDomain = smtpServerDomain
 	conf.SMTPServerAddrPrefix = smtpServerAddrPrefix
@@ -547,66 +342,33 @@ func execServe(c *cli.Context) error {
 	conf.TwilioAuthToken = twilioAuthToken
 	conf.TwilioPhoneNumber = twilioPhoneNumber
 	conf.TwilioVerifyService = twilioVerifyService
-	conf.TwilioCallFormat = twilioCallFormatTemplate
-	conf.MessageSizeLimit = int(messageSizeLimit)
-	conf.MessageDelayMax = messageDelayLimit
 	conf.TotalTopicLimit = totalTopicLimit
 	conf.VisitorSubscriptionLimit = visitorSubscriptionLimit
-	conf.VisitorSubscriberRateLimiting = visitorSubscriberRateLimiting
 	conf.VisitorAttachmentTotalSizeLimit = visitorAttachmentTotalSizeLimit
 	conf.VisitorAttachmentDailyBandwidthLimit = visitorAttachmentDailyBandwidthLimit
 	conf.VisitorRequestLimitBurst = visitorRequestLimitBurst
 	conf.VisitorRequestLimitReplenish = visitorRequestLimitReplenish
-	conf.VisitorRequestExemptPrefixes = visitorRequestLimitExemptPrefixes
+	conf.VisitorRequestExemptIPAddrs = visitorRequestLimitExemptIPs
 	conf.VisitorMessageDailyLimit = visitorMessageDailyLimit
 	conf.VisitorEmailLimitBurst = visitorEmailLimitBurst
 	conf.VisitorEmailLimitReplenish = visitorEmailLimitReplenish
-	conf.VisitorTopicCreationLimitBurst = visitorTopicCreationLimitBurst
-	conf.VisitorTopicCreationLimitReplenish = visitorTopicCreationLimitReplenish
-	conf.VisitorPrefixBitsIPv4 = visitorPrefixBitsIPv4
-	conf.VisitorPrefixBitsIPv6 = visitorPrefixBitsIPv6
-	conf.BanFile = banFile
-	conf.BanWindow = banWindow
-	conf.BanThreshold = banThreshold
-	conf.BanWeights = banWeights
+	conf.VisitorSubscriberRateLimiting = visitorSubscriberRateLimiting
 	conf.BehindProxy = behindProxy
-	conf.ProxyForwardedHeader = proxyForwardedHeader
-	conf.ProxyTrustedPrefixes = trustedProxyPrefixes
 	conf.StripeSecretKey = stripeSecretKey
 	conf.StripeWebhookKey = stripeWebhookKey
 	conf.BillingContact = billingContact
 	conf.EnableSignup = enableSignup
 	conf.EnableLogin = enableLogin
-	conf.RequireLogin = requireLogin
 	conf.EnableReservations = enableReservations
 	conf.EnableMetrics = enableMetrics
 	conf.MetricsListenHTTP = metricsListenHTTP
 	conf.ProfileListenHTTP = profileListenHTTP
-	conf.DatabaseURL = databaseURL
-	conf.DatabaseReplicaURLs = databaseReplicaURLs
-	conf.ClusterNodeID = clusterNodeID
-	conf.ClusterListen = clusterListen
-	conf.ClusterAdvertiseURL = clusterAdvertiseURL
-	conf.ClusterSecret = clusterSecret
-	conf.ClusterBatchLinger = clusterBatchLinger
+	conf.Version = c.App.Version
 	conf.WebPushPrivateKey = webPushPrivateKey
 	conf.WebPushPublicKey = webPushPublicKey
 	conf.WebPushFile = webPushFile
 	conf.WebPushEmailAddress = webPushEmailAddress
 	conf.WebPushStartupQueries = webPushStartupQueries
-	conf.WebPushExpiryDuration = webPushExpiryDuration
-	conf.WebPushExpiryWarningDuration = webPushExpiryWarningDuration
-	conf.BuildVersion = c.App.Version
-	conf.BuildDate = maybeFromMetadata(c.App.Metadata, MetadataKeyDate)
-	conf.BuildCommit = maybeFromMetadata(c.App.Metadata, MetadataKeyCommit)
-
-	// Check if we should run as a Windows service
-	if ranAsService, err := maybeRunAsService(conf); err != nil {
-		log.Fatal("%s", err.Error())
-	} else if ranAsService {
-		log.Info("Exiting.")
-		return nil
-	}
 
 	// Set up hot-reloading of config
 	go sigHandlerConfigReload(config)
@@ -614,16 +376,43 @@ func execServe(c *cli.Context) error {
 	// Run server
 	s, err := server.New(conf)
 	if err != nil {
-		log.Fatal("%s", err.Error())
+		log.Fatal(err.Error())
 	} else if err := s.Run(); err != nil {
-		log.Fatal("%s", err.Error())
+		log.Fatal(err.Error())
 	}
 	log.Info("Exiting.")
 	return nil
 }
 
+func parseSize(s string, defaultValue int64) (v int64, err error) {
+	if s == "" {
+		return defaultValue, nil
+	}
+	v, err = util.ParseSize(s)
+	if err != nil {
+		return 0, err
+	}
+	return v, nil
+}
+
+func sigHandlerConfigReload(config string) {
+	sigs := make(chan os.Signal, 1)
+	signal.Notify(sigs, syscall.SIGHUP)
+	for range sigs {
+		log.Info("Partially hot reloading configuration ...")
+		inputSource, err := newYamlSourceFromFile(config, flagsServe)
+		if err != nil {
+			log.Warn("Hot reload failed: %s", err.Error())
+			continue
+		}
+		if err := reloadLogLevel(inputSource); err != nil {
+			log.Warn("Reloading log level failed: %s", err.Error())
+		}
+	}
+}
+
 func parseIPHostPrefix(host string) (prefixes []netip.Prefix, err error) {
-	// Try parsing as prefix, e.g. 10.0.1.0/24 or 2001:db8::/32
+	// Try parsing as prefix, e.g. 10.0.1.0/24
 	prefix, err := netip.ParsePrefix(host)
 	if err == nil {
 		prefixes = append(prefixes, prefix.Masked())
@@ -647,133 +436,24 @@ func parseIPHostPrefix(host string) (prefixes []netip.Prefix, err error) {
 	return
 }
 
-func parseUsers(usersRaw []string) ([]*user.User, error) {
-	users := make([]*user.User, 0)
-	for _, userLine := range usersRaw {
-		parts := strings.Split(userLine, ":")
-		if len(parts) != 3 {
-			return nil, fmt.Errorf("invalid auth-users: %s, expected format: 'name:hash:role'", userLine)
-		}
-		username := strings.TrimSpace(parts[0])
-		passwordHash := strings.TrimSpace(parts[1])
-		role := user.Role(strings.TrimSpace(parts[2]))
-		if !user.AllowedUsername(username) {
-			return nil, fmt.Errorf("invalid auth-users: %s, username invalid", userLine)
-		} else if err := user.ValidPasswordHash(passwordHash, user.DefaultUserPasswordBcryptCost); err != nil {
-			return nil, fmt.Errorf("invalid auth-users: %s, password hash invalid, %s", userLine, err.Error())
-		} else if !user.AllowedRole(role) {
-			return nil, fmt.Errorf("invalid auth-users: %s, role %s is not allowed, allowed roles are 'admin' or 'user'", userLine, role)
-		}
-		users = append(users, &user.User{
-			Name:        username,
-			Hash:        passwordHash,
-			Role:        role,
-			Provisioned: true,
-		})
-	}
-	return users, nil
-}
-
-func parseAccess(users []*user.User, accessRaw []string) (map[string][]*user.Grant, error) {
-	access := make(map[string][]*user.Grant)
-	for _, accessLine := range accessRaw {
-		parts := strings.Split(accessLine, ":")
-		if len(parts) != 3 {
-			return nil, fmt.Errorf("invalid auth-access: %s, expected format: 'user:topic:permission'", accessLine)
-		}
-		username := strings.TrimSpace(parts[0])
-		if username == userEveryone {
-			username = user.Everyone
-		}
-		u, exists := util.Find(users, func(u *user.User) bool {
-			return u.Name == username
-		})
-		if username != user.Everyone {
-			if !exists {
-				return nil, fmt.Errorf("invalid auth-access: %s, user %s is not provisioned", accessLine, username)
-			} else if !user.AllowedUsername(username) {
-				return nil, fmt.Errorf("invalid auth-access: %s, username %s invalid", accessLine, username)
-			} else if u.Role != user.RoleUser {
-				return nil, fmt.Errorf("invalid auth-access: %s, user %s is not a regular user, only regular users can have ACL entries", accessLine, username)
-			}
-		}
-		topic := strings.TrimSpace(parts[1])
-		if !user.AllowedTopicPattern(topic) {
-			return nil, fmt.Errorf("invalid auth-access: %s, topic pattern %s invalid", accessLine, topic)
-		}
-		permission, err := user.ParsePermission(strings.TrimSpace(parts[2]))
-		if err != nil {
-			return nil, fmt.Errorf("invalid auth-access: %s, permission %s invalid, %s", accessLine, parts[2], err.Error())
-		}
-		if _, exists := access[username]; !exists {
-			access[username] = make([]*user.Grant, 0)
-		}
-		access[username] = append(access[username], &user.Grant{
-			TopicPattern: topic,
-			Permission:   permission,
-			Provisioned:  true,
-		})
-	}
-	return access, nil
-}
-
-func parseTokens(users []*user.User, tokensRaw []string) (map[string][]*user.Token, error) {
-	tokens := make(map[string][]*user.Token)
-	for _, tokenLine := range tokensRaw {
-		parts := strings.Split(tokenLine, ":")
-		if len(parts) < 2 || len(parts) > 3 {
-			return nil, fmt.Errorf("invalid auth-tokens: %s, expected format: 'user:token[:label]'", tokenLine)
-		}
-		username := strings.TrimSpace(parts[0])
-		_, exists := util.Find(users, func(u *user.User) bool {
-			return u.Name == username
-		})
-		if !exists {
-			return nil, fmt.Errorf("invalid auth-tokens: %s, user %s is not provisioned", tokenLine, username)
-		} else if !user.AllowedUsername(username) {
-			return nil, fmt.Errorf("invalid auth-tokens: %s, username %s invalid", tokenLine, username)
-		}
-		token := strings.TrimSpace(parts[1])
-		if !user.ValidToken(token) {
-			return nil, fmt.Errorf("invalid auth-tokens: %s, token %s invalid, use 'ntfy token generate' to generate a random token", tokenLine, token)
-		}
-		var label string
-		if len(parts) > 2 {
-			label = parts[2]
-		}
-		if _, exists := tokens[username]; !exists {
-			tokens[username] = make([]*user.Token, 0)
-		}
-		tokens[username] = append(tokens[username], &user.Token{
-			Value:       token,
-			Label:       label,
-			Provisioned: true,
-		})
-	}
-	return tokens, nil
-}
-
-func maybeFromMetadata(m map[string]any, key string) string {
-	if m == nil {
-		return ""
-	}
-	v, exists := m[key]
-	if !exists {
-		return ""
-	}
-	s, ok := v.(string)
-	if !ok {
-		return ""
-	}
-	return s
-}
-
-// wildcardAddr reports whether the given listen address binds all interfaces (e.g. ":2587",
-// "0.0.0.0:2587", "[::]:2587"), in which case peers cannot derive a reachable URL from it.
-func wildcardAddr(addr string) bool {
-	host, _, err := net.SplitHostPort(addr)
+func reloadLogLevel(inputSource altsrc.InputSourceContext) error {
+	newLevelStr, err := inputSource.String("log-level")
 	if err != nil {
-		return true // Unparseable -> cannot derive a URL either
+		return fmt.Errorf("cannot load log level: %s", err.Error())
 	}
-	return host == "" || host == "0.0.0.0" || host == "::"
+	overrides, err := inputSource.StringSlice("log-level-overrides")
+	if err != nil {
+		return fmt.Errorf("cannot load log level overrides (1): %s", err.Error())
+	}
+	log.ResetLevelOverrides()
+	if err := applyLogLevelOverrides(overrides); err != nil {
+		return fmt.Errorf("cannot load log level overrides (2): %s", err.Error())
+	}
+	log.SetLevel(log.ToLevel(newLevelStr))
+	if len(overrides) > 0 {
+		log.Info("Log level is %v, %d override(s) in place", strings.ToUpper(newLevelStr), len(overrides))
+	} else {
+		log.Info("Log level is %v", strings.ToUpper(newLevelStr))
+	}
+	return nil
 }

cmd/serve_test.go

@@ -12,461 +12,13 @@ import (
 	"github.com/gorilla/websocket"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/client"
-	"heckel.io/ntfy/v2/test"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/client"
+	"heckel.io/ntfy/test"
+	"heckel.io/ntfy/util"
 )
 
-func TestParseUsers_Success(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    []string
-		expected []*user.User
-	}{
-		{
-			name:  "single user",
-			input: []string{"alice:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user"},
-			expected: []*user.User{
-				{
-					Name:        "alice",
-					Hash:        "$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S",
-					Role:        user.RoleUser,
-					Provisioned: true,
-				},
-			},
-		},
-		{
-			name: "multiple users with different roles",
-			input: []string{
-				"alice:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user",
-				"bob:$2a$10$jIcuBWcbxd6oW1aPvoJ5iOShzu3/UJ2kSxKbTZtDypG06nBflQagq:admin",
-			},
-			expected: []*user.User{
-				{
-					Name:        "alice",
-					Hash:        "$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S",
-					Role:        user.RoleUser,
-					Provisioned: true,
-				},
-				{
-					Name:        "bob",
-					Hash:        "$2a$10$jIcuBWcbxd6oW1aPvoJ5iOShzu3/UJ2kSxKbTZtDypG06nBflQagq",
-					Role:        user.RoleAdmin,
-					Provisioned: true,
-				},
-			},
-		},
-		{
-			name:     "empty input",
-			input:    []string{},
-			expected: []*user.User{},
-		},
-		{
-			name:  "user with special characters in name",
-			input: []string{"alice.test+123@example.com:$2a$10$RYUYAsl5zOnAIp6fH7BPX.Eug0rUfEUk92r8WiVusb0VK.vGojWBe:user"},
-			expected: []*user.User{
-				{
-					Name:        "alice.test+123@example.com",
-					Hash:        "$2a$10$RYUYAsl5zOnAIp6fH7BPX.Eug0rUfEUk92r8WiVusb0VK.vGojWBe",
-					Role:        user.RoleUser,
-					Provisioned: true,
-				},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := parseUsers(tt.input)
-			require.NoError(t, err)
-			require.Len(t, result, len(tt.expected))
-
-			for i, expectedUser := range tt.expected {
-				assert.Equal(t, expectedUser.Name, result[i].Name)
-				assert.Equal(t, expectedUser.Hash, result[i].Hash)
-				assert.Equal(t, expectedUser.Role, result[i].Role)
-				assert.Equal(t, expectedUser.Provisioned, result[i].Provisioned)
-			}
-		})
-	}
-}
-
-func TestParseUsers_Errors(t *testing.T) {
-	tests := []struct {
-		name  string
-		input []string
-		error string
-	}{
-		{
-			name:  "invalid format - too few parts",
-			input: []string{"alice:hash"},
-			error: "invalid auth-users: alice:hash, expected format: 'name:hash:role'",
-		},
-		{
-			name:  "invalid format - too many parts",
-			input: []string{"alice:hash:role:extra"},
-			error: "invalid auth-users: alice:hash:role:extra, expected format: 'name:hash:role'",
-		},
-		{
-			name:  "invalid username",
-			input: []string{"alice@#$%:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user"},
-			error: "invalid auth-users: alice@#$%:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user, username invalid",
-		},
-		{
-			name:  "invalid password hash - wrong prefix",
-			input: []string{"alice:plaintext:user"},
-			error: "invalid auth-users: alice:plaintext:user, password hash invalid, password hash must be a bcrypt hash, use 'ntfy user hash' to generate",
-		},
-		{
-			name:  "invalid role",
-			input: []string{"alice:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:invalid"},
-			error: "invalid auth-users: alice:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:invalid, role invalid is not allowed, allowed roles are 'admin' or 'user'",
-		},
-		{
-			name:  "empty username",
-			input: []string{":$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user"},
-			error: "invalid auth-users: :$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user, username invalid",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := parseUsers(tt.input)
-			require.Error(t, err)
-			require.Nil(t, result)
-			assert.Contains(t, err.Error(), tt.error)
-		})
-	}
-}
-
-func TestParseAccess_Success(t *testing.T) {
-	users := []*user.User{
-		{Name: "alice", Role: user.RoleUser},
-		{Name: "bob", Role: user.RoleUser},
-	}
-
-	tests := []struct {
-		name     string
-		users    []*user.User
-		input    []string
-		expected map[string][]*user.Grant
-	}{
-		{
-			name:  "single access entry",
-			users: users,
-			input: []string{"alice:mytopic:read-write"},
-			expected: map[string][]*user.Grant{
-				"alice": {
-					{
-						TopicPattern: "mytopic",
-						Permission:   user.PermissionReadWrite,
-						Provisioned:  true,
-					},
-				},
-			},
-		},
-		{
-			name:  "multiple access entries for same user",
-			users: users,
-			input: []string{
-				"alice:topic1:read-only",
-				"alice:topic2:write-only",
-			},
-			expected: map[string][]*user.Grant{
-				"alice": {
-					{
-						TopicPattern: "topic1",
-						Permission:   user.PermissionRead,
-						Provisioned:  true,
-					},
-					{
-						TopicPattern: "topic2",
-						Permission:   user.PermissionWrite,
-						Provisioned:  true,
-					},
-				},
-			},
-		},
-		{
-			name:  "access for everyone",
-			users: users,
-			input: []string{"everyone:publictopic:read-only"},
-			expected: map[string][]*user.Grant{
-				user.Everyone: {
-					{
-						TopicPattern: "publictopic",
-						Permission:   user.PermissionRead,
-						Provisioned:  true,
-					},
-				},
-			},
-		},
-		{
-			name:  "wildcard topic pattern",
-			users: users,
-			input: []string{"alice:topic*:read-write"},
-			expected: map[string][]*user.Grant{
-				"alice": {
-					{
-						TopicPattern: "topic*",
-						Permission:   user.PermissionReadWrite,
-						Provisioned:  true,
-					},
-				},
-			},
-		},
-		{
-			name:     "empty input",
-			users:    users,
-			input:    []string{},
-			expected: map[string][]*user.Grant{},
-		},
-		{
-			name:  "deny-all permission",
-			users: users,
-			input: []string{"alice:secretopic:deny-all"},
-			expected: map[string][]*user.Grant{
-				"alice": {
-					{
-						TopicPattern: "secretopic",
-						Permission:   user.PermissionDenyAll,
-						Provisioned:  true,
-					},
-				},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := parseAccess(tt.users, tt.input)
-			require.NoError(t, err)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestParseAccess_Errors(t *testing.T) {
-	users := []*user.User{
-		{Name: "alice", Role: user.RoleUser},
-		{Name: "admin", Role: user.RoleAdmin},
-	}
-
-	tests := []struct {
-		name  string
-		users []*user.User
-		input []string
-		error string
-	}{
-		{
-			name:  "invalid format - too few parts",
-			users: users,
-			input: []string{"alice:topic"},
-			error: "invalid auth-access: alice:topic, expected format: 'user:topic:permission'",
-		},
-		{
-			name:  "invalid format - too many parts",
-			users: users,
-			input: []string{"alice:topic:read:extra"},
-			error: "invalid auth-access: alice:topic:read:extra, expected format: 'user:topic:permission'",
-		},
-		{
-			name:  "user not provisioned",
-			users: users,
-			input: []string{"charlie:topic:read"},
-			error: "invalid auth-access: charlie:topic:read, user charlie is not provisioned",
-		},
-		{
-			name:  "admin user cannot have ACL entries",
-			users: users,
-			input: []string{"admin:topic:read"},
-			error: "invalid auth-access: admin:topic:read, user admin is not a regular user, only regular users can have ACL entries",
-		},
-		{
-			name:  "invalid topic pattern",
-			users: users,
-			input: []string{"alice:topic-with-invalid-chars!:read"},
-			error: "invalid auth-access: alice:topic-with-invalid-chars!:read, topic pattern topic-with-invalid-chars! invalid",
-		},
-		{
-			name:  "invalid permission",
-			users: users,
-			input: []string{"alice:topic:invalid-permission"},
-			error: "invalid auth-access: alice:topic:invalid-permission, permission invalid-permission invalid",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := parseAccess(tt.users, tt.input)
-			require.Error(t, err)
-			require.Nil(t, result)
-			assert.Contains(t, err.Error(), tt.error)
-		})
-	}
-}
-
-func TestParseTokens_Success(t *testing.T) {
-	users := []*user.User{
-		{Name: "alice"},
-		{Name: "bob"},
-	}
-
-	tests := []struct {
-		name     string
-		users    []*user.User
-		input    []string
-		expected map[string][]*user.Token
-	}{
-		{
-			name:  "single token without label",
-			users: users,
-			input: []string{"alice:tk_abcdefghijklmnopqrstuvwxyz123"},
-			expected: map[string][]*user.Token{
-				"alice": {
-					{
-						Value:       "tk_abcdefghijklmnopqrstuvwxyz123",
-						Label:       "",
-						Provisioned: true,
-					},
-				},
-			},
-		},
-		{
-			name:  "single token with label",
-			users: users,
-			input: []string{"alice:tk_abcdefghijklmnopqrstuvwxyz123:My Phone"},
-			expected: map[string][]*user.Token{
-				"alice": {
-					{
-						Value:       "tk_abcdefghijklmnopqrstuvwxyz123",
-						Label:       "My Phone",
-						Provisioned: true,
-					},
-				},
-			},
-		},
-		{
-			name:  "multiple tokens for same user",
-			users: users,
-			input: []string{
-				"alice:tk_abcdefghijklmnopqrstuvwxyz123:Phone",
-				"alice:tk_zyxwvutsrqponmlkjihgfedcba987:Laptop",
-			},
-			expected: map[string][]*user.Token{
-				"alice": {
-					{
-						Value:       "tk_abcdefghijklmnopqrstuvwxyz123",
-						Label:       "Phone",
-						Provisioned: true,
-					},
-					{
-						Value:       "tk_zyxwvutsrqponmlkjihgfedcba987",
-						Label:       "Laptop",
-						Provisioned: true,
-					},
-				},
-			},
-		},
-		{
-			name:  "tokens for multiple users",
-			users: users,
-			input: []string{
-				"alice:tk_abcdefghijklmnopqrstuvwxyz123:Phone",
-				"bob:tk_zyxwvutsrqponmlkjihgfedcba987:Tablet",
-			},
-			expected: map[string][]*user.Token{
-				"alice": {
-					{
-						Value:       "tk_abcdefghijklmnopqrstuvwxyz123",
-						Label:       "Phone",
-						Provisioned: true,
-					},
-				},
-				"bob": {
-					{
-						Value:       "tk_zyxwvutsrqponmlkjihgfedcba987",
-						Label:       "Tablet",
-						Provisioned: true,
-					},
-				},
-			},
-		},
-		{
-			name:     "empty input",
-			users:    users,
-			input:    []string{},
-			expected: map[string][]*user.Token{},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := parseTokens(tt.users, tt.input)
-			require.NoError(t, err)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestParseTokens_Errors(t *testing.T) {
-	users := []*user.User{
-		{Name: "alice"},
-	}
-
-	tests := []struct {
-		name  string
-		users []*user.User
-		input []string
-		error string
-	}{
-		{
-			name:  "invalid format - too few parts",
-			users: users,
-			input: []string{"alice"},
-			error: "invalid auth-tokens: alice, expected format: 'user:token[:label]'",
-		},
-		{
-			name:  "invalid format - too many parts",
-			users: users,
-			input: []string{"alice:token:label:extra:parts"},
-			error: "invalid auth-tokens: alice:token:label:extra:parts, expected format: 'user:token[:label]'",
-		},
-		{
-			name:  "user not provisioned",
-			users: users,
-			input: []string{"charlie:tk_abcdefghijklmnopqrstuvwxyz123"},
-			error: "invalid auth-tokens: charlie:tk_abcdefghijklmnopqrstuvwxyz123, user charlie is not provisioned",
-		},
-		{
-			name:  "invalid token format",
-			users: users,
-			input: []string{"alice:invalid-token"},
-			error: "invalid auth-tokens: alice:invalid-token, token invalid-token invalid, use 'ntfy token generate' to generate a random token",
-		},
-		{
-			name:  "token too short",
-			users: users,
-			input: []string{"alice:tk_short"},
-			error: "invalid auth-tokens: alice:tk_short, token tk_short invalid, use 'ntfy token generate' to generate a random token",
-		},
-		{
-			name:  "token without prefix",
-			users: users,
-			input: []string{"alice:abcdefghijklmnopqrstuvwxyz12345"},
-			error: "invalid auth-tokens: alice:abcdefghijklmnopqrstuvwxyz12345, token abcdefghijklmnopqrstuvwxyz12345 invalid, use 'ntfy token generate' to generate a random token",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := parseTokens(tt.users, tt.input)
-			require.Error(t, err)
-			require.Nil(t, result)
-			assert.Contains(t, err.Error(), tt.error)
-		})
-	}
+func init() {
+	rand.Seed(time.Now().UnixMilli())
 }
 
 func TestCLI_Serve_Unix_Curl(t *testing.T) {
@@ -536,41 +88,6 @@ func TestIP_Host_Parsing(t *testing.T) {
 	}
 }
 
-func TestCLI_Serve_ClusterValidation(t *testing.T) {
-	configFile := newEmptyFile(t) // Avoid issues with existing server.yml file on system
-	// Setting cluster-listen implicitly enables clustering, which requires database-url; all
-	// validation must fail before any database connection is attempted
-	app, _, _, _ := newTestApp()
-	err := app.Run([]string{"ntfy", "serve", "--config=" + configFile, "--cluster-listen=127.0.0.1:2587"})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "database-url")
-	// cluster-listen requires cluster-secret
-	app, _, _, _ = newTestApp()
-	err = app.Run([]string{"ntfy", "serve", "--config=" + configFile, "--cluster-listen=127.0.0.1:2587", "--database-url=postgres://user:pass@localhost:1/na"})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "cluster-secret")
-	// cluster-listen requires an explicit stable node ID
-	app, _, _, _ = newTestApp()
-	err = app.Run([]string{"ntfy", "serve", "--config=" + configFile, "--cluster-listen=127.0.0.1:2587", "--database-url=postgres://user:pass@localhost:1/na", "--cluster-secret=s3cret"})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "cluster-node-id")
-	// cluster-secret without cluster-listen is a config error (clustering would silently be off)
-	app, _, _, _ = newTestApp()
-	err = app.Run([]string{"ntfy", "serve", "--config=" + configFile, "--cluster-secret=s3cret"})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "cluster-listen")
-	// A wildcard cluster-listen bind cannot derive an advertise URL
-	app, _, _, _ = newTestApp()
-	err = app.Run([]string{"ntfy", "serve", "--config=" + configFile, "--cluster-listen=:2587", "--database-url=postgres://user:pass@localhost:1/na", "--cluster-secret=s3cret", "--cluster-node-id=node-a"})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "cluster-advertise-url")
-	// cluster-batch-linger must not be negative
-	app, _, _, _ = newTestApp()
-	err = app.Run([]string{"ntfy", "serve", "--config=" + configFile, "--cluster-batch-linger=-1s"})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "cluster batch linger")
-}
-
 func newEmptyFile(t *testing.T) string {
 	filename := filepath.Join(t.TempDir(), "empty")
 	require.Nil(t, os.WriteFile(filename, []byte{}, 0600))

cmd/serve_unix.go

@@ -1,55 +0,0 @@
-//go:build (darwin || linux || dragonfly || freebsd || netbsd || openbsd) && !noserver
-
-package cmd
-
-import (
-	"os"
-	"os/signal"
-	"syscall"
-
-	"github.com/urfave/cli/v2/altsrc"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/server"
-)
-
-func sigHandlerConfigReload(config string) {
-	sigs := make(chan os.Signal, 1)
-	signal.Notify(sigs, syscall.SIGHUP)
-	for range sigs {
-		log.Info("Partially hot reloading configuration ...")
-		inputSource, err := newYamlSourceFromFile(config, flagsServe)
-		if err != nil {
-			log.Warn("Hot reload failed: %s", err.Error())
-			continue
-		}
-		if err := reloadLogLevel(inputSource); err != nil {
-			log.Warn("Reloading log level failed: %s", err.Error())
-		}
-	}
-}
-
-func reloadLogLevel(inputSource altsrc.InputSourceContext) error {
-	newLevelStr, err := inputSource.String("log-level")
-	if err != nil {
-		return err
-	}
-	overrides, err := inputSource.StringSlice("log-level-overrides")
-	if err != nil {
-		return err
-	}
-	log.ResetLevelOverrides()
-	if err := applyLogLevelOverrides(overrides); err != nil {
-		return err
-	}
-	log.SetLevel(log.ToLevel(newLevelStr))
-	if len(overrides) > 0 {
-		log.Info("Log level is %v, %d override(s) in place", newLevelStr, len(overrides))
-	} else {
-		log.Info("Log level is %v", newLevelStr)
-	}
-	return nil
-}
-
-func maybeRunAsService(conf *server.Config) (bool, error) {
-	return false, nil
-}

cmd/serve_windows.go

@@ -1,100 +0,0 @@
-//go:build windows && !noserver
-
-package cmd
-
-import (
-	"fmt"
-	"sync"
-
-	"golang.org/x/sys/windows/svc"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/server"
-)
-
-const serviceName = "ntfy"
-
-// sigHandlerConfigReload is a no-op on Windows since SIGHUP is not available.
-// Windows users can restart the service to reload configuration.
-func sigHandlerConfigReload(config string) {
-	log.Debug("Config hot-reload via SIGHUP is not supported on Windows")
-}
-
-// runAsWindowsService runs the ntfy server as a Windows service
-func runAsWindowsService(conf *server.Config) error {
-	return svc.Run(serviceName, &windowsService{conf: conf})
-}
-
-// windowsService implements the svc.Handler interface
-type windowsService struct {
-	conf   *server.Config
-	server *server.Server
-	mu     sync.Mutex
-}
-
-// Execute is the main entry point for the Windows service
-func (s *windowsService) Execute(args []string, requests <-chan svc.ChangeRequest, status chan<- svc.Status) (bool, uint32) {
-	const cmdsAccepted = svc.AcceptStop | svc.AcceptShutdown
-	status <- svc.Status{State: svc.StartPending}
-
-	// Create and start the server
-	var err error
-	s.mu.Lock()
-	s.server, err = server.New(s.conf)
-	s.mu.Unlock()
-	if err != nil {
-		log.Error("Failed to create server: %s", err.Error())
-		return true, 1
-	}
-
-	// Start server in a goroutine
-	serverErrChan := make(chan error, 1)
-	go func() {
-		serverErrChan <- s.server.Run()
-	}()
-
-	status <- svc.Status{State: svc.Running, Accepts: cmdsAccepted}
-	log.Info("Windows service started")
-
-	for {
-		select {
-		case err := <-serverErrChan:
-			if err != nil {
-				log.Error("Server error: %s", err.Error())
-				return true, 1
-			}
-			return false, 0
-		case req := <-requests:
-			switch req.Cmd {
-			case svc.Interrogate:
-				status <- req.CurrentStatus
-			case svc.Stop, svc.Shutdown:
-				log.Info("Windows service stopping...")
-				status <- svc.Status{State: svc.StopPending}
-				s.mu.Lock()
-				if s.server != nil {
-					s.server.Stop()
-				}
-				s.mu.Unlock()
-				return false, 0
-			default:
-				log.Warn("Unexpected service control request: %d", req.Cmd)
-			}
-		}
-	}
-}
-
-// maybeRunAsService checks if the process is running as a Windows service,
-// and if so, runs the server as a service. Returns true if it ran as a service.
-func maybeRunAsService(conf *server.Config) (bool, error) {
-	isService, err := svc.IsWindowsService()
-	if err != nil {
-		return false, fmt.Errorf("failed to detect Windows service mode: %w", err)
-	} else if !isService {
-		return false, nil
-	}
-	log.Info("Running as Windows service")
-	if err := runAsWindowsService(conf); err != nil {
-		return true, fmt.Errorf("failed to run as Windows service: %w", err)
-	}
-	return true, nil
-}

cmd/subscribe.go

@@ -3,21 +3,28 @@ package cmd
 import (
 	"errors"
 	"fmt"
+	"github.com/urfave/cli/v2"
+	"heckel.io/ntfy/client"
+	"heckel.io/ntfy/log"
+	"heckel.io/ntfy/util"
 	"os"
 	"os/exec"
+	"os/user"
+	"path/filepath"
 	"sort"
 	"strings"
-
-	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/client"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/util"
 )
 
 func init() {
 	commands = append(commands, cmdSubscribe)
 }
 
+const (
+	clientRootConfigFileUnixAbsolute    = "/etc/ntfy/client.yml"
+	clientUserConfigFileUnixRelative    = "ntfy/client.yml"
+	clientUserConfigFileWindowsRelative = "ntfy\\client.yml"
+)
+
 var flagsSubscribe = append(
 	append([]cli.Flag{}, flagsDefault...),
 	&cli.StringFlag{Name: "config", Aliases: []string{"c"}, Usage: "client config file"},
@@ -218,17 +225,12 @@ func doSubscribe(c *cli.Context, cl *client.Client, conf *client.Config, topic,
 }
 
 func maybeAddAuthHeader(s client.Subscribe, conf *client.Config) client.SubscribeOption {
-	// if an explicit empty token or empty user:pass is given, exit without auth
-	if (s.Token != nil && *s.Token == "") || (s.User != nil && *s.User == "" && s.Password != nil && *s.Password == "") {
-		return client.WithEmptyAuth()
-	}
-
 	// check for subscription token then subscription user:pass
-	if s.Token != nil && *s.Token != "" {
-		return client.WithBearerAuth(*s.Token)
+	if s.Token != "" {
+		return client.WithBearerAuth(s.Token)
 	}
-	if s.User != nil && *s.User != "" && s.Password != nil {
-		return client.WithBasicAuth(*s.User, *s.Password)
+	if s.User != "" && s.Password != nil {
+		return client.WithBasicAuth(s.User, *s.Password)
 	}
 
 	// if no subscription token nor subscription user:pass, check for default token then default user:pass
@@ -303,16 +305,30 @@ func loadConfig(c *cli.Context) (*client.Config, error) {
 	if filename != "" {
 		return client.LoadConfig(filename)
 	}
-	if client.DefaultConfigFile != "" {
-		if s, _ := os.Stat(client.DefaultConfigFile); s != nil {
-			return client.LoadConfig(client.DefaultConfigFile)
-		}
-		log.Debug("Config file %s not found", client.DefaultConfigFile)
+	configFile := defaultClientConfigFile()
+	if s, _ := os.Stat(configFile); s != nil {
+		return client.LoadConfig(configFile)
 	}
-	log.Debug("Loading default config")
 	return client.NewConfig(), nil
 }
 
+//lint:ignore U1000 Conditionally used in different builds
+func defaultClientConfigFileUnix() string {
+	u, _ := user.Current()
+	configFile := clientRootConfigFileUnixAbsolute
+	if u.Uid != "0" {
+		homeDir, _ := os.UserConfigDir()
+		return filepath.Join(homeDir, clientUserConfigFileUnixRelative)
+	}
+	return configFile
+}
+
+//lint:ignore U1000 Conditionally used in different builds
+func defaultClientConfigFileWindows() string {
+	homeDir, _ := os.UserConfigDir()
+	return filepath.Join(homeDir, clientUserConfigFileWindowsRelative)
+}
+
 func logMessagePrefix(m *client.Message) string {
 	return fmt.Sprintf("%s/%s", util.ShortTopicURL(m.TopicURL), m.ID)
 }

cmd/subscribe_darwin.go

@@ -1,5 +1,3 @@
-//go:build darwin
-
 package cmd
 
 const (
@@ -12,3 +10,7 @@ or "~/Library/Application Support/ntfy/client.yml" for all other users.`
 var (
 	scriptLauncher = []string{"sh", "-c"}
 )
+
+func defaultClientConfigFile() string {
+	return defaultClientConfigFileUnix()
+}

cmd/subscribe_test.go

@@ -330,7 +330,7 @@ default-token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
 
 	app, _, stdout, _ := newTestApp()
 
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename, "mytopic"}))
+	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--config=" + filename, "mytopic"}))
 
 	require.Equal(t, message, strings.TrimSpace(stdout.String()))
 }
@@ -355,63 +355,7 @@ default-password: mypass
 
 	app, _, stdout, _ := newTestApp()
 
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename, "mytopic"}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Override_Default_UserPass_With_Empty_UserPass(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-user: philipp
-default-password: mypass
-subscribe:
-  - topic: mytopic
-    user: ""
-    password: ""
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Override_Default_Token_With_Empty_Token(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
-subscribe:
-  - topic: mytopic
-    token: ""
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename}))
+	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--config=" + filename, "mytopic"}))
 
 	require.Equal(t, message, strings.TrimSpace(stdout.String()))
 }

cmd/subscribe_unix.go

@@ -12,3 +12,7 @@ or ~/.config/ntfy/client.yml for all other users.`
 var (
 	scriptLauncher = []string{"sh", "-c"}
 )
+
+func defaultClientConfigFile() string {
+	return defaultClientConfigFileUnix()
+}

cmd/subscribe_windows.go

@@ -1,5 +1,3 @@
-//go:build windows
-
 package cmd
 
 const (
@@ -11,3 +9,7 @@ const (
 var (
 	scriptLauncher = []string{"cmd.exe", "/Q", "/C"}
 )
+
+func defaultClientConfigFile() string {
+	return defaultClientConfigFileWindows()
+}

cmd/tier.go

@@ -6,8 +6,8 @@ import (
 	"errors"
 	"fmt"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/user"
+	"heckel.io/ntfy/util"
 )
 
 func init() {
@@ -182,7 +182,7 @@ func execTierAdd(c *cli.Context) error {
 	}
 	if tier, _ := manager.Tier(code); tier != nil {
 		if c.Bool("ignore-exists") {
-			fmt.Fprintf(c.App.Writer, "tier %s already exists (exited successfully)\n", code)
+			fmt.Fprintf(c.App.ErrWriter, "tier %s already exists (exited successfully)\n", code)
 			return nil
 		}
 		return fmt.Errorf("tier %s already exists", code)
@@ -234,7 +234,7 @@ func execTierAdd(c *cli.Context) error {
 	if err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "tier added\n\n")
+	fmt.Fprintf(c.App.ErrWriter, "tier added\n\n")
 	printTier(c, tier)
 	return nil
 }
@@ -315,7 +315,7 @@ func execTierChange(c *cli.Context) error {
 	if err := manager.UpdateTier(tier); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "tier updated\n\n")
+	fmt.Fprintf(c.App.ErrWriter, "tier updated\n\n")
 	printTier(c, tier)
 	return nil
 }
@@ -335,7 +335,7 @@ func execTierDel(c *cli.Context) error {
 	if err := manager.RemoveTier(code); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "tier %s removed\n", code)
+	fmt.Fprintf(c.App.ErrWriter, "tier %s removed\n", code)
 	return nil
 }
 
@@ -359,16 +359,16 @@ func printTier(c *cli.Context, tier *user.Tier) {
 	if tier.StripeMonthlyPriceID != "" && tier.StripeYearlyPriceID != "" {
 		prices = fmt.Sprintf("%s / %s", tier.StripeMonthlyPriceID, tier.StripeYearlyPriceID)
 	}
-	fmt.Fprintf(c.App.Writer, "tier %s (id: %s)\n", tier.Code, tier.ID)
-	fmt.Fprintf(c.App.Writer, "- Name: %s\n", tier.Name)
-	fmt.Fprintf(c.App.Writer, "- Message limit: %d\n", tier.MessageLimit)
-	fmt.Fprintf(c.App.Writer, "- Message expiry duration: %s (%d seconds)\n", tier.MessageExpiryDuration.String(), int64(tier.MessageExpiryDuration.Seconds()))
-	fmt.Fprintf(c.App.Writer, "- Email limit: %d\n", tier.EmailLimit)
-	fmt.Fprintf(c.App.Writer, "- Phone call limit: %d\n", tier.CallLimit)
-	fmt.Fprintf(c.App.Writer, "- Reservation limit: %d\n", tier.ReservationLimit)
-	fmt.Fprintf(c.App.Writer, "- Attachment file size limit: %s\n", util.FormatSizeHuman(tier.AttachmentFileSizeLimit))
-	fmt.Fprintf(c.App.Writer, "- Attachment total size limit: %s\n", util.FormatSizeHuman(tier.AttachmentTotalSizeLimit))
-	fmt.Fprintf(c.App.Writer, "- Attachment expiry duration: %s (%d seconds)\n", tier.AttachmentExpiryDuration.String(), int64(tier.AttachmentExpiryDuration.Seconds()))
-	fmt.Fprintf(c.App.Writer, "- Attachment daily bandwidth limit: %s\n", util.FormatSizeHuman(tier.AttachmentBandwidthLimit))
-	fmt.Fprintf(c.App.Writer, "- Stripe prices (monthly/yearly): %s\n", prices)
+	fmt.Fprintf(c.App.ErrWriter, "tier %s (id: %s)\n", tier.Code, tier.ID)
+	fmt.Fprintf(c.App.ErrWriter, "- Name: %s\n", tier.Name)
+	fmt.Fprintf(c.App.ErrWriter, "- Message limit: %d\n", tier.MessageLimit)
+	fmt.Fprintf(c.App.ErrWriter, "- Message expiry duration: %s (%d seconds)\n", tier.MessageExpiryDuration.String(), int64(tier.MessageExpiryDuration.Seconds()))
+	fmt.Fprintf(c.App.ErrWriter, "- Email limit: %d\n", tier.EmailLimit)
+	fmt.Fprintf(c.App.ErrWriter, "- Phone call limit: %d\n", tier.CallLimit)
+	fmt.Fprintf(c.App.ErrWriter, "- Reservation limit: %d\n", tier.ReservationLimit)
+	fmt.Fprintf(c.App.ErrWriter, "- Attachment file size limit: %s\n", util.FormatSize(tier.AttachmentFileSizeLimit))
+	fmt.Fprintf(c.App.ErrWriter, "- Attachment total size limit: %s\n", util.FormatSize(tier.AttachmentTotalSizeLimit))
+	fmt.Fprintf(c.App.ErrWriter, "- Attachment expiry duration: %s (%d seconds)\n", tier.AttachmentExpiryDuration.String(), int64(tier.AttachmentExpiryDuration.Seconds()))
+	fmt.Fprintf(c.App.ErrWriter, "- Attachment daily bandwidth limit: %s\n", util.FormatSize(tier.AttachmentBandwidthLimit))
+	fmt.Fprintf(c.App.ErrWriter, "- Stripe prices (monthly/yearly): %s\n", prices)
 }

cmd/tier_test.go

@@ -3,8 +3,8 @@ package cmd
 import (
 	"github.com/stretchr/testify/require"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/server"
-	"heckel.io/ntfy/v2/test"
+	"heckel.io/ntfy/server"
+	"heckel.io/ntfy/test"
 	"testing"
 )
 
@@ -12,21 +12,21 @@ func TestCLI_Tier_AddListChangeDelete(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
 	defer test.StopServer(t, s, port)
 
-	app, _, stdout, _ := newTestApp()
+	app, _, _, stderr := newTestApp()
 	require.Nil(t, runTierCommand(app, conf, "add", "--name", "Pro", "--message-limit", "1234", "pro"))
-	require.Contains(t, stdout.String(), "tier added\n\ntier pro (id: ti_")
+	require.Contains(t, stderr.String(), "tier added\n\ntier pro (id: ti_")
 
 	err := runTierCommand(app, conf, "add", "pro")
 	require.NotNil(t, err)
 	require.Equal(t, "tier pro already exists", err.Error())
 
-	app, _, stdout, _ = newTestApp()
+	app, _, _, stderr = newTestApp()
 	require.Nil(t, runTierCommand(app, conf, "list"))
-	require.Contains(t, stdout.String(), "tier pro (id: ti_")
-	require.Contains(t, stdout.String(), "- Name: Pro")
-	require.Contains(t, stdout.String(), "- Message limit: 1234")
+	require.Contains(t, stderr.String(), "tier pro (id: ti_")
+	require.Contains(t, stderr.String(), "- Name: Pro")
+	require.Contains(t, stderr.String(), "- Message limit: 1234")
 
-	app, _, stdout, _ = newTestApp()
+	app, _, _, stderr = newTestApp()
 	require.Nil(t, runTierCommand(app, conf, "change",
 		"--message-limit=999",
 		"--message-expiry-duration=2d",
@@ -40,18 +40,18 @@ func TestCLI_Tier_AddListChangeDelete(t *testing.T) {
 		"--stripe-yearly-price-id=price_992",
 		"pro",
 	))
-	require.Contains(t, stdout.String(), "- Message limit: 999")
-	require.Contains(t, stdout.String(), "- Message expiry duration: 48h")
-	require.Contains(t, stdout.String(), "- Email limit: 91")
-	require.Contains(t, stdout.String(), "- Reservation limit: 98")
-	require.Contains(t, stdout.String(), "- Attachment file size limit: 100.0 MB")
-	require.Contains(t, stdout.String(), "- Attachment expiry duration: 24h")
-	require.Contains(t, stdout.String(), "- Attachment total size limit: 10.0 GB")
-	require.Contains(t, stdout.String(), "- Stripe prices (monthly/yearly): price_991 / price_992")
+	require.Contains(t, stderr.String(), "- Message limit: 999")
+	require.Contains(t, stderr.String(), "- Message expiry duration: 48h")
+	require.Contains(t, stderr.String(), "- Email limit: 91")
+	require.Contains(t, stderr.String(), "- Reservation limit: 98")
+	require.Contains(t, stderr.String(), "- Attachment file size limit: 100.0 MB")
+	require.Contains(t, stderr.String(), "- Attachment expiry duration: 24h")
+	require.Contains(t, stderr.String(), "- Attachment total size limit: 10.0 GB")
+	require.Contains(t, stderr.String(), "- Stripe prices (monthly/yearly): price_991 / price_992")
 
-	app, _, stdout, _ = newTestApp()
+	app, _, _, stderr = newTestApp()
 	require.Nil(t, runTierCommand(app, conf, "remove", "pro"))
-	require.Contains(t, stdout.String(), "tier pro removed")
+	require.Contains(t, stderr.String(), "tier pro removed")
 }
 
 func runTierCommand(app *cli.App, conf *server.Config, args ...string) error {

cmd/token.go

@@ -6,8 +6,8 @@ import (
 	"errors"
 	"fmt"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/user"
+	"heckel.io/ntfy/util"
 	"net/netip"
 	"time"
 )
@@ -72,15 +72,6 @@ Example:
 This is a server-only command. It directly reads from user.db as defined in the server config
 file server.yml. The command only works if 'auth-file' is properly defined.`,
 		},
-		{
-			Name:   "generate",
-			Usage:  "Generates a random token",
-			Action: execTokenGenerate,
-			Description: `Randomly generate a token to be used in provisioned tokens.
-
-This command only generates the token value, but does not persist it anywhere.
-The output can be used in the 'auth-tokens' config option.`,
-		},
 	},
 	Description: `Manage access tokens for individual users.
 
@@ -121,19 +112,19 @@ func execTokenAdd(c *cli.Context) error {
 		return err
 	}
 	u, err := manager.User(username)
-	if errors.Is(err, user.ErrUserNotFound) {
+	if err == user.ErrUserNotFound {
 		return fmt.Errorf("user %s does not exist", username)
 	} else if err != nil {
 		return err
 	}
-	token, err := manager.CreateToken(u.ID, label, expires, netip.IPv4Unspecified(), false)
+	token, err := manager.CreateToken(u.ID, label, expires, netip.IPv4Unspecified())
 	if err != nil {
 		return err
 	}
 	if expires.Unix() == 0 {
-		fmt.Fprintf(c.App.Writer, "token %s created for user %s, never expires\n", token.Value, u.Name)
+		fmt.Fprintf(c.App.ErrWriter, "token %s created for user %s, never expires\n", token.Value, u.Name)
 	} else {
-		fmt.Fprintf(c.App.Writer, "token %s created for user %s, expires %v\n", token.Value, u.Name, expires.Format(time.UnixDate))
+		fmt.Fprintf(c.App.ErrWriter, "token %s created for user %s, expires %v\n", token.Value, u.Name, expires.Format(time.UnixDate))
 	}
 	return nil
 }
@@ -150,7 +141,7 @@ func execTokenDel(c *cli.Context) error {
 		return err
 	}
 	u, err := manager.User(username)
-	if errors.Is(err, user.ErrUserNotFound) {
+	if err == user.ErrUserNotFound {
 		return fmt.Errorf("user %s does not exist", username)
 	} else if err != nil {
 		return err
@@ -158,7 +149,7 @@ func execTokenDel(c *cli.Context) error {
 	if err := manager.RemoveToken(u.ID, token); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "token %s for user %s removed\n", token, username)
+	fmt.Fprintf(c.App.ErrWriter, "token %s for user %s removed\n", token, username)
 	return nil
 }
 
@@ -174,7 +165,7 @@ func execTokenList(c *cli.Context) error {
 	var users []*user.User
 	if username != "" {
 		u, err := manager.User(username)
-		if errors.Is(err, user.ErrUserNotFound) {
+		if err == user.ErrUserNotFound {
 			return fmt.Errorf("user %s does not exist", username)
 		} else if err != nil {
 			return err
@@ -192,15 +183,15 @@ func execTokenList(c *cli.Context) error {
 		if err != nil {
 			return err
 		} else if len(tokens) == 0 && username != "" {
-			fmt.Fprintf(c.App.Writer, "user %s has no access tokens\n", username)
+			fmt.Fprintf(c.App.ErrWriter, "user %s has no access tokens\n", username)
 			return nil
 		} else if len(tokens) == 0 {
 			continue
 		}
 		usersWithTokens++
-		fmt.Fprintf(c.App.Writer, "user %s\n", u.Name)
+		fmt.Fprintf(c.App.ErrWriter, "user %s\n", u.Name)
 		for _, t := range tokens {
-			var label, expires, provisioned string
+			var label, expires string
 			if t.Label != "" {
 				label = fmt.Sprintf(" (%s)", t.Label)
 			}
@@ -209,19 +200,11 @@ func execTokenList(c *cli.Context) error {
 			} else {
 				expires = fmt.Sprintf("expires %s", t.Expires.Format(time.RFC822))
 			}
-			if t.Provisioned {
-				provisioned = " (server config)"
-			}
-			fmt.Fprintf(c.App.Writer, "- %s%s, %s, accessed from %s at %s%s\n", t.Value, label, expires, t.LastOrigin.String(), t.LastAccess.Format(time.RFC822), provisioned)
+			fmt.Fprintf(c.App.ErrWriter, "- %s%s, %s, accessed from %s at %s\n", t.Value, label, expires, t.LastOrigin.String(), t.LastAccess.Format(time.RFC822))
 		}
 	}
 	if usersWithTokens == 0 {
-		fmt.Fprintf(c.App.Writer, "no users with tokens\n")
+		fmt.Fprintf(c.App.ErrWriter, "no users with tokens\n")
 	}
 	return nil
 }
-
-func execTokenGenerate(c *cli.Context) error {
-	fmt.Fprintln(c.App.Writer, user.GenerateToken())
-	return nil
-}

cmd/token_test.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"github.com/stretchr/testify/require"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/server"
-	"heckel.io/ntfy/v2/test"
+	"heckel.io/ntfy/server"
+	"heckel.io/ntfy/test"
 	"regexp"
 	"testing"
 )
@@ -14,28 +14,28 @@ func TestCLI_Token_AddListRemove(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
 	defer test.StopServer(t, s, port)
 
-	app, stdin, stdout, _ := newTestApp()
+	app, stdin, _, stderr := newTestApp()
 	stdin.WriteString("mypass\nmypass")
 	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role user")
+	require.Contains(t, stderr.String(), "user phil added with role user")
 
-	app, _, stdout, _ = newTestApp()
+	app, _, _, stderr = newTestApp()
 	require.Nil(t, runTokenCommand(app, conf, "add", "phil"))
-	require.Regexp(t, `token tk_.+ created for user phil, never expires`, stdout.String())
+	require.Regexp(t, `token tk_.+ created for user phil, never expires`, stderr.String())
 
-	app, _, stdout, _ = newTestApp()
+	app, _, _, stderr = newTestApp()
 	require.Nil(t, runTokenCommand(app, conf, "list", "phil"))
-	require.Regexp(t, `user phil\n- tk_.+, never expires, accessed from 0.0.0.0 at .+`, stdout.String())
+	require.Regexp(t, `user phil\n- tk_.+, never expires, accessed from 0.0.0.0 at .+`, stderr.String())
 	re := regexp.MustCompile(`tk_\w+`)
-	token := re.FindString(stdout.String())
+	token := re.FindString(stderr.String())
 
-	app, _, stdout, _ = newTestApp()
+	app, _, _, stderr = newTestApp()
 	require.Nil(t, runTokenCommand(app, conf, "remove", "phil", token))
-	require.Regexp(t, fmt.Sprintf("token %s for user phil removed", token), stdout.String())
+	require.Regexp(t, fmt.Sprintf("token %s for user phil removed", token), stderr.String())
 
-	app, _, stdout, _ = newTestApp()
+	app, _, _, stderr = newTestApp()
 	require.Nil(t, runTokenCommand(app, conf, "list"))
-	require.Equal(t, "no users with tokens\n", stdout.String())
+	require.Equal(t, "no users with tokens\n", stderr.String())
 }
 
 func runTokenCommand(app *cli.App, conf *server.Config, args ...string) error {

cmd/user.go

@@ -6,18 +6,13 @@ import (
 	"crypto/subtle"
 	"errors"
 	"fmt"
+	"heckel.io/ntfy/user"
 	"os"
 	"strings"
-	"time"
 
 	"github.com/urfave/cli/v2"
 	"github.com/urfave/cli/v2/altsrc"
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/db/pg"
-	"heckel.io/ntfy/v2/mail"
-	"heckel.io/ntfy/v2/server"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/util"
 )
 
 const (
@@ -30,21 +25,15 @@ func init() {
 
 var flagsUser = append(
 	append([]cli.Flag{}, flagsDefault...),
-	&cli.StringFlag{Name: "config", Aliases: []string{"c"}, EnvVars: []string{"NTFY_CONFIG_FILE"}, Value: server.DefaultConfigFile, DefaultText: server.DefaultConfigFile, Usage: "config file"},
+	&cli.StringFlag{Name: "config", Aliases: []string{"c"}, EnvVars: []string{"NTFY_CONFIG_FILE"}, Value: defaultServerConfigFile, DefaultText: defaultServerConfigFile, Usage: "config file"},
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "auth-file", Aliases: []string{"auth_file", "H"}, EnvVars: []string{"NTFY_AUTH_FILE"}, Usage: "auth database file used for access control"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "auth-default-access", Aliases: []string{"auth_default_access", "p"}, EnvVars: []string{"NTFY_AUTH_DEFAULT_ACCESS"}, Value: "read-write", Usage: "default permissions if no matching entries in the auth database are found"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "database-url", Aliases: []string{"database_url"}, EnvVars: []string{"NTFY_DATABASE_URL"}, Usage: "PostgreSQL connection string for database-backed stores"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "base-url", Aliases: []string{"base_url", "B"}, EnvVars: []string{"NTFY_BASE_URL"}, Usage: "externally visible base URL for this host (e.g. https://ntfy.sh)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-addr", Aliases: []string{"smtp_sender_addr"}, EnvVars: []string{"NTFY_SMTP_SENDER_ADDR"}, Usage: "SMTP server address (host:port) for outgoing emails"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-user", Aliases: []string{"smtp_sender_user"}, EnvVars: []string{"NTFY_SMTP_SENDER_USER"}, Usage: "SMTP user (if e-mail sending is enabled)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-pass", Aliases: []string{"smtp_sender_pass"}, EnvVars: []string{"NTFY_SMTP_SENDER_PASS"}, Usage: "SMTP password (if e-mail sending is enabled)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-from", Aliases: []string{"smtp_sender_from"}, EnvVars: []string{"NTFY_SMTP_SENDER_FROM"}, Usage: "SMTP sender address (if e-mail sending is enabled)"}),
 )
 
 var cmdUser = &cli.Command{
 	Name:      "user",
 	Usage:     "Manage/show users",
-	UsageText: "ntfy user [list|add|remove|change-pass|reset-pass|change-role] ...",
+	UsageText: "ntfy user [list|add|remove|change-pass|change-role] ...",
 	Flags:     flagsUser,
 	Before:    initConfigFileInputSourceFunc("config", flagsUser, initLogFunc),
 	Category:  categoryServer,
@@ -53,7 +42,7 @@ var cmdUser = &cli.Command{
 			Name:      "add",
 			Aliases:   []string{"a"},
 			Usage:     "Adds a new user",
-			UsageText: "ntfy user add [--role=admin|user] USERNAME\nNTFY_PASSWORD=... ntfy user add [--role=admin|user] USERNAME\nNTFY_PASSWORD_HASH=... ntfy user add [--role=admin|user] USERNAME",
+			UsageText: "ntfy user add [--role=admin|user] USERNAME\nNTFY_PASSWORD=... ntfy user add [--role=admin|user] USERNAME",
 			Action:    execUserAdd,
 			Flags: []cli.Flag{
 				&cli.StringFlag{Name: "role", Aliases: []string{"r"}, Value: string(user.RoleUser), Usage: "user role"},
@@ -66,13 +55,12 @@ granted otherwise by the auth-default-access setting). An admin user has read an
 topics.
 
 Examples:
-  ntfy user add phil                          # Add regular user phil
-  ntfy user add --role=admin phil             # Add admin user phil
-  NTFY_PASSWORD=... ntfy user add phil        # Add user, using env variable to set password (for scripts)
-  NTFY_PASSWORD_HASH=... ntfy user add phil   # Add user, using env variable to set password hash (for scripts)
+  ntfy user add phil                     # Add regular user phil  
+  ntfy user add --role=admin phil        # Add admin user phil
+  NTFY_PASSWORD=... ntfy user add phil   # Add user, using env variable to set password (for scripts)
 
-You may set the NTFY_PASSWORD environment variable to pass the password, or NTFY_PASSWORD_HASH to pass
-directly the bcrypt hash. This is useful if you are creating users via scripts.
+You may set the NTFY_PASSWORD environment variable to pass the password. This is useful if 
+you are creating users via scripts.
 `,
 		},
 		{
@@ -91,7 +79,7 @@ Example:
 			Name:      "change-pass",
 			Aliases:   []string{"chp"},
 			Usage:     "Changes a user's password",
-			UsageText: "ntfy user change-pass USERNAME\nNTFY_PASSWORD=... ntfy user change-pass USERNAME\nNTFY_PASSWORD_HASH=... ntfy user change-pass USERNAME",
+			UsageText: "ntfy user change-pass USERNAME\nNTFY_PASSWORD=... ntfy user change-pass USERNAME",
 			Action:    execUserChangePass,
 			Description: `Change the password for the given user.
 
@@ -101,34 +89,10 @@ it twice.
 Example:
   ntfy user change-pass phil
   NTFY_PASSWORD=.. ntfy user change-pass phil
-  NTFY_PASSWORD_HASH=.. ntfy user change-pass phil
 
-You may set the NTFY_PASSWORD environment variable to pass the new password or NTFY_PASSWORD_HASH to pass
-directly the bcrypt hash. This is useful if you are updating users via scripts.
-`,
-		},
-		{
-			Name:      "reset-pass",
-			Aliases:   []string{"rp"},
-			Usage:     "Generates a password reset link for a user",
-			UsageText: "ntfy user reset-pass [--send-email] USERNAME",
-			Action:    execUserResetPass,
-			Flags: []cli.Flag{
-				&cli.BoolFlag{Name: "send-email", Aliases: []string{"e"}, Usage: "also email the reset link to the user's primary email"},
-			},
-			Description: `Generate a password reset link for the given user and print it to stdout.
+You may set the NTFY_PASSWORD environment variable to pass the new password. This is 
+useful if you are updating users via scripts.
 
-The user completes the reset by opening the link in a browser and choosing a new password;
-the admin never learns or chooses the new password. The link is single-use and expires after
-one hour. This is an admin override of the self-service reset flow -- unlike self-service, it
-does not require the user to have a verified primary email (the token is bound to the user).
-
-With --send-email, the link is additionally emailed to the user's primary email address (this
-requires SMTP to be configured and the user to have a verified primary email).
-
-Example:
-  ntfy user reset-pass phil               # Print a reset link for user phil
-  ntfy user reset-pass --send-email phil  # Print and email the reset link
 `,
 		},
 		{
@@ -167,22 +131,6 @@ as messages per day, attachment file sizes, etc.
 Example:
   ntfy user change-tier phil pro   # Change tier to "pro" for user "phil"  
   ntfy user change-tier phil -     # Remove tier from user "phil" entirely 
-`,
-		},
-		{
-			Name:      "hash",
-			Usage:     "Create password hash for a predefined user",
-			UsageText: "ntfy user hash",
-			Action:    execUserHash,
-			Description: `Asks for a password and creates a bcrypt password hash.
-
-This command is useful to create a password hash for a user, which can then be used
-for predefined users in the server config file, in auth-users.
-
-Example:
-  $ ntfy user hash
-  (asks for password and confirmation)
-  $2a$10$YLiO8U21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C
 `,
 		},
 		{
@@ -226,12 +174,7 @@ variable to pass the new password. This is useful if you are creating/updating u
 func execUserAdd(c *cli.Context) error {
 	username := c.Args().Get(0)
 	role := user.Role(c.String("role"))
-	password, hashed := os.LookupEnv("NTFY_PASSWORD_HASH")
-
-	if !hashed {
-		password = os.Getenv("NTFY_PASSWORD")
-	}
-
+	password := os.Getenv("NTFY_PASSWORD")
 	if username == "" {
 		return errors.New("username expected, type 'ntfy user add --help' for help")
 	} else if username == userEveryone || username == user.Everyone {
@@ -245,7 +188,7 @@ func execUserAdd(c *cli.Context) error {
 	}
 	if user, _ := manager.User(username); user != nil {
 		if c.Bool("ignore-exists") {
-			fmt.Fprintf(c.App.Writer, "user %s already exists (exited successfully)\n", username)
+			fmt.Fprintf(c.App.ErrWriter, "user %s already exists (exited successfully)\n", username)
 			return nil
 		}
 		return fmt.Errorf("user %s already exists", username)
@@ -255,12 +198,13 @@ func execUserAdd(c *cli.Context) error {
 		if err != nil {
 			return err
 		}
+
 		password = p
 	}
-	if err := manager.AddUser(username, password, role, hashed); err != nil {
+	if err := manager.AddUser(username, password, role); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "user %s added with role %s\n", username, role)
+	fmt.Fprintf(c.App.ErrWriter, "user %s added with role %s\n", username, role)
 	return nil
 }
 
@@ -275,22 +219,19 @@ func execUserDel(c *cli.Context) error {
 	if err != nil {
 		return err
 	}
-	if _, err := manager.User(username); errors.Is(err, user.ErrUserNotFound) {
+	if _, err := manager.User(username); err == user.ErrUserNotFound {
 		return fmt.Errorf("user %s does not exist", username)
 	}
 	if err := manager.RemoveUser(username); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "user %s removed\n", username)
+	fmt.Fprintf(c.App.ErrWriter, "user %s removed\n", username)
 	return nil
 }
 
 func execUserChangePass(c *cli.Context) error {
 	username := c.Args().Get(0)
-	password, hashed := os.LookupEnv("NTFY_PASSWORD_HASH")
-	if !hashed {
-		password = os.Getenv("NTFY_PASSWORD")
-	}
+	password := os.Getenv("NTFY_PASSWORD")
 	if username == "" {
 		return errors.New("username expected, type 'ntfy user change-pass --help' for help")
 	} else if username == userEveryone || username == user.Everyone {
@@ -300,7 +241,7 @@ func execUserChangePass(c *cli.Context) error {
 	if err != nil {
 		return err
 	}
-	if _, err := manager.User(username); errors.Is(err, user.ErrUserNotFound) {
+	if _, err := manager.User(username); err == user.ErrUserNotFound {
 		return fmt.Errorf("user %s does not exist", username)
 	}
 	if password == "" {
@@ -309,65 +250,10 @@ func execUserChangePass(c *cli.Context) error {
 			return err
 		}
 	}
-	if err := manager.ChangePassword(username, password, hashed); err != nil {
+	if err := manager.ChangePassword(username, password); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "changed password for user %s\n", username)
-	return nil
-}
-
-func execUserResetPass(c *cli.Context) error {
-	username := c.Args().Get(0)
-	sendEmail := c.Bool("send-email")
-	baseURL := strings.TrimSuffix(c.String("base-url"), "/")
-	if username == "" {
-		return errors.New("username expected, type 'ntfy user reset-pass --help' for help")
-	} else if username == userEveryone || username == user.Everyone {
-		return errors.New("username not allowed")
-	} else if baseURL == "" {
-		return errors.New("base-url must be configured to generate a reset link")
-	}
-	manager, err := createUserManager(c)
-	if err != nil {
-		return err
-	}
-	u, err := manager.User(username)
-	if errors.Is(err, user.ErrUserNotFound) {
-		return fmt.Errorf("user %s does not exist", username)
-	} else if err != nil {
-		return err
-	} else if u.Provisioned {
-		return fmt.Errorf("user %s is provisioned in the config file; its password cannot be reset", username)
-	}
-	// Resolve the primary email up front if we need to send -- fail before creating a token
-	var primaryEmail string
-	if sendEmail {
-		primaryEmail, err = manager.PrimaryEmail(u.ID)
-		if err != nil {
-			return err
-		} else if primaryEmail == "" {
-			return fmt.Errorf("user %s has no primary email; cannot send reset link (omit --send-email to just print it)", username)
-		}
-	}
-	// The reset token is bound to the user, not an email -- so this works even with no SMTP
-	token, err := manager.AddMagicLink(user.MagicLinkKindPasswordReset, u.ID, "", time.Hour)
-	if err != nil {
-		return err
-	}
-	link := baseURL + "/account/password/reset/" + token
-	fmt.Fprintln(c.App.Writer, link)
-	if sendEmail {
-		sender := mail.NewSender(&mail.Config{
-			SMTPAddr: c.String("smtp-sender-addr"),
-			SMTPUser: c.String("smtp-sender-user"),
-			SMTPPass: c.String("smtp-sender-pass"),
-			From:     c.String("smtp-sender-from"),
-		})
-		if err := sender.SendPasswordReset(primaryEmail, link); err != nil {
-			return fmt.Errorf("failed to send reset email to %s: %w", primaryEmail, err)
-		}
-		fmt.Fprintf(c.App.ErrWriter, "reset link emailed to %s\n", primaryEmail)
-	}
+	fmt.Fprintf(c.App.ErrWriter, "changed password for user %s\n", username)
 	return nil
 }
 
@@ -383,26 +269,13 @@ func execUserChangeRole(c *cli.Context) error {
 	if err != nil {
 		return err
 	}
-	if _, err := manager.User(username); errors.Is(err, user.ErrUserNotFound) {
+	if _, err := manager.User(username); err == user.ErrUserNotFound {
 		return fmt.Errorf("user %s does not exist", username)
 	}
 	if err := manager.ChangeRole(username, role); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "changed role for user %s to %s\n", username, role)
-	return nil
-}
-
-func execUserHash(c *cli.Context) error {
-	password, err := readPasswordAndConfirm(c)
-	if err != nil {
-		return err
-	}
-	hash, err := user.HashPassword(password, user.DefaultUserPasswordBcryptCost)
-	if err != nil {
-		return fmt.Errorf("failed to hash password: %w", err)
-	}
-	fmt.Fprintln(c.App.Writer, hash)
+	fmt.Fprintf(c.App.ErrWriter, "changed role for user %s to %s\n", username, role)
 	return nil
 }
 
@@ -420,19 +293,19 @@ func execUserChangeTier(c *cli.Context) error {
 	if err != nil {
 		return err
 	}
-	if _, err := manager.User(username); errors.Is(err, user.ErrUserNotFound) {
+	if _, err := manager.User(username); err == user.ErrUserNotFound {
 		return fmt.Errorf("user %s does not exist", username)
 	}
 	if tier == tierReset {
 		if err := manager.ResetTier(username); err != nil {
 			return err
 		}
-		fmt.Fprintf(c.App.Writer, "removed tier from user %s\n", username)
+		fmt.Fprintf(c.App.ErrWriter, "removed tier from user %s\n", username)
 	} else {
 		if err := manager.ChangeTier(username, tier); err != nil {
 			return err
 		}
-		fmt.Fprintf(c.App.Writer, "changed tier for user %s to %s\n", username, tier)
+		fmt.Fprintf(c.App.ErrWriter, "changed tier for user %s to %s\n", username, tier)
 	}
 	return nil
 }
@@ -453,31 +326,16 @@ func createUserManager(c *cli.Context) (*user.Manager, error) {
 	authFile := c.String("auth-file")
 	authStartupQueries := c.String("auth-startup-queries")
 	authDefaultAccess := c.String("auth-default-access")
-	databaseURL := c.String("database-url")
+	if authFile == "" {
+		return nil, errors.New("option auth-file not set; auth is unconfigured for this server")
+	} else if !util.FileExists(authFile) {
+		return nil, errors.New("auth-file does not exist; please start the server at least once to create it")
+	}
 	authDefault, err := user.ParsePermission(authDefaultAccess)
 	if err != nil {
 		return nil, errors.New("if set, auth-default-access must start set to 'read-write', 'read-only', 'write-only' or 'deny-all'")
 	}
-	authConfig := &user.Config{
-		DefaultAccess:       authDefault,
-		ProvisionEnabled:    false, // Hack: Do not re-provision users on manager initialization
-		BcryptCost:          user.DefaultUserPasswordBcryptCost,
-		QueueWriterInterval: user.DefaultUserStatsQueueWriterInterval,
-		AccessCacheEnabled:  false, // Do not cache for CLI commands
-	}
-	if databaseURL != "" {
-		host, dbErr := pg.Open(databaseURL)
-		if dbErr != nil {
-			return nil, dbErr
-		}
-		return user.NewPostgresManager(db.New(host, nil), authConfig)
-	} else if authFile != "" {
-		if !util.FileExists(authFile) {
-			return nil, errors.New("auth-file does not exist; please start the server at least once to create it")
-		}
-		return user.NewSQLiteManager(authFile, authStartupQueries, authConfig)
-	}
-	return nil, errors.New("option database-url or auth-file not set; auth is unconfigured for this server")
+	return user.NewManager(authFile, authStartupQueries, authDefault, user.DefaultUserPasswordBcryptCost, user.DefaultUserStatsQueueWriterInterval)
 }
 
 func readPasswordAndConfirm(c *cli.Context) (string, error) {
@@ -485,8 +343,6 @@ func readPasswordAndConfirm(c *cli.Context) (string, error) {
 	password, err := util.ReadPassword(c.App.Reader)
 	if err != nil {
 		return "", err
-	} else if len(password) == 0 {
-		return "", errors.New("password cannot be empty")
 	}
 	fmt.Fprintf(c.App.ErrWriter, "\r%s\rconfirm: ", strings.Repeat(" ", 25))
 	confirm, err := util.ReadPassword(c.App.Reader)

cmd/user_test.go

@@ -1,35 +1,34 @@
 package cmd
 
 import (
+	"github.com/stretchr/testify/require"
+	"github.com/urfave/cli/v2"
+	"heckel.io/ntfy/server"
+	"heckel.io/ntfy/test"
+	"heckel.io/ntfy/user"
 	"os"
 	"path/filepath"
 	"testing"
-
-	"github.com/stretchr/testify/require"
-	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/server"
-	"heckel.io/ntfy/v2/test"
-	"heckel.io/ntfy/v2/user"
 )
 
 func TestCLI_User_Add(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
 	defer test.StopServer(t, s, port)
 
-	app, stdin, stdout, _ := newTestApp()
+	app, stdin, _, stderr := newTestApp()
 	stdin.WriteString("mypass\nmypass")
 	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role user")
+	require.Contains(t, stderr.String(), "user phil added with role user")
 }
 
 func TestCLI_User_Add_Exists(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
 	defer test.StopServer(t, s, port)
 
-	app, stdin, stdout, _ := newTestApp()
+	app, stdin, _, stderr := newTestApp()
 	stdin.WriteString("mypass\nmypass")
 	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role user")
+	require.Contains(t, stderr.String(), "user phil added with role user")
 
 	app, stdin, _, _ = newTestApp()
 	stdin.WriteString("mypass\nmypass")
@@ -42,10 +41,10 @@ func TestCLI_User_Add_Admin(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
 	defer test.StopServer(t, s, port)
 
-	app, stdin, stdout, _ := newTestApp()
+	app, stdin, _, stderr := newTestApp()
 	stdin.WriteString("mypass\nmypass")
 	require.Nil(t, runUserCommand(app, conf, "add", "--role=admin", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role admin")
+	require.Contains(t, stderr.String(), "user phil added with role admin")
 }
 
 func TestCLI_User_Add_Password_Mismatch(t *testing.T) {
@@ -61,27 +60,19 @@ func TestCLI_User_Add_Password_Mismatch(t *testing.T) {
 
 func TestCLI_User_ChangePass(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
-	conf.AuthUsers = []*user.User{
-		{Name: "philuser", Hash: "$2a$10$U4WSIYY6evyGmZaraavM2e2JeVG6EMGUKN1uUwufUeeRd4Jpg6cGC", Role: user.RoleUser}, // philuser:philpass
-	}
 	defer test.StopServer(t, s, port)
 
 	// Add user
-	app, stdin, stdout, _ := newTestApp()
+	app, stdin, _, stderr := newTestApp()
 	stdin.WriteString("mypass\nmypass")
 	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role user")
+	require.Contains(t, stderr.String(), "user phil added with role user")
 
 	// Change pass
-	app, stdin, stdout, _ = newTestApp()
+	app, stdin, _, stderr = newTestApp()
 	stdin.WriteString("newpass\nnewpass")
 	require.Nil(t, runUserCommand(app, conf, "change-pass", "phil"))
-	require.Contains(t, stdout.String(), "changed password for user phil")
-
-	// Cannot change provisioned user's pass
-	app, stdin, _, _ = newTestApp()
-	stdin.WriteString("newpass\nnewpass")
-	require.Error(t, runUserCommand(app, conf, "change-pass", "philuser"))
+	require.Contains(t, stderr.String(), "changed password for user phil")
 }
 
 func TestCLI_User_ChangeRole(t *testing.T) {
@@ -89,15 +80,15 @@ func TestCLI_User_ChangeRole(t *testing.T) {
 	defer test.StopServer(t, s, port)
 
 	// Add user
-	app, stdin, stdout, _ := newTestApp()
+	app, stdin, _, stderr := newTestApp()
 	stdin.WriteString("mypass\nmypass")
 	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role user")
+	require.Contains(t, stderr.String(), "user phil added with role user")
 
 	// Change role
-	app, _, stdout, _ = newTestApp()
+	app, _, _, stderr = newTestApp()
 	require.Nil(t, runUserCommand(app, conf, "change-role", "phil", "admin"))
-	require.Contains(t, stdout.String(), "changed role for user phil to admin")
+	require.Contains(t, stderr.String(), "changed role for user phil to admin")
 }
 
 func TestCLI_User_Delete(t *testing.T) {
@@ -105,15 +96,15 @@ func TestCLI_User_Delete(t *testing.T) {
 	defer test.StopServer(t, s, port)
 
 	// Add user
-	app, stdin, stdout, _ := newTestApp()
+	app, stdin, _, stderr := newTestApp()
 	stdin.WriteString("mypass\nmypass")
 	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role user")
+	require.Contains(t, stderr.String(), "user phil added with role user")
 
 	// Delete user
-	app, _, stdout, _ = newTestApp()
+	app, _, _, stderr = newTestApp()
 	require.Nil(t, runUserCommand(app, conf, "del", "phil"))
-	require.Contains(t, stdout.String(), "user phil removed")
+	require.Contains(t, stderr.String(), "user phil removed")
 
 	// Delete user again (does not exist)
 	app, _, _, _ = newTestApp()
@@ -122,69 +113,6 @@ func TestCLI_User_Delete(t *testing.T) {
 	require.Contains(t, err.Error(), "user phil does not exist")
 }
 
-func TestCLI_User_ResetPass(t *testing.T) {
-	s, conf, port := newTestServerWithAuth(t)
-	defer test.StopServer(t, s, port)
-
-	app, stdin, _, _ := newTestApp()
-	stdin.WriteString("mypass\nmypass")
-	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-
-	// Prints a working-looking reset link when base-url is set
-	app, _, stdout, _ := newTestApp()
-	require.Nil(t, runUserCommand(app, conf, "--base-url=https://ntfy.example.com", "reset-pass", "phil"))
-	require.Contains(t, stdout.String(), "https://ntfy.example.com/account/password/reset/")
-}
-
-func TestCLI_User_ResetPass_NoBaseURL(t *testing.T) {
-	s, conf, port := newTestServerWithAuth(t)
-	defer test.StopServer(t, s, port)
-
-	app, stdin, _, _ := newTestApp()
-	stdin.WriteString("mypass\nmypass")
-	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-
-	app, _, _, _ = newTestApp()
-	err := runUserCommand(app, conf, "reset-pass", "phil")
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "base-url")
-}
-
-func TestCLI_User_ResetPass_SendEmailNoPrimary(t *testing.T) {
-	s, conf, port := newTestServerWithAuth(t)
-	defer test.StopServer(t, s, port)
-
-	app, stdin, _, _ := newTestApp()
-	stdin.WriteString("mypass\nmypass")
-	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-
-	// --send-email requires a primary email; phil has none
-	app, _, _, _ = newTestApp()
-	err := runUserCommand(app, conf, "--base-url=https://ntfy.example.com", "reset-pass", "--send-email", "phil")
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "no primary email")
-}
-
-func TestCLI_User_ResetPass_ProvisionedRejected(t *testing.T) {
-	s, conf, port := newTestServerWithAuth(t)
-	defer test.StopServer(t, s, port)
-
-	// Seed a provisioned user into the auth database via config provisioning
-	m, err := user.NewSQLiteManager(conf.AuthFile, "", &user.Config{
-		ProvisionEnabled: true,
-		Users: []*user.User{
-			{Name: "provuser", Hash: "$2a$10$YLiO8U21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C", Role: user.RoleUser},
-		},
-	})
-	require.Nil(t, err)
-	require.Nil(t, m.Close())
-
-	app, _, _, _ := newTestApp()
-	err = runUserCommand(app, conf, "--base-url=https://ntfy.example.com", "reset-pass", "provuser")
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "provisioned")
-}
-
 func newTestServerWithAuth(t *testing.T) (s *server.Server, conf *server.Config, port int) {
 	configFile := filepath.Join(t.TempDir(), "server-dummy.yml")
 	require.Nil(t, os.WriteFile(configFile, []byte(""), 0600)) // Dummy config file to avoid lookup of real server.yml
@@ -192,7 +120,6 @@ func newTestServerWithAuth(t *testing.T) (s *server.Server, conf *server.Config,
 	conf.File = configFile
 	conf.AuthFile = filepath.Join(t.TempDir(), "user.db")
 	conf.AuthDefault = user.PermissionDenyAll
-	conf.AuthAccessCacheEnabled = false
 	s, port = test.StartServerWithConfig(t, conf)
 	return
 }

cmd/webpush.go

@@ -1,19 +1,12 @@
-//go:build !noserver && !nowebpush
+//go:build !noserver
 
 package cmd
 
 import (
 	"fmt"
-	"os"
 
 	"github.com/SherClockHolmes/webpush-go"
 	"github.com/urfave/cli/v2"
-	"github.com/urfave/cli/v2/altsrc"
-)
-
-var flagsWebPush = append(
-	[]cli.Flag{},
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "output-file", Aliases: []string{"f"}, Usage: "write VAPID keys to this file"}),
 )
 
 func init() {
@@ -33,7 +26,6 @@ var cmdWebPush = &cli.Command{
 			Usage:     "Generate VAPID keys to enable browser background push notifications",
 			UsageText: "ntfy webpush keys",
 			Category:  categoryServer,
-			Flags:     flagsWebPush,
 		},
 	},
 }
@@ -43,19 +35,7 @@ func generateWebPushKeys(c *cli.Context) error {
 	if err != nil {
 		return err
 	}
-
-	if outputFile := c.String("output-file"); outputFile != "" {
-		contents := fmt.Sprintf(`---
-web-push-public-key: %s
-web-push-private-key: %s
-`, publicKey, privateKey)
-		err = os.WriteFile(outputFile, []byte(contents), 0660)
-		if err != nil {
-			return err
-		}
-		_, err = fmt.Fprintf(c.App.Writer, "Web Push keys written to %s.\n", outputFile)
-	} else {
-		_, err = fmt.Fprintf(c.App.Writer, `Web Push keys generated. Add the following lines to your config file:
+	_, err = fmt.Fprintf(c.App.ErrWriter, `Web Push keys generated. Add the following lines to your config file:
 
 web-push-public-key: %s
 web-push-private-key: %s
@@ -64,6 +44,5 @@ web-push-email-address: <email address>
 
 See https://ntfy.sh/docs/config/#web-push for details.
 `, publicKey, privateKey)
-	}
 	return err
 }

cmd/webpush_test.go

@@ -1,27 +1,17 @@
 package cmd
 
 import (
-	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/server"
+	"heckel.io/ntfy/server"
 )
 
 func TestCLI_WebPush_GenerateKeys(t *testing.T) {
-	app, _, stdout, _ := newTestApp()
+	app, _, _, stderr := newTestApp()
 	require.Nil(t, runWebPushCommand(app, server.NewConfig(), "keys"))
-	require.Contains(t, stdout.String(), "Web Push keys generated.")
-}
-
-func TestCLI_WebPush_WriteKeysToFile(t *testing.T) {
-	tempDir := t.TempDir()
-	t.Chdir(tempDir)
-	app, _, stdout, _ := newTestApp()
-	require.Nil(t, runWebPushCommand(app, server.NewConfig(), "keys", "--output-file=key-file.yaml"))
-	require.Contains(t, stdout.String(), "Web Push keys written to key-file.yaml")
-	require.FileExists(t, filepath.Join(tempDir, "key-file.yaml"))
+	require.Contains(t, stderr.String(), "Web Push keys generated.")
 }
 
 func runWebPushCommand(app *cli.App, conf *server.Config, args ...string) error {

db/db.go

@@ -1,146 +0,0 @@
-package db
-
-import (
-	"context"
-	"database/sql"
-	"sync/atomic"
-	"time"
-
-	"heckel.io/ntfy/v2/log"
-)
-
-const (
-	tag                            = "db"
-	replicaHealthCheckInitialDelay = 5 * time.Second
-	replicaHealthCheckInterval     = 30 * time.Second
-	replicaHealthCheckTimeout      = 10 * time.Second
-)
-
-// DB wraps a primary *sql.DB and optional read replicas. All standard query/exec methods
-// delegate to the primary. The ReadOnly() method returns a *sql.DB from a healthy replica
-// (round-robin), falling back to the primary if no replicas are configured or all are unhealthy.
-type DB struct {
-	primary  *Host
-	replicas []*Host
-	counter  atomic.Uint64
-	cancel   context.CancelFunc
-}
-
-// New creates a new DB that wraps the given primary and optional replica connections.
-// If replicas is nil or empty, ReadOnly() simply returns the primary.
-// Replicas start unhealthy and are checked immediately by a background goroutine.
-func New(primary *Host, replicas []*Host) *DB {
-	ctx, cancel := context.WithCancel(context.Background())
-	d := &DB{
-		primary:  primary,
-		replicas: replicas,
-		cancel:   cancel,
-	}
-	if len(d.replicas) > 0 {
-		go d.healthCheckLoop(ctx)
-	}
-	return d
-}
-
-// Query delegates to the primary database.
-func (d *DB) Query(query string, args ...any) (*sql.Rows, error) {
-	return d.primary.DB.Query(query, args...)
-}
-
-// QueryRow delegates to the primary database.
-func (d *DB) QueryRow(query string, args ...any) *sql.Row {
-	return d.primary.DB.QueryRow(query, args...)
-}
-
-// Exec delegates to the primary database.
-func (d *DB) Exec(query string, args ...any) (sql.Result, error) {
-	return d.primary.DB.Exec(query, args...)
-}
-
-// Begin delegates to the primary database.
-func (d *DB) Begin() (*sql.Tx, error) {
-	return d.primary.DB.Begin()
-}
-
-// Ping delegates to the primary database.
-func (d *DB) Ping() error {
-	return d.primary.DB.Ping()
-}
-
-// Primary returns the underlying primary *sql.DB. This is only intended for
-// one-time schema setup during store initialization, not for regular queries.
-func (d *DB) Primary() *sql.DB {
-	return d.primary.DB
-}
-
-// ReadOnly returns a *sql.DB suitable for read-only queries. It round-robins across healthy
-// replicas. If all replicas are unhealthy or none are configured, the primary is returned.
-func (d *DB) ReadOnly() *sql.DB {
-	if len(d.replicas) == 0 {
-		return d.primary.DB
-	}
-	n := len(d.replicas)
-	start := int(d.counter.Add(1) - 1)
-	for i := 0; i < n; i++ {
-		r := d.replicas[(start+i)%n]
-		if r.healthy.Load() {
-			return r.DB
-		}
-	}
-	return d.primary.DB
-}
-
-// MarkReplicasHealthyForTest immediately marks all configured replicas as healthy, bypassing the
-// async health-check loop's initial delay. It exists so tests can deterministically route
-// ReadOnly() to a replica without waiting; it is not used in production code.
-func (d *DB) MarkReplicasHealthyForTest() {
-	for _, r := range d.replicas {
-		r.healthy.Store(true)
-	}
-}
-
-// Close closes the primary database and all replicas, and stops the health-check goroutine.
-func (d *DB) Close() error {
-	d.cancel()
-	for _, r := range d.replicas {
-		r.DB.Close()
-	}
-	return d.primary.DB.Close()
-}
-
-// healthCheckLoop checks replicas immediately, then periodically on a ticker.
-func (d *DB) healthCheckLoop(ctx context.Context) {
-	select {
-	case <-ctx.Done():
-		return
-	case <-time.After(replicaHealthCheckInitialDelay):
-		d.checkReplicas(ctx)
-	}
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-time.After(replicaHealthCheckInterval):
-			d.checkReplicas(ctx)
-		}
-	}
-}
-
-// checkReplicas pings each replica with a timeout and updates its health status.
-func (d *DB) checkReplicas(ctx context.Context) {
-	for _, r := range d.replicas {
-		wasHealthy := r.healthy.Load()
-		pingCtx, cancel := context.WithTimeout(ctx, replicaHealthCheckTimeout)
-		err := r.DB.PingContext(pingCtx)
-		cancel()
-		if err != nil {
-			r.healthy.Store(false)
-			log.Tag(tag).Error("Database replica %s is unhealthy: %s", r.Addr, err)
-		} else {
-			r.healthy.Store(true)
-			if !wasHealthy {
-				log.Tag(tag).Info("Database replica %s is healthy", r.Addr)
-			}
-		}
-	}
-}

db/pg/leader.go

@@ -1,163 +0,0 @@
-package pg
-
-import (
-	"context"
-	"database/sql"
-	"sync"
-	"time"
-
-	"heckel.io/ntfy/v2/log"
-)
-
-const (
-	tagLeader = "leader"
-
-	tryAdvisoryLockQuery = `SELECT pg_try_advisory_lock($1)`
-	advisoryUnlockQuery  = `SELECT pg_advisory_unlock($1)`
-
-	defaultRenewInterval = 5 * time.Second
-	leaderMissedRenewals = 3
-	leaderHoldoffFactor  = 2
-)
-
-// Leader implements singleton-job leader election via a Postgres advisory lock held on a
-// pinned connection. The lock auto-releases when the holding connection dies, so a crashed
-// leader is replaced without manual fencing; distinct keys elect independently. The Leader
-// renews its lease on its own loop; callers only ask IsLeader and eventually Close.
-//
-// Holding the lock is not the same as believing to be the leader: IsLeader also requires a
-// recent renewal (lease duration) and a completed hold-off after winning the lock. The
-// hold-off outlasts the lease duration by construction, so on failover the old belief always
-// expires before the new one begins: a short no-leader gap, never two leaders. Defaults:
-// renew every 5s, lease duration 15s, hold-off 30s -> up to ~35s without a leader.
-type Leader struct {
-	db            *sql.DB
-	key           int64
-	renewInterval time.Duration
-	conn          *sql.Conn          // holds the advisory lock while this process is leader
-	acquiredAt    time.Time          // When the lock was won (this tenure), for the hold-off
-	renewedAt     time.Time          // Last successful renewal, for the lease duration; zero = lock not held
-	cancel        context.CancelFunc // Stops the renew loop and aborts its in-flight query on Close
-	closeOnce     sync.Once
-	wg            sync.WaitGroup
-	mu            sync.Mutex // Protects conn, acquiredAt and renewedAt
-}
-
-// NewLeader creates a Leader competing for the lock identified by key and starts its renew
-// loop. renewInterval is for tests; pass 0 for the default.
-func NewLeader(db *sql.DB, key int64, renewInterval time.Duration) *Leader {
-	if renewInterval <= 0 {
-		renewInterval = defaultRenewInterval
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	l := &Leader{
-		db:            db,
-		key:           key,
-		renewInterval: renewInterval,
-		cancel:        cancel,
-	}
-	l.wg.Add(1)
-	go l.runAcquireOrRenewLoop(ctx)
-	return l
-}
-
-// IsLeader reports whether this process should act as the leader: lock held, lease renewed
-// recently, hold-off elapsed (see the Leader doc comment).
-func (l *Leader) IsLeader() bool {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	leaseDuration := leaderMissedRenewals * l.renewInterval
-	holdoff := leaderHoldoffFactor * leaseDuration
-	return time.Since(l.renewedAt) < leaseDuration && time.Since(l.acquiredAt) >= holdoff
-}
-
-// Close stops competing for leadership and releases the lock. Idempotent.
-func (l *Leader) Close() {
-	l.closeOnce.Do(func() {
-		l.cancel() // Also aborts an in-flight renewal query
-		l.wg.Wait()
-		if l.IsLeader() {
-			log.Tag(tagLeader).Info("Lost leadership: closed (lock key %d)", l.key)
-		}
-		l.release()
-	})
-}
-
-// runAcquireOrRenewLoop acquires or renews the lock every renewInterval until ctx is canceled
-func (l *Leader) runAcquireOrRenewLoop(ctx context.Context) {
-	defer l.wg.Done()
-	ticker := time.NewTicker(l.renewInterval)
-	defer ticker.Stop()
-	wasLeader := false
-	for {
-		attemptCtx, cancel := context.WithTimeout(ctx, l.renewInterval)
-		l.tryAcquireOrRenew(attemptCtx)
-		cancel()
-		if isLeader := l.IsLeader(); isLeader != wasLeader {
-			wasLeader = isLeader
-			if isLeader {
-				log.Tag(tagLeader).Info("Became leader (lock key %d)", l.key)
-			} else {
-				log.Tag(tagLeader).Info("Lost leadership (lock key %d)", l.key)
-			}
-		}
-		select {
-		case <-ticker.C:
-		case <-ctx.Done():
-			return
-		}
-	}
-}
-
-// tryAcquireOrRenew renews the lock on a healthy leader (a cheap ping) or retries acquiring
-// it on a follower, on a pinned connection.
-func (l *Leader) tryAcquireOrRenew(ctx context.Context) {
-	l.mu.Lock()
-	conn := l.conn
-	l.mu.Unlock()
-	if conn != nil {
-		if conn.PingContext(ctx) == nil {
-			// Still holding the lock, connection healthy: renew the lease
-			l.mu.Lock()
-			l.renewedAt = time.Now()
-			l.mu.Unlock()
-			log.Tag(tagLeader).Trace("Renewed leader lease (lock key %d)", l.key)
-			return
-		}
-		log.Tag(tagLeader).Debug("Leader lock connection died, lock lost (lock key %d)", l.key)
-		l.release() // Connection died; the lock is already gone, re-acquire below
-	}
-	newConn, err := l.db.Conn(ctx)
-	if err != nil {
-		log.Tag(tagLeader).Debug("Cannot get connection to compete for leader lock (lock key %d): %s", l.key, err.Error())
-		return
-	}
-	var acquired bool
-	if err := newConn.QueryRowContext(ctx, tryAdvisoryLockQuery, l.key).Scan(&acquired); err != nil || !acquired {
-		newConn.Close()
-		log.Tag(tagLeader).Trace("Leader lock held elsewhere (lock key %d)", l.key)
-		return
-	}
-	log.Tag(tagLeader).Debug("Acquired leader lock (lock key %d); leadership after the hold-off", l.key)
-	l.mu.Lock()
-	l.conn = newConn
-	l.acquiredAt = time.Now()
-	l.renewedAt = l.acquiredAt
-	l.mu.Unlock()
-}
-
-// release unlocks the advisory lock and returns the pinned connection to the pool
-func (l *Leader) release() {
-	l.mu.Lock()
-	conn := l.conn
-	l.conn = nil
-	l.renewedAt = time.Time{} // Zero revokes belief; without it, IsLeader would linger a lease duration
-	l.mu.Unlock()
-	if conn != nil {
-		// Unlock explicitly: sql.Conn.Close() returns the connection to the pool, so the
-		// session-scoped lock would otherwise stay held
-		conn.ExecContext(context.Background(), advisoryUnlockQuery, l.key)
-		conn.Close()
-		log.Tag(tagLeader).Debug("Released leader lock (lock key %d)", l.key)
-	}
-}

db/pg/leader_internal_test.go

@@ -1,41 +0,0 @@
-package pg
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-// The lease logic is pure time arithmetic, so it is unit-tested here without a database; the
-// external leader tests cover the loop end to end.
-
-func TestLeader_Lease_HoldoffMeansNoLeaderRatherThanTwo(t *testing.T) {
-	// Freshly acquired lock: belief must wait out the hold-off
-	l := &Leader{renewInterval: 20 * time.Second} // Lease duration 1m, hold-off 2m
-	l.acquiredAt = time.Now()
-	l.renewedAt = l.acquiredAt
-	require.False(t, l.IsLeader())
-	// Once the hold-off has passed (and verification is fresh), belief begins
-	l.acquiredAt = time.Now().Add(-3 * time.Minute)
-	l.renewedAt = time.Now()
-	require.True(t, l.IsLeader())
-}
-
-func TestLeader_Lease_ExpiredLeaseRevokesLeadership(t *testing.T) {
-	// A leader that cannot renew its lease (wedged process, long GC pause) must stop
-	// believing once the lease expires, even though the lock may still be held
-	l := &Leader{renewInterval: 20 * time.Second} // Lease duration 1m, hold-off 2m
-	l.acquiredAt = time.Now().Add(-time.Hour)
-	l.renewedAt = time.Now().Add(-2 * time.Minute) // Lease expired
-	require.False(t, l.IsLeader())
-	l.renewedAt = time.Now() // Fresh renewal restores belief
-	require.True(t, l.IsLeader())
-}
-
-func TestLeader_Lease_ReleasedIsNeverLeader(t *testing.T) {
-	// release() zeroes renewedAt, which fails the lease check no matter how old the tenure
-	l := &Leader{renewInterval: 20 * time.Second} // Lease duration 1m, hold-off 2m
-	l.acquiredAt = time.Now().Add(-time.Hour)
-	require.False(t, l.IsLeader())
-}

db/pg/leader_test.go

@@ -1,90 +0,0 @@
-package pg_test
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/db/pg"
-	dbtest "heckel.io/ntfy/v2/db/test"
-)
-
-const testRenewInterval = 20 * time.Millisecond // Lease duration 60ms, hold-off 120ms
-
-func TestLeader_AcquireAndFailover(t *testing.T) {
-	testDB := dbtest.CreateTestPostgres(t) // skips if NTFY_TEST_DATABASE_URL is unset
-	const key = int64(42)
-	l1 := pg.NewLeader(testDB.Primary(), key, testRenewInterval)
-	defer l1.Close()
-	// Belief follows the hold-off, it is never instant
-	require.False(t, l1.IsLeader())
-	waitForLeader(t, l1)
-	// A competitor never becomes leader while the leader lives
-	l2 := pg.NewLeader(testDB.Primary(), key, testRenewInterval)
-	defer l2.Close()
-	time.Sleep(300 * time.Millisecond) // Several verification rounds
-	require.False(t, l2.IsLeader())
-	require.True(t, l1.IsLeader())
-	// Close -> the follower takes over
-	l1.Close()
-	require.False(t, l1.IsLeader())
-	waitForLeader(t, l2)
-	require.False(t, l1.IsLeader())
-}
-
-func TestLeader_ConnectionLossFailover(t *testing.T) {
-	// A crashed leader must not wedge the cluster: Postgres releases the session-scoped lock
-	// when the pinned connection dies (simulated by terminating the backend), and someone
-	// re-acquires. Either node may win; the invariant is one leader eventually, never two.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	hostA, err := pg.Open(schemaDSN)
-	require.Nil(t, err)
-	defer hostA.DB.Close()
-	hostB, err := pg.Open(schemaDSN)
-	require.Nil(t, err)
-	defer hostB.DB.Close()
-	const key = int64(43)
-	l1 := pg.NewLeader(hostA.DB, key, testRenewInterval)
-	defer l1.Close()
-	waitForLeader(t, l1)
-	l2 := pg.NewLeader(hostB.DB, key, testRenewInterval)
-	defer l2.Close()
-	// Kill the backend holding the lock (advisory lock keys map to classid/objid)
-	_, err = hostB.DB.Exec(`SELECT pg_terminate_backend(pid) FROM pg_locks WHERE locktype = 'advisory' AND objid = $1 AND granted`, key)
-	require.Nil(t, err)
-	// Eventually exactly one leader again, and never two along the way
-	deadline := time.Now().Add(5 * time.Second)
-	for time.Now().Before(deadline) {
-		leader1, leader2 := l1.IsLeader(), l2.IsLeader()
-		require.False(t, leader1 && leader2, "two leaders at once")
-		if leader1 != leader2 {
-			return
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-	t.Fatal("no leader re-emerged after connection loss")
-}
-
-func TestLeader_DistinctKeysAreIndependent(t *testing.T) {
-	testDB := dbtest.CreateTestPostgres(t)
-	l1 := pg.NewLeader(testDB.Primary(), 1, testRenewInterval)
-	defer l1.Close()
-	l2 := pg.NewLeader(testDB.Primary(), 2, testRenewInterval)
-	defer l2.Close()
-	// Different keys do not compete: both become effective leaders
-	waitForLeader(t, l1)
-	waitForLeader(t, l2)
-}
-
-// waitForLeader waits until the node believes it is the leader, or fails the test
-func waitForLeader(t *testing.T, l *pg.Leader) {
-	t.Helper()
-	deadline := time.Now().Add(5 * time.Second)
-	for time.Now().Before(deadline) {
-		if l.IsLeader() {
-			return
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-	t.Fatal("node never became effective leader")
-}

db/pg/pg.go

@@ -1,127 +0,0 @@
-package pg
-
-import (
-	"database/sql"
-	"fmt"
-	"net/url"
-	"strconv"
-	"strings"
-	"time"
-
-	_ "github.com/jackc/pgx/v5/stdlib" // PostgreSQL driver
-
-	"heckel.io/ntfy/v2/db"
-)
-
-// Advisory lock keys. PostgreSQL advisory locks share one database-wide key space, so every
-// ntfy key is defined here, following the "ntfy"+2586+letter scheme
-const (
-	SchemaLockKey = int64(0x6e7466792586a) // Schema setup serialization (transaction-scoped, see db/schema)
-	LeaderLockKey = int64(0x6e7466792586b) // Cluster singleton-job leader (session-scoped, held for process lifetime)
-)
-
-// Open opens a PostgreSQL connection pool for a primary database. It pings the database
-// to verify connectivity before returning.
-func Open(dsn string) (*db.Host, error) {
-	d, err := open(dsn)
-	if err != nil {
-		return nil, fmt.Errorf("failed to open database: %w", err)
-	}
-	if err := d.DB.Ping(); err != nil {
-		return nil, fmt.Errorf("database ping failed on %v: %w", d.Addr, err)
-	}
-	return d, nil
-}
-
-// OpenReplica opens a PostgreSQL connection pool for a read replica. Unlike Open, it does
-// not ping the database, since replicas are health-checked in the background by db.DB.
-func OpenReplica(dsn string) (*db.Host, error) {
-	return open(dsn)
-}
-
-// open opens a PostgreSQL database connection pool from a DSN string. It supports custom
-// query parameters for pool configuration: pool_max_conns (default 10), pool_max_idle_conns,
-// pool_conn_max_lifetime, and pool_conn_max_idle_time. These parameters are stripped from
-// the DSN before passing it to the driver.
-func open(dsn string) (*db.Host, error) {
-	u, err := url.Parse(dsn)
-	if err != nil {
-		return nil, fmt.Errorf("invalid database URL: %w", err)
-	}
-	switch u.Scheme {
-	case "postgres", "postgresql":
-		// OK
-	default:
-		return nil, fmt.Errorf("invalid database URL scheme %q, must be \"postgres\" or \"postgresql\" (URL: %s)", u.Scheme, censorPassword(u))
-	}
-	q := u.Query()
-	maxOpenConns, err := extractIntParam(q, "pool_max_conns", 10)
-	if err != nil {
-		return nil, err
-	}
-	maxIdleConns, err := extractIntParam(q, "pool_max_idle_conns", 0)
-	if err != nil {
-		return nil, err
-	}
-	connMaxLifetime, err := extractDurationParam(q, "pool_conn_max_lifetime", 0)
-	if err != nil {
-		return nil, err
-	}
-	connMaxIdleTime, err := extractDurationParam(q, "pool_conn_max_idle_time", 0)
-	if err != nil {
-		return nil, err
-	}
-	u.RawQuery = q.Encode()
-	d, err := sql.Open("pgx", u.String())
-	if err != nil {
-		return nil, err
-	}
-	d.SetMaxOpenConns(maxOpenConns)
-	if maxIdleConns > 0 {
-		d.SetMaxIdleConns(maxIdleConns)
-	}
-	if connMaxLifetime > 0 {
-		d.SetConnMaxLifetime(connMaxLifetime)
-	}
-	if connMaxIdleTime > 0 {
-		d.SetConnMaxIdleTime(connMaxIdleTime)
-	}
-	return &db.Host{
-		Addr: u.Host,
-		DB:   d,
-	}, nil
-}
-
-func extractIntParam(q url.Values, key string, defaultValue int) (int, error) {
-	s := q.Get(key)
-	if s == "" {
-		return defaultValue, nil
-	}
-	q.Del(key)
-	v, err := strconv.Atoi(s)
-	if err != nil {
-		return 0, fmt.Errorf("invalid %s value %q: %w", key, s, err)
-	}
-	return v, nil
-}
-
-// censorPassword returns a string representation of the URL with the password replaced by "*****".
-func censorPassword(u *url.URL) string {
-	if password, hasPassword := u.User.Password(); hasPassword {
-		return strings.Replace(u.String(), ":"+password+"@", ":*****@", 1)
-	}
-	return u.String()
-}
-
-func extractDurationParam(q url.Values, key string, defaultValue time.Duration) (time.Duration, error) {
-	s := q.Get(key)
-	if s == "" {
-		return defaultValue, nil
-	}
-	q.Del(key)
-	d, err := time.ParseDuration(s)
-	if err != nil {
-		return 0, fmt.Errorf("invalid %s value %q: %w", key, s, err)
-	}
-	return d, nil
-}

db/pg/pg_test.go

@@ -1,53 +0,0 @@
-package pg
-
-import (
-	"net/url"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestOpen_InvalidScheme(t *testing.T) {
-	_, err := Open("postgresql+psycopg2://user:pass@localhost/db")
-	require.Error(t, err)
-	require.Contains(t, err.Error(), `invalid database URL scheme "postgresql+psycopg2"`)
-	require.Contains(t, err.Error(), "*****")
-	require.NotContains(t, err.Error(), "pass")
-}
-
-func TestOpen_InvalidURL(t *testing.T) {
-	_, err := Open("not a valid url\x00")
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "invalid database URL")
-}
-
-func TestCensorPassword(t *testing.T) {
-	tests := []struct {
-		name     string
-		url      string
-		expected string
-	}{
-		{
-			name:     "with password",
-			url:      "postgres://user:secret@localhost/db",
-			expected: "postgres://user:*****@localhost/db",
-		},
-		{
-			name:     "without password",
-			url:      "postgres://localhost/db",
-			expected: "postgres://localhost/db",
-		},
-		{
-			name:     "user only",
-			url:      "postgres://user@localhost/db",
-			expected: "postgres://user@localhost/db",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			u, err := url.Parse(tt.url)
-			require.NoError(t, err)
-			require.Equal(t, tt.expected, censorPassword(u))
-		})
-	}
-}

db/schema/schema.go

@@ -1,111 +0,0 @@
-// Package schema tracks and migrates database schemas, and Migrate creates or upgrades a
-// store's schema inside a single transaction. On PostgreSQL, all stores share one database, so
-// versions live in a shared schema_version table keyed by store name. On SQLite, every store is
-// its own database file, so the version lives in the schemaVersion table keyed by id = 1.
-package schema
-
-import (
-	"database/sql"
-	"errors"
-	"fmt"
-
-	"heckel.io/ntfy/v2/db/pg"
-	"heckel.io/ntfy/v2/log"
-)
-
-const (
-	tag = "schema"
-)
-
-const (
-	sqliteCreateVersionTableQuery = `CREATE TABLE IF NOT EXISTS schemaVersion (id INT PRIMARY KEY, version INT NOT NULL)`
-	sqliteSelectVersionQuery      = `SELECT version FROM schemaVersion WHERE id = 1`
-	sqliteUpsertVersionQuery      = `INSERT INTO schemaVersion (id, version) VALUES (1, ?) ON CONFLICT (id) DO UPDATE SET version = excluded.version`
-
-	postgresCreateVersionTableQuery = `CREATE TABLE IF NOT EXISTS schema_version (store TEXT PRIMARY KEY, version INT NOT NULL)`
-	postgresSelectVersionQuery      = `SELECT version FROM schema_version WHERE store = $1`
-	postgresUpsertVersionQuery      = `INSERT INTO schema_version (store, version) VALUES ($1, $2) ON CONFLICT (store) DO UPDATE SET version = EXCLUDED.version`
-	postgresAdvisoryLockQuery       = `SELECT pg_advisory_xact_lock($1)` // Transaction-scoped lock to avoid migration races
-)
-
-// Migrate creates or upgrades the named store's schema to targetVersion in one transaction, or
-// creates a new database using the "create" function.
-func Migrate(db *sql.DB, dialect Dialect, store string, targetVersion int, create MigrateFunc, migrations map[int]MigrateFunc) error {
-	if dialect != Postgres && dialect != SQLite {
-		return fmt.Errorf("unsupported schema dialect %d", dialect)
-	}
-	tx, err := db.Begin()
-	if err != nil {
-		return fmt.Errorf("cannot begin %s schema transaction: %w", store, err)
-	}
-	defer tx.Rollback()
-	if dialect == Postgres {
-		// Serialize setup across nodes: CREATE TABLE IF NOT EXISTS is not atomic, and
-		// concurrently cold-booting nodes would otherwise race on DDL and crash
-		if _, err := tx.Exec(postgresAdvisoryLockQuery, pg.SchemaLockKey); err != nil {
-			return fmt.Errorf("cannot acquire %s schema advisory lock: %w", store, err)
-		}
-	}
-	if _, err := tx.Exec(createVersionTableQuery(dialect)); err != nil {
-		return fmt.Errorf("cannot create schema version table: %w", err)
-	}
-	version, err := readVersion(tx, dialect, store)
-	if errors.Is(err, sql.ErrNoRows) {
-		// Fresh database: create the store's tables at the target version
-		if err := create(tx); err != nil {
-			return fmt.Errorf("cannot create %s schema: %w", store, err)
-		}
-		if err := writeVersion(tx, dialect, store, targetVersion); err != nil {
-			return fmt.Errorf("cannot write %s schema version: %w", store, err)
-		}
-		return tx.Commit()
-	} else if err != nil {
-		return fmt.Errorf("cannot read %s schema version: %w", store, err)
-	}
-	if version == targetVersion {
-		return tx.Commit()
-	}
-	if version > targetVersion {
-		return fmt.Errorf("unexpected %s schema version %d, this version of ntfy supports up to %d", store, version, targetVersion)
-	}
-	for v := version; v < targetVersion; v++ {
-		migrate, ok := migrations[v]
-		if !ok {
-			return fmt.Errorf("cannot find %s migration step from version %d to %d", store, v, v+1)
-		}
-		log.Tag(tag).Info("Migrating %s database schema: from %d to %d", store, v, v+1)
-		if err := migrate(tx); err != nil {
-			return fmt.Errorf("%s migration step from version %d to %d failed: %w", store, v, v+1, err)
-		}
-	}
-	if err := writeVersion(tx, dialect, store, targetVersion); err != nil {
-		return fmt.Errorf("cannot write %s schema version: %w", store, err)
-	}
-	return tx.Commit()
-}
-
-func createVersionTableQuery(dialect Dialect) string {
-	if dialect == Postgres {
-		return postgresCreateVersionTableQuery
-	}
-	return sqliteCreateVersionTableQuery
-}
-
-func readVersion(tx *sql.Tx, dialect Dialect, store string) (version int, err error) {
-	if dialect == Postgres {
-		err = tx.QueryRow(postgresSelectVersionQuery, store).Scan(&version)
-	} else {
-		err = tx.QueryRow(sqliteSelectVersionQuery).Scan(&version)
-	}
-	return
-}
-
-func writeVersion(tx *sql.Tx, dialect Dialect, store string, version int) error {
-	var err error
-	if dialect == Postgres {
-		_, err = tx.Exec(postgresUpsertVersionQuery, store, version)
-	} else {
-		_, err = tx.Exec(sqliteUpsertVersionQuery, version)
-	}
-	return err
-}

db/schema/schema_test.go

@@ -1,192 +0,0 @@
-package schema_test
-
-import (
-	"database/sql"
-	"fmt"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/db/pg"
-	"heckel.io/ntfy/v2/db/schema"
-	dbtest "heckel.io/ntfy/v2/db/test"
-
-	_ "github.com/mattn/go-sqlite3"
-)
-
-const (
-	testCreateQuery = `CREATE TABLE IF NOT EXISTS things (id TEXT PRIMARY KEY, name TEXT NOT NULL)`
-)
-
-func testCreate(tx *sql.Tx) error {
-	_, err := tx.Exec(testCreateQuery)
-	return err
-}
-
-func openTestPostgres(t *testing.T) *sql.DB {
-	t.Helper()
-	host, err := pg.Open(dbtest.CreateTestPostgresSchema(t))
-	require.Nil(t, err)
-	t.Cleanup(func() { host.DB.Close() })
-	return host.DB
-}
-
-func openTestSQLite(t *testing.T) *sql.DB {
-	t.Helper()
-	d, err := sql.Open("sqlite3", filepath.Join(t.TempDir(), "test.db"))
-	require.Nil(t, err)
-	t.Cleanup(func() { d.Close() })
-	return d
-}
-
-func forEachDialect(t *testing.T, f func(t *testing.T, d *sql.DB, dialect schema.Dialect)) {
-	t.Run("postgres", func(t *testing.T) {
-		f(t, openTestPostgres(t), schema.Postgres)
-	})
-	t.Run("sqlite", func(t *testing.T) {
-		f(t, openTestSQLite(t), schema.SQLite)
-	})
-}
-
-func TestMigrate_FreshCreate(t *testing.T) {
-	forEachDialect(t, func(t *testing.T, d *sql.DB, dialect schema.Dialect) {
-		// A fresh database jumps straight to the target version; migration steps are not consulted
-		require.Nil(t, schema.Migrate(d, dialect, "things", 3, testCreate, nil))
-		_, err := d.Exec(`INSERT INTO things (id, name) VALUES ('a', 'thing a')`)
-		require.Nil(t, err)
-		require.Equal(t, 3, storeVersion(t, d, dialect, "things"))
-		// Idempotent: a second node boots against the migrated schema
-		require.Nil(t, schema.Migrate(d, dialect, "things", 3, testCreate, nil))
-	})
-}
-
-func TestMigrate_AppliesMigrationSteps(t *testing.T) {
-	forEachDialect(t, func(t *testing.T, d *sql.DB, dialect schema.Dialect) {
-		require.Nil(t, schema.Migrate(d, dialect, "things", 1, testCreate, nil))
-		// A newer version of the code migrates 1 -> 3 step by step, in order
-		migrations := map[int]schema.MigrateFunc{
-			1: func(tx *sql.Tx) error {
-				_, err := tx.Exec(`ALTER TABLE things ADD COLUMN color TEXT NOT NULL DEFAULT ''`)
-				return err
-			},
-			2: func(tx *sql.Tx) error {
-				_, err := tx.Exec(`ALTER TABLE things ADD COLUMN size INT NOT NULL DEFAULT 0`)
-				return err
-			},
-		}
-		require.Nil(t, schema.Migrate(d, dialect, "things", 3, testCreate, migrations))
-		_, err := d.Exec(`INSERT INTO things (id, name, color, size) VALUES ('b', 'thing b', 'red', 2)`)
-		require.Nil(t, err)
-		require.Equal(t, 3, storeVersion(t, d, dialect, "things"))
-	})
-}
-
-func TestMigrate_ClosureCarriesConfig(t *testing.T) {
-	// Migrations needing config take it via closure at map-construction time; there is no
-	// params plumbing in the framework itself
-	migrationsFor := func(defaultName string) map[int]schema.MigrateFunc {
-		return map[int]schema.MigrateFunc{
-			1: schema.AsMigrateFunc(fmt.Sprintf(`ALTER TABLE things ADD COLUMN nick TEXT NOT NULL DEFAULT '%s'`, defaultName)),
-		}
-	}
-	forEachDialect(t, func(t *testing.T, d *sql.DB, dialect schema.Dialect) {
-		require.Nil(t, schema.Migrate(d, dialect, "things", 1, testCreate, nil))
-		_, err := d.Exec(`INSERT INTO things (id, name) VALUES ('a', 'thing a')`)
-		require.Nil(t, err)
-		require.Nil(t, schema.Migrate(d, dialect, "things", 2, testCreate, migrationsFor("configured-default")))
-		var nick string
-		require.Nil(t, d.QueryRow(`SELECT nick FROM things WHERE id = 'a'`).Scan(&nick))
-		require.Equal(t, "configured-default", nick)
-	})
-}
-
-func TestMigrate_InvalidDialect(t *testing.T) {
-	d := openTestSQLite(t)
-	err := schema.Migrate(d, schema.Dialect(99), "things", 1, testCreate, nil)
-	require.Error(t, err)
-}
-
-func TestMigrate_RefusesFutureVersion(t *testing.T) {
-	forEachDialect(t, func(t *testing.T, d *sql.DB, dialect schema.Dialect) {
-		require.Nil(t, schema.Migrate(d, dialect, "things", 2, testCreate, map[int]schema.MigrateFunc{}))
-		err := schema.Migrate(d, dialect, "things", 1, testCreate, nil)
-		require.Error(t, err)
-	})
-}
-
-func TestMigrate_MissingStepFails(t *testing.T) {
-	forEachDialect(t, func(t *testing.T, d *sql.DB, dialect schema.Dialect) {
-		require.Nil(t, schema.Migrate(d, dialect, "things", 1, testCreate, nil))
-		err := schema.Migrate(d, dialect, "things", 3, testCreate, nil) // No step 1 -> 2 registered
-		require.Error(t, err)
-	})
-}
-
-func TestMigrate_StoresAreIndependent(t *testing.T) {
-	// Postgres only: stores share one database, tracked as rows in schema_version. On SQLite
-	// every store has its own database file, so independence is by file.
-	d := openTestPostgres(t)
-	require.Nil(t, schema.Migrate(d, schema.Postgres, "things", 1, testCreate, nil))
-	require.Nil(t, schema.Migrate(d, schema.Postgres, "gadgets", 4, func(tx *sql.Tx) error {
-		_, err := tx.Exec(`CREATE TABLE IF NOT EXISTS gadgets (id TEXT PRIMARY KEY)`)
-		return err
-	}, nil))
-	require.Equal(t, 1, storeVersion(t, d, schema.Postgres, "things"))
-	require.Equal(t, 4, storeVersion(t, d, schema.Postgres, "gadgets"))
-}
-
-func TestMigrate_SQLiteReadsExistingSchemaVersionTable(t *testing.T) {
-	// Existing ntfy SQLite databases (message, user, webpush) track their version in a
-	// schemaVersion (id, version) table keyed by id = 1; the framework uses that table as-is
-	// on SQLite, so existing databases migrate without any adoption step
-	d := openTestSQLite(t)
-	_, err := d.Exec(testCreateQuery)
-	require.Nil(t, err)
-	_, err = d.Exec(`CREATE TABLE schemaVersion (id INT PRIMARY KEY, version INT NOT NULL)`)
-	require.Nil(t, err)
-	_, err = d.Exec(`INSERT INTO schemaVersion VALUES (1, 1)`)
-	require.Nil(t, err)
-	migrations := map[int]schema.MigrateFunc{
-		1: func(tx *sql.Tx) error {
-			_, err := tx.Exec(`ALTER TABLE things ADD COLUMN color TEXT NOT NULL DEFAULT ''`)
-			return err
-		},
-	}
-	require.Nil(t, schema.Migrate(d, schema.SQLite, "things", 2, testCreate, migrations))
-	_, err = d.Exec(`INSERT INTO things (id, name, color) VALUES ('a', 'thing a', 'red')`)
-	require.Nil(t, err)
-	require.Equal(t, 2, storeVersion(t, d, schema.SQLite, "things"))
-}
-
-func TestMigrate_ConcurrentFreshCreate(t *testing.T) {
-	// Postgres only: concurrent cold-boots must not race on DDL (CREATE TABLE IF NOT EXISTS is
-	// not atomic); Migrate serializes via an advisory lock. SQLite has a single writer.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	const n = 8
-	errs := make(chan error, n)
-	for i := 0; i < n; i++ {
-		go func() {
-			host, err := pg.Open(schemaDSN)
-			if err != nil {
-				errs <- err
-				return
-			}
-			defer host.DB.Close()
-			errs <- schema.Migrate(host.DB, schema.Postgres, "things", 1, testCreate, nil)
-		}()
-	}
-	for i := 0; i < n; i++ {
-		require.Nil(t, <-errs)
-	}
-}
-
-func storeVersion(t *testing.T, d *sql.DB, dialect schema.Dialect, store string) int {
-	t.Helper()
-	var version int
-	if dialect == schema.Postgres {
-		require.Nil(t, d.QueryRow(`SELECT version FROM schema_version WHERE store = $1`, store).Scan(&version), fmt.Sprintf("store %s", store))
-	} else {
-		require.Nil(t, d.QueryRow(`SELECT version FROM schemaVersion WHERE id = 1`).Scan(&version), fmt.Sprintf("store %s", store))
-	}
-	return version
-}

db/schema/types.go

@@ -1,31 +0,0 @@
-package schema
-
-import "database/sql"
-
-// Dialect selects the SQL flavor Migrate speaks to the version table.
-type Dialect int
-
-// Supported dialects; SQLite is the zero value
-const (
-	SQLite Dialect = iota
-	Postgres
-)
-
-// MigrateFunc applies one schema change inside the setup transaction: the initial creation of
-// a store's tables, or one step upgrading a store from version N to N+1. Migrations needing
-// config capture it via closure, e.g. func migrations(cacheDuration time.Duration) map[int]MigrateFunc.
-type MigrateFunc func(tx *sql.Tx) error
-
-// AsMigrateFunc converts a simple query to a migration function
-func AsMigrateFunc(query string) MigrateFunc {
-	return func(tx *sql.Tx) error {
-		_, err := tx.Exec(query)
-		return err
-	}
-}
-
-// NopMigrateFunc is a migration step that does nothing, for versions where a dialect has no
-// work to do (e.g. when only the other dialect's schema changed).
-func NopMigrateFunc(_ *sql.Tx) error {
-	return nil
-}

db/test/schema.go

@@ -1,185 +0,0 @@
-package dbtest
-
-import (
-	"database/sql"
-	"fmt"
-	"sort"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// Querier is the subset of *sql.DB / *db.DB needed to introspect a schema.
-type Querier interface {
-	Query(query string, args ...any) (*sql.Rows, error)
-}
-
-// SQLiteSchema returns a normalized, comparable description of the database schema: tables
-// with their columns, named indexes, and foreign keys. Column order, declared type spelling
-// (INT vs INTEGER) and default values are not part of the description, so the schema produced
-// by a migration chain can be compared to a freshly created one.
-func SQLiteSchema(t testing.TB, d Querier) string {
-	t.Helper()
-	lines := make([]string, 0)
-	for _, table := range sqliteTables(t, d) {
-		lines = append(lines, "table "+table)
-		lines = append(lines, sqliteColumns(t, d, table)...)
-		lines = append(lines, sqliteForeignKeys(t, d, table)...)
-		lines = append(lines, sqliteIndexes(t, d, table)...)
-	}
-	return strings.Join(lines, "\n")
-}
-
-// PostgresSchema is SQLiteSchema's PostgreSQL counterpart, describing the current schema's
-// tables, columns, constraints and indexes in a normalized, comparable way.
-func PostgresSchema(t testing.TB, d Querier) string {
-	t.Helper()
-	lines := make([]string, 0)
-	for _, table := range postgresTables(t, d) {
-		lines = append(lines, "table "+table)
-		lines = append(lines, postgresColumns(t, d, table)...)
-	}
-	lines = append(lines, postgresConstraints(t, d)...)
-	lines = append(lines, postgresIndexes(t, d)...)
-	return strings.Join(lines, "\n")
-}
-
-func sqliteTables(t testing.TB, d Querier) []string {
-	t.Helper()
-	return queryStrings(t, d, `SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name`)
-}
-
-func sqliteColumns(t testing.TB, d Querier, table string) []string {
-	t.Helper()
-	rows, err := d.Query(fmt.Sprintf(`PRAGMA table_info(%q)`, table))
-	require.Nil(t, err)
-	defer rows.Close()
-	lines := make([]string, 0)
-	for rows.Next() {
-		var cid, notNull, pk int
-		var name, typ string
-		var dflt sql.NullString
-		require.Nil(t, rows.Scan(&cid, &name, &typ, &notNull, &dflt, &pk))
-		typ = strings.ToUpper(typ)
-		if typ == "INT" { // INT and INTEGER are the same affinity; migrations spell them inconsistently
-			typ = "INTEGER"
-		}
-		lines = append(lines, fmt.Sprintf("  col %s %s notnull=%d pk=%d", name, typ, notNull, pk))
-	}
-	require.Nil(t, rows.Err())
-	sort.Strings(lines)
-	return lines
-}
-
-func sqliteForeignKeys(t testing.TB, d Querier, table string) []string {
-	t.Helper()
-	rows, err := d.Query(fmt.Sprintf(`PRAGMA foreign_key_list(%q)`, table))
-	require.Nil(t, err)
-	defer rows.Close()
-	lines := make([]string, 0)
-	for rows.Next() {
-		var id, seq int
-		var refTable, from, onUpdate, onDelete, match string
-		var to sql.NullString // NULL when referencing the parent's primary key implicitly
-		require.Nil(t, rows.Scan(&id, &seq, &refTable, &from, &to, &onUpdate, &onDelete, &match))
-		lines = append(lines, fmt.Sprintf("  fk %s -> %s(%s) on_delete=%s", from, refTable, to.String, onDelete))
-	}
-	require.Nil(t, rows.Err())
-	sort.Strings(lines)
-	return lines
-}
-
-func sqliteIndexes(t testing.TB, d Querier, table string) []string {
-	t.Helper()
-	rows, err := d.Query(fmt.Sprintf(`PRAGMA index_list(%q)`, table))
-	require.Nil(t, err)
-	type index struct {
-		name            string
-		unique, partial int
-	}
-	indexes := make([]index, 0)
-	for rows.Next() {
-		var seq, unique, partial int
-		var name, origin string
-		require.Nil(t, rows.Scan(&seq, &name, &unique, &origin, &partial))
-		// Skip auto-indexes backing PRIMARY KEY/UNIQUE table constraints; those are described
-		// by the column and constraint listings already
-		if strings.HasPrefix(name, "sqlite_autoindex_") {
-			continue
-		}
-		indexes = append(indexes, index{name, unique, partial})
-	}
-	require.Nil(t, rows.Err())
-	require.Nil(t, rows.Close())
-	lines := make([]string, 0, len(indexes))
-	for _, idx := range indexes {
-		cols := queryStrings(t, d, fmt.Sprintf(`SELECT name FROM pragma_index_info(%q) ORDER BY seqno`, idx.name))
-		lines = append(lines, fmt.Sprintf("  index %s unique=%d partial=%d cols=(%s)", idx.name, idx.unique, idx.partial, strings.Join(cols, ",")))
-	}
-	sort.Strings(lines)
-	return lines
-}
-
-func postgresTables(t testing.TB, d Querier) []string {
-	t.Helper()
-	return queryStrings(t, d, `SELECT table_name FROM information_schema.tables WHERE table_schema = current_schema() AND table_type = 'BASE TABLE' ORDER BY table_name`)
-}
-
-func postgresColumns(t testing.TB, d Querier, table string) []string {
-	t.Helper()
-	rows, err := d.Query(`SELECT column_name, data_type, is_nullable FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = $1 ORDER BY column_name`, table)
-	require.Nil(t, err)
-	defer rows.Close()
-	lines := make([]string, 0)
-	for rows.Next() {
-		var name, typ, nullable string
-		require.Nil(t, rows.Scan(&name, &typ, &nullable))
-		lines = append(lines, fmt.Sprintf("  col %s %s nullable=%s", name, typ, nullable))
-	}
-	require.Nil(t, rows.Err())
-	return lines
-}
-
-func postgresConstraints(t testing.TB, d Querier) []string {
-	t.Helper()
-	return queryStrings(t, d, `
-		SELECT 'constraint ' || conrelid::regclass::text || ': ' || pg_get_constraintdef(oid)
-		FROM pg_constraint
-		WHERE connamespace = current_schema()::regnamespace
-		ORDER BY 1
-	`)
-}
-
-func postgresIndexes(t testing.TB, d Querier) []string {
-	t.Helper()
-	rows, err := d.Query(`SELECT indexname, indexdef, schemaname FROM pg_indexes WHERE schemaname = current_schema() ORDER BY indexname`)
-	require.Nil(t, err)
-	defer rows.Close()
-	lines := make([]string, 0)
-	for rows.Next() {
-		var name, def, schema string
-		require.Nil(t, rows.Scan(&name, &def, &schema))
-		// The index definition qualifies the table with the (test-specific) schema name; strip
-		// it so snapshots from different test schemas compare equal
-		def = strings.ReplaceAll(def, schema+".", "")
-		lines = append(lines, "index "+def)
-	}
-	require.Nil(t, rows.Err())
-	return lines
-}
-
-func queryStrings(t testing.TB, d Querier, query string) []string {
-	t.Helper()
-	rows, err := d.Query(query)
-	require.Nil(t, err)
-	defer rows.Close()
-	values := make([]string, 0)
-	for rows.Next() {
-		var value string
-		require.Nil(t, rows.Scan(&value))
-		values = append(values, value)
-	}
-	require.Nil(t, rows.Err())
-	return values
-}

db/test/test.go

@@ -1,64 +0,0 @@
-package dbtest
-
-import (
-	"fmt"
-	"net/url"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/db/pg"
-	"heckel.io/ntfy/v2/util"
-)
-
-const testPoolMaxConns = "2"
-
-// CreateTestPostgresSchema creates a temporary PostgreSQL schema and returns the DSN pointing to it.
-// It registers a cleanup function to drop the schema when the test finishes.
-// If NTFY_TEST_DATABASE_URL is not set, the test is skipped.
-func CreateTestPostgresSchema(t testing.TB) string {
-	t.Helper()
-	dsn := os.Getenv("NTFY_TEST_DATABASE_URL")
-	if dsn == "" {
-		t.Skip("NTFY_TEST_DATABASE_URL not set")
-	}
-	schema := fmt.Sprintf("test_%s", util.RandomString(10))
-	u, err := url.Parse(dsn)
-	require.Nil(t, err)
-	q := u.Query()
-	q.Set("pool_max_conns", testPoolMaxConns)
-	u.RawQuery = q.Encode()
-	dsn = u.String()
-	setupHost, err := pg.Open(dsn)
-	require.Nil(t, err)
-	_, err = setupHost.DB.Exec(fmt.Sprintf("CREATE SCHEMA %s", schema))
-	require.Nil(t, err)
-	require.Nil(t, setupHost.DB.Close())
-	q.Set("search_path", schema)
-	u.RawQuery = q.Encode()
-	schemaDSN := u.String()
-	t.Cleanup(func() {
-		cleanHost, err := pg.Open(dsn)
-		if err == nil {
-			cleanHost.DB.Exec(fmt.Sprintf("DROP SCHEMA %s CASCADE", schema))
-			cleanHost.DB.Close()
-		}
-	})
-	return schemaDSN
-}
-
-// CreateTestPostgres creates a temporary PostgreSQL schema and returns an open *db.DB connection to it.
-// It registers cleanup functions to close the DB and drop the schema when the test finishes.
-// If NTFY_TEST_DATABASE_URL is not set, the test is skipped.
-func CreateTestPostgres(t testing.TB) *db.DB {
-	t.Helper()
-	schemaDSN := CreateTestPostgresSchema(t)
-	testHost, err := pg.Open(schemaDSN)
-	require.Nil(t, err)
-	d := db.New(testHost, nil)
-	t.Cleanup(func() {
-		d.Close()
-	})
-	return d
-}

db/types.go

@@ -1,25 +0,0 @@
-package db
-
-import (
-	"database/sql"
-	"sync/atomic"
-)
-
-// Beginner is an interface for types that can begin a database transaction.
-// Both *sql.DB and *DB implement this.
-type Beginner interface {
-	Begin() (*sql.Tx, error)
-}
-
-// Querier is an interface for types that can execute SQL queries.
-// *sql.DB, *sql.Tx, and *DB all implement this.
-type Querier interface {
-	Query(query string, args ...any) (*sql.Rows, error)
-}
-
-// Host pairs a *sql.DB with the host:port it was opened against.
-type Host struct {
-	Addr    string // "host:port"
-	DB      *sql.DB
-	healthy atomic.Bool
-}

db/util.go

@@ -1,36 +0,0 @@
-package db
-
-import "database/sql"
-
-// ExecTx executes a function within a database transaction. If the function returns an error,
-// the transaction is rolled back. Otherwise, the transaction is committed.
-func ExecTx(db Beginner, f func(tx *sql.Tx) error) error {
-	tx, err := db.Begin()
-	if err != nil {
-		return err
-	}
-	defer tx.Rollback()
-	if err := f(tx); err != nil {
-		return err
-	}
-	return tx.Commit()
-}
-
-// QueryTx executes a function within a database transaction and returns the result. If the function
-// returns an error, the transaction is rolled back. Otherwise, the transaction is committed.
-func QueryTx[T any](db Beginner, f func(tx *sql.Tx) (T, error)) (T, error) {
-	tx, err := db.Begin()
-	if err != nil {
-		var zero T
-		return zero, err
-	}
-	defer tx.Rollback()
-	t, err := f(tx)
-	if err != nil {
-		return t, err
-	}
-	if err := tx.Commit(); err != nil {
-		return t, err
-	}
-	return t, nil
-}

docker-compose.yml

@@ -1,3 +1,4 @@
+version: "2.1"
 services:
   ntfy:
     image: binwiederhier/ntfy
@@ -13,3 +14,4 @@ services:
     ports:
       - 80:80
     restart: unless-stopped
+

docs/contact.md

@@ -1,51 +0,0 @@
-# Contact
-
-This service is run by [Philipp C. Heckel](https://heckel.io). There are several ways to get in touch with me and the 
-ntfy community. Please choose the appropriate channel based on your needs.
-
-## Support
-
-### Community support
-
-For general questions, feature discussions, and community help, please use one of these public channels:
-
-| Channel           | Link                                                                                 | Description                                                |
-|-------------------|--------------------------------------------------------------------------------------|------------------------------------------------------------|
-| **Discord**       | [discord.gg/cT7ECsZj9w](https://discord.gg/cT7ECsZj9w)                               | Real-time chat with the community (I'm `binwiederhier`)    |
-| **Matrix**        | [#ntfy:matrix.org](https://matrix.to/#/#ntfy:matrix.org)                             | Bridged from Discord, same community (I'm `binwiederhier`) |
-| **Matrix Space**  | [#ntfy-space:matrix.org](https://matrix.to/#/#ntfy-space:matrix.org)                 | Matrix space with all ntfy rooms                           |
-| **GitHub Issues** | [github.com/binwiederhier/ntfy/issues](https://github.com/binwiederhier/ntfy/issues) | Bug reports and feature requests                           |
-
-!!! info "Why public channels?"
-    Answering questions in public channels benefits the entire community. Other users can learn from the 
-    discussion, and answers can be referenced later. This is much more scalable than 1-on-1 support.
-
-### Paid support
-
-If you are subscribed to a [ntfy Pro](https://ntfy.sh/#pricing) plan, you are entitled to priority support 
-via the following channels:
-
-| Channel               | Contact                                             | Description                              |
-|-----------------------|-----------------------------------------------------|------------------------------------------|
-| **General Support**   | [support@mail.ntfy.sh](mailto:support@mail.ntfy.sh) | Direct email support for Pro subscribers |
-| **Billing Inquiries** | [billing@mail.ntfy.sh](mailto:billing@mail.ntfy.sh) | Inquire about billing issues             |
-| **Discord/Matrix**    | Mention your Pro status                             | Priority responses in community channels |
-
-Please include your ntfy.sh username when contacting support so we can verify your subscription status.
-
-## Security issues
-
-If you discover a security vulnerability, please report it responsibly via [security@mail.ntfy.sh](mailto:security@mail.ntfy.sh). See also: [SECURITY.md](https://github.com/binwiederhier/ntfy/blob/main/SECURITY.md).
-
-## Abuse reports
-
-To report spam, phishing, or other abuse of ntfy.sh, please email [abuse@mail.ntfy.sh](mailto:abuse@mail.ntfy.sh).
-Please include the topic name and any relevant message details so we can investigate.
-
-## Other inquiries
-
-For questions about our [privacy policy](privacy.md), data handling, or to exercise your data rights 
-(access, deletion, etc.), please email [privacy@mail.ntfy.sh](mailto:privacy@mail.ntfy.sh).
-
-For business inquiries, partnerships, press, or other general questions that don't fit the categories above, please
-use [contact@mail.ntfy.sh](mailto:contact@mail.ntfy.sh).

docs/contributing.md

@@ -1,43 +0,0 @@
-# Contributing
-
-Thank you for your interest in contributing to ntfy! There are many ways to help, whether you're a developer,
-translator, or just an enthusiastic user.
-
-## Code contributions
-
-If you'd like to contribute code to ntfy:
-
-1. Check out the [development guide](develop.md) to set up your environment
-2. Look at [open issues](https://github.com/binwiederhier/ntfy/issues) for ideas, or propose your own
-3. For larger features or architectural changes, please reach out on [Discord/Matrix](contact.md) first to discuss 
-   before investing significant time
-4. Submit a pull request on GitHub
-
-All contributions are welcome, from small bug fixes to major features.
-
-## Translations
-
-Help make ntfy accessible to users around the world! We use Hosted Weblate for translations:
-
-- **Weblate**: [hosted.weblate.org/projects/ntfy](https://hosted.weblate.org/projects/ntfy/)
-
-You can start translating immediately without any coding knowledge.
-
-## Documentation
-
-Found a typo? Want to improve the docs? Documentation contributions are very welcome:
-
-- Edit any page directly on GitHub using the edit button
-- Submit a pull request with your improvements
-
-## Bug reports and feature requests
-
-- **GitHub Issues**: [github.com/binwiederhier/ntfy/issues](https://github.com/binwiederhier/ntfy/issues)
-
-Please search existing issues before creating a new one to avoid duplicates.
-
-## Code of Conduct
-
-Please be respectful and constructive in all interactions. See the 
-[Code of Conduct](https://github.com/binwiederhier/ntfy/blob/main/CODE_OF_CONDUCT.md) for details.
-

docs/deprecations.md

@@ -1,4 +1,4 @@
-# Deprecations and breaking changes
+# Deprecation notices
 This page is used to list deprecation notices for ntfy. Deprecated commands and options will be 
 **removed after 1-3 months** from the time they were deprecated. How long the feature is deprecated
 before the behavior is changed depends on the severity of the change, and how prominent the feature is.

docs/develop.md

@@ -2,7 +2,7 @@
 Hurray 🥳 🎉, you are interested in writing code for ntfy! **That's awesome.** 😎
 
 I tried my very best to write up detailed instructions, but if at any point in time you run into issues, don't 
-hesitate to reach out via one of the channels listed on the [contact page](contact.md).
+hesitate to **contact me on [Discord](https://discord.gg/cT7ECsZj9w) or [Matrix](https://matrix.to/#/#ntfy:matrix.org)**.
 
 ## ntfy server
 The ntfy server source code is available [on GitHub](https://github.com/binwiederhier/ntfy). The codebase for the
@@ -65,8 +65,8 @@ These steps **assume Ubuntu**. Steps may vary on different Linux distributions.
 
 First, install [Go](https://go.dev/) (see [official instructions](https://go.dev/doc/install)):
 ``` shell
-wget https://go.dev/dl/go1.25.8.linux-amd64.tar.gz
-sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.25.8.linux-amd64.tar.gz
+wget https://go.dev/dl/go1.19.1.linux-amd64.tar.gz
+sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.19.1.linux-amd64.tar.gz
 export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin
 go version   # verifies that it worked
 ```
@@ -77,11 +77,9 @@ go install github.com/goreleaser/goreleaser@latest
 goreleaser -v   # verifies that it worked
 ```
 
-Install [nodejs](https://nodejs.org/en/) (see [official instructions](https://nodejs.org/en/download/package-manager/)).
-Use a current LTS release (Node 24 is what CI builds with; anything older than Node 20 will not work
-with the current Vite-based web build):
+Install [nodejs](https://nodejs.org/en/) (see [official instructions](https://nodejs.org/en/download/package-manager/)):
 ``` shell
-curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
+curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash -
 sudo apt-get install -y nodejs
 npm -v   # verifies that it worked
 ```
@@ -257,7 +255,6 @@ Reference: <https://stackoverflow.com/questions/34160509/options-for-testing-ser
     go run main.go \
       --log-level debug \
       serve \
-        --base-url http://localhost \
         --web-push-public-key KEY \
         --web-push-private-key KEY \
         --web-push-email-address <email> \
@@ -343,6 +340,10 @@ Then either follow the steps for building with or without Firebase.
 Without Firebase, you may want to still change the default `app_base_url` in [values.xml](https://github.com/binwiederhier/ntfy-android/blob/main/app/src/main/res/values/values.xml)
 if you're self-hosting the server. Then run:
 ```
+# Remove Google dependencies (FCM)
+sed -i -e '/google-services/d' build.gradle
+sed -i -e '/google-services/d' app/build.gradle
+
 # To build an unsigned .apk (app/build/outputs/apk/fdroid/*.apk)
 ./gradlew assembleFdroidRelease
 
@@ -350,8 +351,6 @@ if you're self-hosting the server. Then run:
 ./gradlew bundleFdroidRelease
 ```
 
-The F-Droid flavor automatically excludes Google Services dependencies.
-
 ### Build Play flavor (FCM)
 !!! info
     I do build the ntfy Android app using IntelliJ IDEA (Android Studio), so I don't know if these Gradle commands will
@@ -364,7 +363,7 @@ To build your own version with Firebase, you must:
 * And change `app_base_url` in [values.xml](https://github.com/binwiederhier/ntfy-android/blob/main/app/src/main/res/values/values.xml)
 * Then run:
 ```
-# To build an unsigned .apk (app/build/outputs/apk/play/release/*.apk)
+# To build an unsigned .apk (app/build/outputs/apk/play/*.apk)
 ./gradlew assemblePlayRelease
 
 # To build a bundle .aab (app/play/release/*.aab)
@@ -385,7 +384,7 @@ strictly based off of my development on this app. There may be other versions of
 ### Apple setup
 
 !!! info
-    Along with this step, the [PLIST Deployment](#plist-config) step is also required 
+    Along with this step, the [PLIST Deployment](#plist-deployment-and-configuration) step is also required 
     for these changes to take effect in the iOS app.
 
 1. [Create a new key in Apple Developer Member Center](https://developer.apple.com/account/resources/authkeys/add)
@@ -430,7 +429,7 @@ steps:
 
 ### XCode setup
 
-1. Follow step 4 of [Add Firebase to your Apple project](https://firebase.google.com/docs/ios/setup) to install the 
+1. Follow step 4 of [https://firebase.google.com/docs/ios/setup](Add Firebase to your Apple project) to install the 
    `firebase-ios-sdk` in XCode, if it's not already present - you can select any packages in addition to Firebase Core / Firebase Messaging
 1. Similarly, install the SQLite.swift package dependency in XCode
 1. When running the debug build, ensure XCode is pointed to the connected iOS device - registering for push notifications does not work in the iOS simulators
@@ -442,6 +441,6 @@ To have instant notifications/better notification delivery when using firebase,
 1. In XCode, find the NTFY app target. **Not** the NSE app target.
 1. Find the Asset/ folder in the project navigator
 1. Drag the `GoogleService-Info.plist` file into the Asset/ folder that you get from the firebase console. It can be 
-   found in the "Project settings" > "General" > "Your apps"  with a button labeled "GoogleService-Info.plist"
+   found in the "Project settings" > "General" > "Your apps"  with a button labled "GoogleService-Info.plist"
 
 After that, you should be all set!

docs/emojis.md

@@ -2,9 +2,9 @@
 
 <!-- This file was generated by scripts/emoji-convert.sh -->
 
-You can [tag messages](publish.md#tags-emojis) with emojis 🥳 🎉 and other relevant strings. Matching tags are automatically
+You can [tag messages](../publish/#tags-emojis) with emojis 🥳 🎉 and other relevant strings. Matching tags are automatically
 converted to emojis. This is a reference of all supported emojis. To learn more about the feature, please refer to the
-[tagging and emojis page](publish.md#tags-emojis).
+[tagging and emojis page](../publish/#tags-emojis).
 
 <table class="remove-md-box emoji-table"><tr>
 

docs/examples.md

@@ -31,12 +31,6 @@ GitHub have been hopeless. In case it ever becomes available, I want to know imm
 */6 * * * * if curl -s https://api.github.com/users/ntfy | grep "Not Found"; then curl -d "github.com/ntfy is available" -H "Tags: tada" -H "Prio: high" ntfy.sh/my-alerts; fi
 ```
 
-You can also use [`ntfy-run`](https://github.com/quantum5/ntfy-run) to send the output of your cronjob in the
-notification, so that you know exactly why it failed:
-
-```
-0 0 * * * ntfy-run -n https://ntfy.sh/backups --success-priority low --failure-tags warning ~/backup-computer
-```
 
 ## Low disk space alerts
 Here's a simple cronjob that I use to alert me when the disk space on the root disk is running low. It's simple, but 
@@ -141,21 +135,6 @@ You can send a message during a workflow run with curl. Here is an example sendi
       ${{ secrets.NTFY_URL }}
 ```
 
-## Changedetection.io
-ntfy is an excellent choice for getting notifications when a website has a change sent to your mobile (or desktop), 
-[changedetection.io](https://changedetection.io) or on GitHub ([dgtlmoon/changedetection.io](https://github.com/dgtlmoon/changedetection.io)) 
-uses [apprise](https://github.com/caronc/apprise) library for notification integrations.
-
-To add any ntfy(s) notification to a website change simply add the [ntfy style URL](https://github.com/caronc/apprise/wiki/Notify_ntfy) 
-to the notification list.
-
-For example `ntfy://{topic}` or `ntfy://{user}:{password}@{host}:{port}/{topics}`
-
-In your changedetection.io installation, click `Edit` > `Notifications` on a single website watch (or group) then add 
-the special ntfy Apprise Notification URL to the Notification List.
-
-![ntfy alerts on website change](static/img/cdio-setup.jpg)
-
 ## Watchtower (shoutrrr)
 You can use [shoutrrr](https://containrrr.dev/shoutrrr/latest/services/ntfy/) to send 
 [Watchtower](https://github.com/containrrr/watchtower/) notifications to your ntfy topic.
@@ -167,30 +146,15 @@ services:
   watchtower:
     image: containrrr/watchtower
     environment:
-      - WATCHTOWER_NOTIFICATION_SKIP_TITLE=True
+      - WATCHTOWER_NOTIFICATIONS=shoutrrr
       - WATCHTOWER_NOTIFICATION_URL=ntfy://ntfy.sh/my_watchtower_topic?title=WatchtowerUpdates
 ```
 
-The environment variable `WATCHTOWER_NOTIFICATION_SKIP_TITLE` is required to prevent Watchtower from [replacing the `title` query parameter](https://containrrr.dev/watchtower/notifications/#settings). If omitted, the provided notification title will not be used.
-
 Or, if you only want to send notifications using shoutrrr:
 ```
 shoutrrr send -u "ntfy://ntfy.sh/my_watchtower_topic?title=WatchtowerUpdates" -m "testMessage"
 ```
 
-Authentication tokens are also supported:
-
-- (Recommended) Ntfy url format (replace the domain, topic and token with your own):
-```
-ntfy://:TOKEN@DOMAIN/TOPIC
-```
-
-- Generic webhook and authorization header using this url format (replace the domain, topic and token with your own):
-
-```
-generic+https://DOMAIN/TOPIC?@authorization=Bearer+TOKEN`
-```
-
 ## Sonarr, Radarr, Lidarr, Readarr, Prowlarr, SABnzbd
 
 <!-- Sonarr v4 is in beta as of May 2023, should be updated to remove v3 reference when stable -->
@@ -619,8 +583,6 @@ This will only work on selfhosted [traccar](https://www.traccar.org/) ([Github](
 
 The easiest way to integrate traccar with ntfy, is to configure ntfy as the SMS provider for your instance. You then can set your ntfy topic as your account's phone number in traccar. Sending the email notifications to ntfy will not work, as ntfy does not support HTML emails.
 
-**Info:** Add a phone number to your traccar account not in device, as otherwise it will not try to send SMS.
-
 **Caution:** JSON publishing is only possible, when POST-ing to the root URL of the ntfy instance. (see [documentation](publish.md#publish-as-json))
 ```xml
         <entry key='sms.http.url'>https://ntfy.sh</entry>
@@ -640,84 +602,3 @@ or by simply providing traccar with a valid username/password combination.
         <entry key='sms.http.user'>phil</entry>
         <entry key='sms.http.password'>mypass</entry>
 ```
-
-## Flowtriq DDoS detection
-[Flowtriq](https://flowtriq.com) is a real-time DDoS detection and mitigation platform. Its Linux agent, ftagent,
-supports webhook alerts that can POST directly to an ntfy topic, so you get push notifications on your phone
-whenever an attack is detected.
-
-Configure the webhook URL in your ftagent configuration to point to your ntfy topic:
-
-```yaml
-# /etc/ftagent/ftagent.yml
-alerts:
-  webhooks:
-    - url: https://ntfy.sh/flowtriq-attacks
-      method: POST
-```
-
-You can also use curl to test the integration manually with a sample attack alert:
-
-```bash
-curl \
-  -H "Title: DDoS Attack Detected" \
-  -H "Priority: urgent" \
-  -H "Tags: rotating_light" \
-  -d "Attack detected on 203.0.113.5: 14.2 Gbps UDP flood from 3,482 sources" \
-  ntfy.sh/flowtriq-attacks
-```
-
-## Terminal Notifications for Long-Running Commands
-
-This example provides a simple way to send notifications using [ntfy.sh](https://ntfy.sh) when a terminal command completes. It includes success or failure indicators based on the command's exit status.
-
-Store your ntfy.sh bearer token securely if access control is enabled:
-
-   ```sh
-   echo "your_bearer_token_here" > ~/.ntfy_token
-   chmod 600 ~/.ntfy_token
-   ```
-
-Add the following function and alias to your `.bashrc` or `.bash_profile`:
-
-   ```sh
-   # Function for alert notifications using ntfy.sh
-   notify_via_ntfy() {
-       local exit_status=$?  # Capture the exit status before doing anything else
-       local token=$(< ~/.ntfy_token)  # Securely read the token
-       local status_icon="$([ $exit_status -eq 0 ] && echo magic_wand || echo warning)"
-       local last_command=$(history | tail -n1 | sed -e 's/^[[:space:]]*[0-9]\{1,\}[[:space:]]*//' -e 's/[;&|][[:space:]]*alert$//')
-       # for zsh users, use the same sed pattern but get the history differently.
-       # local last_command=$(history "$HISTCMD" | sed -e 's/^[[:space:]]*[0-9]\{1,\}[[:space:]]*//' -e 's/[;&|][[:space:]]*alert$//')
-
-       curl -s -X POST "https://n.example.dev/alerts" \
-           -H "Authorization: Bearer $token" \
-           -H "Title: Terminal" \
-           -H "X-Priority: 3" \
-           -H "Tags: $status_icon" \
-           -d "Command: $last_command (Exit: $exit_status)"
-
-       echo "Tags: $status_icon"
-       echo "$last_command (Exit: $exit_status)"
-   }
-
-   # Add an "alert" alias for long running commands using ntfy.sh
-   alias alert='notify_via_ntfy'
-   ```
-
-Now you can run any long-running command and append `alert` to notify when it completes:
-
-```sh
-sleep 10; alert
-```
-![ntfy notifications on mobile device](static/img/mobile-screenshot-notification.png)
-
-**Notification Sent** with a success 🪄 (`magic_wand`) or failure ⚠️ (`warning`) tag.
-
-To test failure notifications:
-
-```sh
-false; alert  # Always fails (exit 1)
-ls --invalid; alert  # Invalid option
-cat nonexistent_file; alert  # File not found
-```

docs/faq.md

@@ -71,35 +71,22 @@ The web app is a static website without a backend (other than the ntfy API). All
 cache and local storage. That means it does not need to be protected with a login screen, and it poses no additional 
 security risk. So technically, it does not need to be disabled.
 
-However, if you still want, you can require login with the `require-login: true` option,
-or disable it with the `web-root: disable` option in the `server.yml` file. 
+However, if you still want to disable it, you can do so with the `web-root: disable` option in the `server.yml` file. 
 
 Think of the ntfy web app like an Android/iOS app. It is freely available and accessible to anyone, yet useless without
 a proper backend. So as long as you secure your backend with ACLs, exposing the ntfy web app to the Internet is harmless.
 
-## If topic names are public, could I not just brute force them?
-If you don't have [ACLs set up](config.md#access-control), the topic name is your password, it says so everywhere. If you
-choose a easy-to-guess/dumb topic name, people will be able to guess it. If you choose a randomly generated topic name,
-the topic is as good as a good password.
-
-As for brute forcing: It's not possible to brute force a ntfy server for very long, as you'll get quickly rate limited.
-In the default configuration, you'll be able to do 60 requests as a burst, and then 1 request per 10 seconds. Assuming you
-choose a random 10 digit topic name using only A-Z, a-z, 0-9, _ and -, there are 64^10 possible topic names. Even if you
-could do hundreds of requests per seconds (which you cannot), it would take many years to brute force a topic name.
-
-For ntfy.sh, there's even a fail2ban in place which will ban your IP pretty quickly.
-
 ## Where can I donate?
 I have just very recently started accepting donations via [GitHub Sponsors](https://github.com/sponsors/binwiederhier).
 I would be humbled if you helped me carry the server and developer account costs. Even small donations are very much
 appreciated.
 
 ## Can I email you? Can I DM you on Discord/Matrix?
-For community support, please use the public channels listed on the [contact page](contact.md). I generally 
-**do not respond to direct messages** about ntfy, unless you are paying for a [ntfy Pro](https://ntfy.sh/#pricing) 
-plan (see [paid support](contact.md#paid-support)), or you are inquiring about business 
-opportunities (see [other inquiries](contact.md#other-inquiries)).
+While I love chatting on [Discord](https://discord.gg/cT7ECsZj9w), [Matrix](https://matrix.to/#/#ntfy-space:matrix.org), 
+[Lemmy](https://discuss.ntfy.sh/c/ntfy), or [GitHub](https://github.com/binwiederhier/ntfy/issues), I generally 
+**do not respond to emails about ntfy or direct messages** about ntfy, unless you are paying for a 
+[ntfy Pro](https://ntfy.sh/#pricing) plan, or you are inquiring about business opportunities. 
 
 I am sorry, but answering individual questions about ntfy on a 1-on-1 basis is not scalable. Answering your questions 
-in public forums benefits others, since I can link to the discussion at a later point in time, or other users
+in the above-mentioned forums benefits others, since I can link to the discussion at a later point in time, or other users
 may be able to help out. I hope you understand.

docs/hooks.py

@@ -1,7 +1,6 @@
 import os
 import shutil
 
-
-def on_post_build(config, **kwargs):
-    site_dir = config["site_dir"]
-    shutil.copytree("docs/static/fonts", os.path.join(site_dir, "get"))
+def copy_fonts(config, **kwargs):
+    site_dir = config['site_dir']
+    shutil.copytree('docs/static/fonts', os.path.join(site_dir, 'get'))

docs/index.md

@@ -3,11 +3,11 @@ ntfy lets you **send push notifications to your phone or desktop via scripts fro
 or POST requests. I use it to notify myself when scripts fail, or long-running commands complete.
 
 ## Step 1: Get the app
-<a href="https://play.google.com/store/apps/details?id=io.heckel.ntfy"><img width="170" src="static/img/badge-googleplay.png"></a>
-<a href="https://f-droid.org/en/packages/io.heckel.ntfy/"><img width="170" src="static/img/badge-fdroid.svg"></a>
-<a href="https://apps.apple.com/us/app/ntfy/id1625396347"><img width="150" src="static/img/badge-appstore.png"></a>
+<a href="https://play.google.com/store/apps/details?id=io.heckel.ntfy"><img src="../../static/img/badge-googleplay.png"></a>
+<a href="https://f-droid.org/en/packages/io.heckel.ntfy/"><img src="../../static/img/badge-fdroid.png"></a>
+<a href="https://apps.apple.com/us/app/ntfy/id1625396347"><img src="../../static/img/badge-appstore.png"></a>
 
-To [receive notifications on your phone](subscribe/phone.md), install the app, either via Google Play, App Store or F-Droid.
+To [receive notifications on your phone](subscribe/phone.md), install the app, either via Google Play or F-Droid.
 Once installed, open it and subscribe to a topic of your choosing. Topics don't have to explicitly be created, so just
 pick a name and use it later when you [publish a message](publish.md). Note that **topic names are public, so it's wise 
 to choose something that cannot be guessed easily.** 

docs/install.md

@@ -14,160 +14,65 @@ We support amd64, armv7 and arm64.
 
 1. Install ntfy using one of the methods described below
 2. Then (optionally) edit `/etc/ntfy/server.yml` for the server (Linux only, see [configuration](config.md) or [sample server.yml](https://github.com/binwiederhier/ntfy/blob/main/server/server.yml))
-3. Or (optionally) create/edit `~/.config/ntfy/client.yml` (for the non-root user), `~/Library/Application Support/ntfy/client.yml` (for the macOS non-root user), or `/etc/ntfy/client.yml` (for the root user), see [sample client.yml](https://github.com/binwiederhier/ntfy/blob/main/client/client.yml))
+3. Or (optionally) create/edit `~/.config/ntfy/client.yml` (for the non-root user) or `/etc/ntfy/client.yml` (for the root user), see [sample client.yml](https://github.com/binwiederhier/ntfy/blob/main/client/client.yml))
 
 To run the ntfy server, then just run `ntfy serve` (or `systemctl start ntfy` when using the deb/rpm).
 To send messages, use `ntfy publish`. To subscribe to topics, use `ntfy subscribe` (see [subscribing via CLI](subscribe/cli.md)
 for details). 
 
-If you like tutorials, check out :simple-youtube: [Kris Occhipinti's ntfy install guide](https://www.youtube.com/watch?v=bZzqrX05mNU) on YouTube, or
-[Alex's Docker-based setup guide](https://blog.alexsguardian.net/posts/2023/09/12/selfhosting-ntfy/). Both are great
-resources to get started. _I am not affiliated with Kris or Alex, I just liked their video/post._
+If you like video tutorials, check out :simple-youtube: [Kris Occhipinti's ntfy install guide](https://www.youtube.com/watch?v=bZzqrX05mNU). 
+It's short and to the point. _I am not affiliated with Kris, I just liked the video._
 
 ## Linux binaries
 Please check out the [releases page](https://github.com/binwiederhier/ntfy/releases) for binaries and
 deb/rpm packages.
 
-### Download and run
-The steps below allow you to download ntfy server and run it in a pinch. But it won't be enough to install it permanently
-as a service starting at boot time.
-
 === "x86_64/amd64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_linux_amd64.tar.gz
-    tar zxvf ntfy_2.27.0_linux_amd64.tar.gz
-    sudo cp -a ntfy_2.27.0_linux_amd64/ntfy /usr/local/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.27.0_linux_amd64/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_linux_amd64.tar.gz
+    tar zxvf ntfy_2.6.2_linux_amd64.tar.gz
+    sudo cp -a ntfy_2.6.2_linux_amd64/ntfy /usr/local/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.6.2_linux_amd64/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
 === "armv6"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_linux_armv6.tar.gz
-    tar zxvf ntfy_2.27.0_linux_armv6.tar.gz
-    sudo cp -a ntfy_2.27.0_linux_armv6/ntfy /usr/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.27.0_linux_armv6/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_linux_armv6.tar.gz
+    tar zxvf ntfy_2.6.2_linux_armv6.tar.gz
+    sudo cp -a ntfy_2.6.2_linux_armv6/ntfy /usr/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.6.2_linux_armv6/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
 === "armv7/armhf"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_linux_armv7.tar.gz
-    tar zxvf ntfy_2.27.0_linux_armv7.tar.gz
-    sudo cp -a ntfy_2.27.0_linux_armv7/ntfy /usr/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.27.0_linux_armv7/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_linux_armv7.tar.gz
+    tar zxvf ntfy_2.6.2_linux_armv7.tar.gz
+    sudo cp -a ntfy_2.6.2_linux_armv7/ntfy /usr/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.6.2_linux_armv7/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
 === "arm64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_linux_arm64.tar.gz
-    tar zxvf ntfy_2.27.0_linux_arm64.tar.gz
-    sudo cp -a ntfy_2.27.0_linux_arm64/ntfy /usr/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.27.0_linux_arm64/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_linux_arm64.tar.gz
+    tar zxvf ntfy_2.6.2_linux_arm64.tar.gz
+    sudo cp -a ntfy_2.6.2_linux_arm64/ntfy /usr/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.6.2_linux_arm64/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
-### Install as a service
-If you want to install ntfy server permanently as a service, and your OS/distribution of choice doesn't offer a package,
-there are a few more steps to follow.
-
-Create the ntfy user and group:
-```bash
-useradd --system --home-dir /var/lib/ntfy --shell /bin/false --comment "User for the simple HTTP-based pub-sub notification service" ntfy
-```
-
-Depending on your init system, the following steps will diverge.
-
-#### On systemd systems
-Install the ntfy server unit file (which contains parameters to start the service at boot time):
-
-=== "x86_64/amd64"
-    ```bash
-    sudo mv ntfy_2.27.0_linux_amd64/server/ntfy.service /etc/systemd/system/
-    sudo chmod 644 /etc/systemd/system/ntfy.service
-    ```
-
-=== "armv6"
-    ```bash
-    sudo mv ntfy_2.27.0_linux_armv6/server/ntfy.service /etc/systemd/system/
-    sudo chmod 644 /etc/systemd/system/ntfy.service
-    ```
-
-=== "armv7/armhf"
-    ```bash
-    sudo mv ntfy_2.27.0_linux_armv7/server/ntfy.service /etc/systemd/system/
-    sudo chmod 644 /etc/systemd/system/ntfy.service
-    ```
-
-=== "arm64"
-    ```bash
-    sudo mv ntfy_2.27.0_linux_arm64/server/ntfy.service /etc/systemd/system/
-    sudo chmod 644 /etc/systemd/system/ntfy.service
-    ```
-
-Then notify systemd we have added a new service and start the service:
-
-```bash
-sudo systemctl daemon-reload
-sudo systemctl start ntfy
-```
-
-#### On OpenRC systems
-Install the ntfy server service script:
-
-=== "x86_64/amd64"
-    ```bash
-    sudo mv ntfy_2.27.0_linux_amd64/server/ntfy.openrc /etc/init.d/ntfy
-    sudo chmod 755 /etc/init.d/ntfy
-    ```
-
-=== "armv6"
-    ```bash
-    sudo mv ntfy_2.27.0_linux_armv6/server/ntfy.openrc /etc/init.d/ntfy
-    sudo chmod 755 /etc/init.d/ntfy
-    ```
-
-=== "armv7/armhf"
-    ```bash
-    sudo mv ntfy_2.27.0_linux_armv7/server/ntfy.openrc /etc/init.d/ntfy
-    sudo chmod 755 /etc/init.d/ntfy
-    ```
-
-=== "arm64"
-    ```bash
-    sudo mv ntfy_2.27.0_linux_arm64/server/ntfy.openrc /etc/init.d/ntfy
-    sudo chmod 755 /etc/init.d/ntfy
-    ```
-
-Start the ntfy server service:
-
-```bash
-sudo rc-service ntfy start
-```
-
-Add the ntfy server service to the default runlevel (so that it starts at boot time):
-
-```bash
-sudo rc-update add ntfy default
-```
-
 ## Debian/Ubuntu repository
-
-!!! info
-    As of September 2025, **the official ntfy.sh Debian/Ubuntu repository has moved to [archive.ntfy.sh](https://archive.ntfy.sh/apt)**.
-    The old repository [archive.heckel.io](https://archive.heckel.io/apt) is still available for now, but will likely
-    go away soon. I suspect I will phase it out some time in early 2026.
-
-Installation via Debian/Ubuntu repository (fingerprint `55BA 774A 6F5E E674 31E4  B6B7 CFDB 962D 4F1E C4AF`):
+Installation via Debian repository:
 
 === "x86_64/amd64"
     ```bash
     sudo mkdir -p /etc/apt/keyrings
-    sudo curl -L -o /etc/apt/keyrings/ntfy.gpg https://archive.ntfy.sh/apt/keyring.gpg
+    curl -fsSL https://archive.heckel.io/apt/pubkey.txt | sudo gpg --dearmor -o /etc/apt/keyrings/archive.heckel.io.gpg
     sudo apt install apt-transport-https
-    echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/ntfy.gpg] https://archive.ntfy.sh/apt stable main" \
-        | sudo tee /etc/apt/sources.list.d/ntfy.list
+    sudo sh -c "echo 'deb [arch=amd64 signed-by=/etc/apt/keyrings/archive.heckel.io.gpg] https://archive.heckel.io/apt debian main' \
+        > /etc/apt/sources.list.d/archive.heckel.io.list"  
     sudo apt update
     sudo apt install ntfy
     sudo systemctl enable ntfy
@@ -177,10 +82,10 @@ Installation via Debian/Ubuntu repository (fingerprint `55BA 774A 6F5E E674 31E4
 === "armv7/armhf"
     ```bash
     sudo mkdir -p /etc/apt/keyrings
-    sudo curl -L -o /etc/apt/keyrings/ntfy.gpg https://archive.ntfy.sh/apt/keyring.gpg
+    curl -fsSL https://archive.heckel.io/apt/pubkey.txt | sudo gpg --dearmor -o /etc/apt/keyrings/archive.heckel.io.gpg
     sudo apt install apt-transport-https
-    echo "deb [arch=armhf signed-by=/etc/apt/keyrings/ntfy.gpg] https://archive.ntfy.sh/apt stable main" \
-        | sudo tee /etc/apt/sources.list.d/ntfy.list
+    sudo sh -c "echo 'deb [arch=armhf signed-by=/etc/apt/keyrings/archive.heckel.io.gpg] https://archive.heckel.io/apt debian main' \
+        > /etc/apt/sources.list.d/archive.heckel.io.list"
     sudo apt update
     sudo apt install ntfy
     sudo systemctl enable ntfy
@@ -190,10 +95,10 @@ Installation via Debian/Ubuntu repository (fingerprint `55BA 774A 6F5E E674 31E4
 === "arm64"
     ```bash
     sudo mkdir -p /etc/apt/keyrings
-    sudo curl -L -o /etc/apt/keyrings/ntfy.gpg https://archive.ntfy.sh/apt/keyring.gpg
+    curl -fsSL https://archive.heckel.io/apt/pubkey.txt | sudo gpg --dearmor -o /etc/apt/keyrings/archive.heckel.io.gpg
     sudo apt install apt-transport-https
-    echo "deb [arch=arm64 signed-by=/etc/apt/keyrings/ntfy.gpg] https://archive.ntfy.sh/apt stable main" \
-        | sudo tee /etc/apt/sources.list.d/ntfy.list
+    sudo sh -c "echo 'deb [arch=arm64 signed-by=/etc/apt/keyrings/archive.heckel.io.gpg] https://archive.heckel.io/apt debian main' \
+        > /etc/apt/sources.list.d/archive.heckel.io.list"
     sudo apt update
     sudo apt install ntfy
     sudo systemctl enable ntfy
@@ -204,7 +109,7 @@ Manually installing the .deb file:
 
 === "x86_64/amd64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_linux_amd64.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_linux_amd64.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -212,7 +117,7 @@ Manually installing the .deb file:
 
 === "armv6"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_linux_armv6.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_linux_armv6.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -220,7 +125,7 @@ Manually installing the .deb file:
 
 === "armv7/armhf"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_linux_armv7.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_linux_armv7.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -228,7 +133,7 @@ Manually installing the .deb file:
 
 === "arm64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_linux_arm64.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_linux_arm64.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -238,35 +143,33 @@ Manually installing the .deb file:
 
 === "x86_64/amd64"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_linux_amd64.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_linux_amd64.rpm
     sudo systemctl enable ntfy 
     sudo systemctl start ntfy
     ```
 
 === "armv6"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_linux_armv6.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_linux_armv6.rpm
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
     ```
 
 === "armv7/armhf"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_linux_armv7.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_linux_armv7.rpm
     sudo systemctl enable ntfy 
     sudo systemctl start ntfy
     ```
 
 === "arm64"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_linux_arm64.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_linux_arm64.rpm
     sudo systemctl enable ntfy 
     sudo systemctl start ntfy
     ```
 
 ## Arch Linux
-<span class="community-badge" title="This package is maintained by the community, not the ntfy developers"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M11 7h2v2h-2zm0 4h2v6h-2zm1-9C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm0 18c-4.41 0-8-3.59-8-8s3.59-8 8-8 8 3.59 8 8-3.59 8-8 8z"/></svg> Community maintained</span>
-
 ntfy can be installed using an [AUR package](https://aur.archlinux.org/packages/ntfysh-bin/). 
 You can use an [AUR helper](https://wiki.archlinux.org/title/AUR_helpers) like `paru`, `yay` or others to download, 
 build and install ntfy and keep it up to date.
@@ -281,9 +184,7 @@ cd ntfysh-bin
 makepkg -si
 ```
 
-## NixOS / Nix 
-<span class="community-badge" title="This package is maintained by the community, not the ntfy developers"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M11 7h2v2h-2zm0 4h2v6h-2zm1-9C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm0 18c-4.41 0-8-3.59-8-8s3.59-8 8-8 8 3.59 8 8-3.59 8-8 8z"/></svg> Community maintained</span>
-
+## NixOS / Nix
 ntfy is packaged in nixpkgs as `ntfy-sh`. It can be installed by adding the package name to the configuration file and calling `nixos-rebuild`. Alternatively, the following command can be used to install ntfy in the current user environment:
 ```
 nix-env -iA ntfy-sh
@@ -291,28 +192,20 @@ nix-env -iA ntfy-sh
 
 NixOS also supports [declarative setup of the ntfy server](https://search.nixos.org/options?channel=unstable&show=services.ntfy-sh.enable&from=0&size=50&sort=relevance&type=packages&query=ntfy). 
 
-## FreeBSD
-<span class="community-badge" title="This package is maintained by the community, not the ntfy developers"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M11 7h2v2h-2zm0 4h2v6h-2zm1-9C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm0 18c-4.41 0-8-3.59-8-8s3.59-8 8-8 8 3.59 8 8-3.59 8-8 8z"/></svg> Community maintained</span>
-
-ntfy is ported to FreeBSD and available via the ports collection as [sysutils/go-ntfy](https://www.freshports.org/sysutils/go-ntfy/). You can install it via `pkg`:
-```
-pkg install go-ntfy
-```
-
 ## macOS
 The [ntfy CLI](subscribe/cli.md) (`ntfy publish` and `ntfy subscribe` only) is supported on macOS as well. 
-To install, please [download the tarball](https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_darwin_all.tar.gz), 
+To install, please [download the tarball](https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_darwin_all.tar.gz), 
 extract it and place it somewhere in your `PATH` (e.g. `/usr/local/bin/ntfy`). 
 
 If run as `root`, ntfy will look for its config at `/etc/ntfy/client.yml`. For all other users, it'll look for it at 
 `~/Library/Application Support/ntfy/client.yml` (sample included in the tarball).
 
 ```bash
-curl -L https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_darwin_all.tar.gz > ntfy_2.27.0_darwin_all.tar.gz
-tar zxvf ntfy_2.27.0_darwin_all.tar.gz
-sudo cp -a ntfy_2.27.0_darwin_all/ntfy /usr/local/bin/ntfy
+curl -L https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_darwin_all.tar.gz > ntfy_2.6.2_darwin_all.tar.gz
+tar zxvf ntfy_2.6.2_darwin_all.tar.gz
+sudo cp -a ntfy_2.6.2_darwin_all/ntfy /usr/local/bin/ntfy
 mkdir ~/Library/Application\ Support/ntfy 
-cp ntfy_2.27.0_darwin_all/client/client.yml ~/Library/Application\ Support/ntfy/client.yml
+cp ntfy_2.6.2_darwin_all/client/client.yml ~/Library/Application\ Support/ntfy/client.yml
 ntfy --help
 ```
 
@@ -321,38 +214,27 @@ ntfy --help
     development as well. Check out the [build instructions](develop.md) for details.
 
 ## Homebrew
-<span class="community-badge" title="This package is maintained by the community, not the ntfy developers"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M11 7h2v2h-2zm0 4h2v6h-2zm1-9C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm0 18c-4.41 0-8-3.59-8-8s3.59-8 8-8 8 3.59 8 8-3.59 8-8 8z"/></svg> Community maintained</span>
-
 To install the [ntfy CLI](subscribe/cli.md) (`ntfy publish` and `ntfy subscribe` only) via Homebrew (Linux and macOS),
 simply run:
 ```
 brew install ntfy
 ```
 
+
 ## Windows
-The ntfy server and CLI are fully supported on Windows. You can run the ntfy server directly or as a Windows service.
-To install, you can either
-
-* [Download the latest ZIP](https://github.com/binwiederhier/ntfy/releases/download/v2.27.0/ntfy_2.27.0_windows_amd64.zip),
+The [ntfy CLI](subscribe/cli.md) (`ntfy publish` and `ntfy subscribe` only) is supported on Windows as well.
+To install, please [download the latest ZIP](https://github.com/binwiederhier/ntfy/releases/download/v2.6.2/ntfy_2.6.2_windows_amd64.zip),
 extract it and place the `ntfy.exe` binary somewhere in your `%Path%`. 
-* Or install ntfy from the [Scoop](https://scoop.sh) main repository via `scoop install ntfy`
 
-Once installed, you can run the ntfy CLI commands like so:
+The default path for the client config file is at `%AppData%\ntfy\client.yml` (not created automatically, sample in the ZIP file).
 
-```
-ntfy.exe -h
-```
+Also available in [Scoop's](https://scoop.sh) Main repository:
 
-The default configuration file location on Windows is `%ProgramData%\ntfy\server.yml` (e.g., `C:\ProgramData\ntfy\server.yml`)
-for the server, and `%AppData%\ntfy\client.yml` for the client. You may need to create the directory and config file manually.
+`scoop install ntfy`
 
-To install the ntfy server as a Windows service, you can use the built-in `sc` command. For example, run this in an
-elevated command prompt (adjust the path to `ntfy.exe` accordingly):
-
-```
-sc create ntfy binPath="C:\path\to\ntfy.exe serve" start=auto
-sc start ntfy
-```
+!!! info
+    There is currently no installer for Windows, and the binary is not signed. If this is desired, please create a
+    [GitHub issue](https://github.com/binwiederhier/ntfy/issues) to let me know.
 
 ## Docker
 The [ntfy image](https://hub.docker.com/r/binwiederhier/ntfy) is available for amd64, armv6, armv7 and arm64. It should 
@@ -397,6 +279,8 @@ docker run \
 
 Using docker-compose with non-root user and healthchecks enabled:
 ```yaml
+version: "2.3"
+
 services:
   ntfy:
     image: binwiederhier/ntfy
@@ -418,7 +302,6 @@ services:
         retries: 3
         start_period: 40s
     restart: unless-stopped
-    init: true # needed, if healthcheck is used. Prevents zombie processes
 ```
 
 If using a non-root user when running the docker version, be sure to chown the server.yml, user.db, and cache.db files and attachments directory to the same uid/gid.
@@ -437,6 +320,7 @@ The setup for Kubernetes is very similar to that for Docker, and requires a fair
 are a few options to mix and match, including a deployment without a cache file, a stateful set with a persistent cache, and a standalone
 unmanned pod.
 
+
 === "deployment"
     ```yaml
     apiVersion: apps/v1
@@ -655,18 +539,18 @@ kubectl apply -k /ntfy
                       cpu: 150m
                       memory: 150Mi
               volumeMounts:
-                - mountPath: /etc/ntfy/server.yml
-                  subPath: server.yml
-                  name: config-volume # generated via configMapGenerator from kustomization file
-                - mountPath: /var/cache/ntfy
-                  name: cache-volume # cache volume mounted to persistent volume
-          volumes:
-            - name: config-volume
-              configMap: # uses configmap generator to parse server.yml to configmap
-                name: server-config
-            - name: cache-volume
-              persistentVolumeClaim: # stores /cache/ntfy in defined pv
-                claimName: ntfy-pvc
+                  - mountPath: /etc/ntfy/server.yml
+                    subPath: server.yml
+                    name: config-volume # generated vie configMapGenerator from kustomization file
+                  - mountPath: /var/cache/ntfy
+                    name: cache-volume #cache volume mounted to persistent volume
+            volumes:
+              - name: config-volume
+                configMap:  # uses configmap generator to parse server.yml to configmap
+                  name: server-config
+              - name: cache-volume
+                persistentVolumeClaim: # stores /cache/ntfy in defined pv
+                  claimName: ntfy-pvc
     ```
   
 === "ntfy-pvc.yaml"
@@ -726,31 +610,3 @@ kubectl apply -k /ntfy
     cache-file: "/var/cache/ntfy/cache.db"
     attachment-cache-dir: "/var/cache/ntfy/attachments"
     ```
-
-## Helm
-<span class="community-badge" title="This package is maintained by the community, not the ntfy developers"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M11 7h2v2h-2zm0 4h2v6h-2zm1-9C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm0 18c-4.41 0-8-3.59-8-8s3.59-8 8-8 8 3.59 8 8-3.59 8-8 8z"/></svg> Community maintained</span>
-
-If you prefer [Helm](https://helm.sh/), ntfy can be deployed using the third-party
-[HelmForge chart](https://helmforge.dev/docs/charts/ntfy), which packages the official
-`binwiederhier/ntfy` image with persistent storage, Service, Ingress, optional Prometheus metrics, and more.
-This chart is **not** maintained by the ntfy developers.
-
-!!! warning
-    The HelmForge project is young and maintained by a small community. Review the chart before deploying it,
-    and use it at your own risk.
-
-```bash
-helm repo add helmforge https://repo.helmforge.dev
-helm repo update
-helm install ntfy helmforge/ntfy
-```
-
-Alternatively, install it directly from the OCI registry:
-
-```bash
-helm install ntfy oci://ghcr.io/helmforgedev/helm/ntfy
-```
-
-Because ntfy's default SQLite storage is single-writer, run the chart as a single instance rather than
-treating it as a horizontally scalable deployment. See the [chart documentation](https://helmforge.dev/docs/charts/ntfy)
-for the full list of configurable values.

docs/integrations.md

@@ -4,21 +4,8 @@ There are quite a few projects that work with ntfy, integrate ntfy, or have been
 
 I've added a ⭐ to projects or posts that have a significant following, or had a lot of interaction by the community.
 
-## Table of Contents
-
-- [Official integrations](#official-integrations)
-- [Integration via HTTP/SMTP/etc.](#integration-via-httpsmtpetc)
-- [UnifiedPush integrations](#unifiedpush-integrations)
-- [Libraries](#libraries)
-- [CLIs + GUIs](#clis-guis)
-- [Projects + scripts](#projects-scripts)
-- [Blog + forum posts](#blog-forum-posts)
-- [Alternative ntfy servers](#alternative-ntfy-servers)
-
 ## Official integrations
 
-- [changedetection.io](https://changedetection.io) ⭐ - Website change detection and notification
-- [Home Assistant](https://www.home-assistant.io/integrations/ntfy) ⭐ - Home Assistant is an open-source platform for automating and controlling smart home devices.
 - [Healthchecks.io](https://healthchecks.io/) ⭐ - Online service for monitoring regularly running tasks such as cron jobs
 - [Apprise](https://github.com/caronc/apprise/wiki/Notify_ntfy) ⭐ - Push notifications that work with just about every platform
 - [Uptime Kuma](https://uptime.kuma.pet/) ⭐ - A self-hosted monitoring tool
@@ -29,33 +16,21 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [Gatus](https://gatus.io/) ⭐ - Automated service health dashboard
 - [Automatisch](https://automatisch.io/) ⭐ - Open source Zapier alternative / workflow automation tool
 - [FlexGet](https://flexget.com/Plugins/Notifiers/ntfysh) ⭐ - Multipurpose automation tool for all of your media
-- [Shoutrrr](https://containrrr.dev/shoutrrr/v0.8/services/ntfy/) ⭐ - Notification library for gophers and their furry friends.
+- [Shoutrrr](https://containrrr.dev/shoutrrr/v0.7/services/ntfy/) ⭐ - Notification library for gophers and their furry friends.
 - [Netdata](https://learn.netdata.cloud/docs/alerts-and-notifications/notifications/agent-alert-notifications/ntfy) ⭐ - Real-time performance monitoring
 - [Deployer](https://github.com/deployphp/deployer) ⭐ - PHP deployment tool
 - [Scrt.link](https://scrt.link/) - Share a secret
 - [Platypush](https://docs.platypush.tech/platypush/plugins/ntfy.html) - Automation platform aimed to run on any device that can run Python
 - [diun](https://crazymax.dev/diun/) - Docker Image Update Notifier
 - [Cloudron](https://www.cloudron.io/store/sh.ntfy.cloudronapp.html) - Platform that makes it easy to manage web apps on your server
-- [Xitoring](https://xitoring.com/docs/notifications/notification-roles/ntfy/) - Server and Uptime monitoring
-- [HetrixTools](https://docs.hetrixtools.com/ntfy-sh-notifications/) - Uptime monitoring
-- [EasyMorph](https://help.easymorph.com/doku.php?id=transformations:sendntfymessage) - Visual data transformation and automation tool
-- [Monibot](https://monibot.io/) - Monibot monitors your websites, servers and applications and notifies you if something goes wrong.
-- [Miniflux](https://miniflux.app/docs/ntfy.html) - Minimalist and opinionated feed reader
-- [Beszel](https://beszel.dev/guide/notifications/ntfy) - Server monitoring platform
-- [Simple Observability](https://simpleobservability.com/docs/alerts/ntfy) - Server monitoring and observability platform
-- [Sifio](https://sifio.net) - Aggregate updates from RSS, social media, and other sources, then deliver them to ntfy, Slack, Notion and more
 
 ## Integration via HTTP/SMTP/etc.
 
 - [Watchtower](https://containrrr.dev/watchtower/) ⭐ - Automating Docker container base image updates (see [integration example](examples.md#watchtower-shoutrrr))
 - [Jellyfin](https://jellyfin.org/) ⭐ - The Free Software Media System (see [integration example](examples.md#))
-- [Overseerr](https://docs.overseerr.dev/using-overseerr/notifications/webhooks) ⭐ - a request management and media discovery tool for Plex (see [integration example](examples.md#jellyseerroverseerr-webhook))
+- [Overseer](https://docs.overseerr.dev/using-overseerr/notifications/webhooks) ⭐ - a request management and media discovery tool for Plex (see [integration example](examples.md#jellyseerroverseerr-webhook))
 - [Tautulli](https://github.com/Tautulli/Tautulli) ⭐ - Monitoring and tracking tool for Plex (integration [via webhook](https://github.com/Tautulli/Tautulli/wiki/Notification-Agents-Guide#webhook))
 - [Mailrise](https://github.com/YoRyan/mailrise) - An SMTP gateway (integration via [Apprise](https://github.com/caronc/apprise/wiki/Notify_ntfy))
-- [Proxmox-Ntfy](https://github.com/qtsone/proxmox-ntfy) - Python script that monitors Proxmox tasks and sends notifications using the Ntfy service.
-- [Scrutiny](https://github.com/AnalogJ/scrutiny) - WebUI for smartd S.M.A.R.T monitoring. Scrutiny includes shoutrrr/ntfy integration ([see integration README](https://github.com/AnalogJ/scrutiny?tab=readme-ov-file#notifications))
-- [UptimeObserver](https://uptimeobserver.com) - Uptime Monitoring tool for Websites, APIs, SSL Certificates, DNS, Domain Names and Ports. [Integration Guide](https://support.uptimeobserver.com/integrations/ntfy/)
-- [Flowtriq](https://flowtriq.com) - Real-time DDoS detection and mitigation platform (integration via [webhook alerts](https://flowtriq.com))
 
 ## [UnifiedPush](https://unifiedpush.org/users/apps/) integrations
 
@@ -81,27 +56,16 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [ntfy](https://github.com/ffflorian/ntfy) - Send notifications over ntfy (JS)
 - [ntfy_dart](https://github.com/jr1221/ntfy_dart) - Dart wrapper around the ntfy API (Dart)
 - [gotfy](https://github.com/AnthonyHewins/gotfy) - A Go wrapper for the ntfy API (Go)
-- [symfony/ntfy-notifier](https://symfony.com/components/NtfyNotifier) ⭐ - Symfony Notifier integration for ntfy (PHP)
-- [ntfy-java](https://github.com/MaheshBabu11/ntfy-java/) - A Java package to interact with a ntfy server (Java)
-- [aiontfy](https://github.com/tr4nt0r/aiontfy) - Asynchronous client library for publishing and subscribing to ntfy (Python)
-- [ex_ntfy](https://github.com/houllette/ex_ntfy) - Elixir SDK covering publishing, polling, and streaming subscriptions for ntfy servers (Elixir)
 
 ## CLIs + GUIs
 
 - [ntfy.sh.sh](https://github.com/mininmobile/ntfy.sh.sh) - Run scripts on ntfy.sh events
-- [ntfy-desktop](https://codeberg.org/zvava/ntfy-desktop) - Cross-platform desktop application for ntfy
-- [ntfy-desktop](https://github.com/Aetherinox/ntfy-desktop) - Desktop client for Windows, Linux, and MacOS with push notifications
-- [ntfy Desktop (Windows)](https://github.com/simoneferrari/ntfy-desktop) - Native Windows desktop client with multi-server support, toast notifications and message history, built with WPF and .NET (C#)
+- [ntfy Desktop client](https://codeberg.org/zvava/ntfy-desktop) - Cross-platform desktop application for ntfy
+- [ntfy svelte front-end](https://github.com/novatorem/Ntfy) - Front-end built with svelte
 - [wio-ntfy-ticker](https://github.com/nachotp/wio-ntfy-ticker) - Ticker display for a ntfy.sh topic
-- [ntfysh-windows](https://github.com/mshafer1/ntfysh-windows) - A ntfy client for Windows Desktop
+- [ntfysh-windows](https://github.com/lucas-bortoli/ntfysh-windows) - A ntfy client for Windows Desktop
 - [ntfyr](https://github.com/haxwithaxe/ntfyr) - A simple commandline tool to send notifications to ntfy
 - [ntfy.py](https://github.com/ioqy/ntfy-client-python) - ntfy.py is a simple nfty.sh client for sending notifications
-- [wlzntfy](https://github.com/Walzen-Group/ntfy-toaster) - A minimalistic, receive-only toast notification client for Windows 11
-- [Ntfy_CSV_Reminders](https://github.com/thiswillbeyourgithub/Ntfy_CSV_Reminders) - A Python tool that sends random-timing phone notifications for recurring tasks by using daily probability checks based on CSV-defined frequencies.
-- [Daily Fact Ntfy](https://github.com/thiswillbeyourgithub/Daily_Fact_Ntfy) - Generate [llm](https://github.com/simonw/llm) generated fact every day about any topic you're interested in.
-- [ntfyexec](https://github.com/alecthomas/ntfyexec) - Send a notification through ntfy.sh if a command fails
-- [Ntfy Desktop](https://github.com/emmaexe/ntfyDesktop) - Fully featured desktop client for Linux, built with Qt and C++.
-- [Ntfy App](https://github.com/rubix-studios-pty-ltd/ntfy-app) - Tauri/Rust desktop client for Windows, Linux and MacOS with push notifications.
 
 ## Projects + scripts 
 
@@ -110,13 +74,12 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [Grafana-to-ntfy](https://gitlab.com/Saibe1111/grafana-to-ntfy) - Grafana-to-ntfy alerts channel (Node Js)
 - [ntfy-long-zsh-command](https://github.com/robfox92/ntfy-long-zsh-command) - Notifies you once a long-running command completes (zsh)
 - [ntfy-shellscripts](https://github.com/nickexyz/ntfy-shellscripts) - A few scripts for the ntfy project (Shell)
-- [alertmanager-ntfy-relay](https://github.com/therobbielee/alertmanager-ntfy-relay) - ntfy.sh relay for Alertmanager (Go)
-- [oci-notifications-ntfy-relay](https://github.com/Ryan02I5/oci-notifications-ntfy-relay) - Minimal OCI Notifications / Oracle Functions relay to ntfy topics (Python)
 - [QuickStatus](https://github.com/corneliusroot/QuickStatus) - A shell script to alert to any immediate problems upon login (Shell)
 - [ntfy.el](https://github.com/shombando/ntfy) - Send notifications from Emacs (Emacs)
 - [backup-projects](https://gist.github.com/anthonyaxenov/826ba65abbabd5b00196bc3e6af76002) - Stupidly simple backup script for own projects (Shell)
 - [grav-plugin-whistleblower](https://github.com/Himmlisch-Studios/grav-plugin-whistleblower) - Grav CMS plugin to get notifications via ntfy (PHP)
 - [ntfy-server-status](https://github.com/filip2cz/ntfy-server-status) -  Checking if server is online and reporting through ntfy (C)
+- [borg-based backup](https://github.com/davidhi7/backup) - Simple borg-based backup script with notifications based on ntfy.sh or Discord webhooks (Python/Shell)
 - [ntfy.sh *arr script](https://github.com/agent-squirrel/nfty-arr-script) - Quick and hacky script to get sonarr/radarr to notify the ntfy.sh service (Shell)
 - [website-watcher](https://github.com/muety/website-watcher) - A small tool to watch websites for changes (with XPath support) (Python)
 - [siteeagle](https://github.com/tpanum/siteeagle) - A small Python script to monitor websites and notify changes (Python)
@@ -159,82 +122,13 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [ntfyd](https://github.com/joachimschmidt557/ntfyd) - ntfy desktop daemon (Zig)
 - [ntfy-browser](https://github.com/johman10/ntfy-browser) - browser extension to receive notifications without having the page open (TypeScript)
 - [ntfy-electron](https://github.com/xdpirate/ntfy-electron) - Electron wrapper for the ntfy web app (JS)
-- [systemd-ntfy-poweronoff](https://github.com/stendler/systemd-ntfy-poweronoff) - Systemd services to send notifications on system startup, shutdown and service failure
+- [systemd-ntfy-poweronoff](https://github.com/stendler/systemd-ntfy-poweronoff) -  Systemd services to send notifications on system startup and shutdown (Go)
 - [msgdrop](https://github.com/jbrubake/msgdrop) - Send and receive encrypted messages (Bash)
 - [vigilant](https://github.com/VerifiedJoseph/vigilant) - Monitor RSS/ATOM and JSON feeds, and send push notifications on new entries (PHP)
 - [ansible-role-ntfy-alertmanager](https://github.com/bleetube/ansible-role-ntfy-alertmanager) - Ansible role to install xenrox/ntfy-alertmanager
-- [NtfyMe-Blender](https://github.com/NotNanook/NtfyMe-Blender) - Blender addon to send notifications to NtfyMe (Python)
-- [ntfy-ios-url-share](https://www.icloud.com/shortcuts/be8a7f49530c45f79733cfe3e41887e6) - An iOS shortcut that lets you share URLs easily and quickly.
-- [ntfy-ios-filesharing](https://www.icloud.com/shortcuts/fe948d151b2e4ae08fb2f9d6b27d680b) - An iOS shortcut that lets you share files from your share feed to a topic of your choice.
-- [systemd-ntfy](https://hackage.haskell.org/package/systemd-ntfy) - monitor a set of systemd services an send a notification to ntfy.sh whenever their status changes
-- [RouterOS Scripts](https://git.eworm.de/cgit/routeros-scripts/about/) - a collection of scripts for MikroTik RouterOS
-- [ntfy-android-builder](https://github.com/TheBlusky/ntfy-android-builder) - Script for building ntfy-android with custom Firebase configuration (Docker/Shell)
-- [jetspotter](https://github.com/vvanouytsel/jetspotter) - send notifications when planes are spotted near you (Go)
-- [monitoring_ntfy](https://www.drupal.org/project/monitoring_ntfy) - Drupal monitoring Ntfy.sh integration (PHP/Drupal)
-- [Notify](https://flathub.org/apps/com.ranfdev.Notify) - Native GTK4 client for ntfy (Rust) 
-- [notify-via-ntfy](https://exchange.checkmk.com/p/notify-via-ntfy) - Checkmk plugin to send notifications via ntfy (Python)
-- [ntfy-java](https://github.com/MaheshBabu11/ntfy-java/) - A Java package to interact with a ntfy server (Java)
-- [container-update-check](https://github.com/stendler/container-update-check) - Scripts to check and notify if a podman or docker container image can be updated (Podman/Shell)
-- [ignition-combustion-template](https://github.com/stendler/ignition-combustion-template) - Templates and scripts to generate a configuration to automatically setup a system on first boot. Including systemd-ntfy-poweronoff (Shell)
-- [ntfy-run](https://github.com/quantum5/ntfy-run) - Tool to run a command, capture its output, and send it to ntfy (Rust)
-- [Clipboard IO](https://github.com/jim3692/clipboard-io) - End to end encrypted clipboard
-- [ntfy-me-mcp](https://github.com/gitmotion/ntfy-me-mcp) - An ntfy MCP server for sending/fetching ntfy notifications to your self-hosted ntfy server from AI Agents (supports secure token auth & more - use with npx or docker!) (Node/Typescript)
-- [InvaderInformant](https://github.com/patricksthannon/InvaderInformant) - Script for Mac OS systems that monitors new or dropped connections to your network using ntfy (Shell)
-- [NtfyPwsh](https://github.com/ptmorris1/NtfyPwsh) - PowerShell module to help send messages to ntfy (PowerShell)
-- [ntfyrr](https://github.com/leukosaima/ntfyrr) - Overseerr and Maintainerr webhook notification to ntfy helper service (C#)
-- [ntfy for Sandstorm](https://apps.sandstorm.io/app/c6rk81r4qk6dm3k04x1kxmyccqewhh4npuxeyg1xrpfypn2ddy0h) - ntfy app for the Sandstorm platform
-- [ntfy-heartbeat-monitor](https://codeberg.org/RockWolf/ntfy-heartbeat-monitor) - Application for implementing heartbeat monitoring/alerting by utilizing ntfy
-- [ntfy-bridge](https://github.com/AlexGaudon/ntfy-bridge) - An application to bridge Discord messages (or webhooks) to ntfy.
-- [ntailfy](https://github.com/leukosaima/ntailfy) - ntfy notifications when Tailscale devices connect/disconnect (Go)
-- [BRun](https://github.com/cbrake/brun) - Native Linux automation platform connecting triggers to actions without containers (Go)
-- [Uptime Monitor](https://uptime-monitor.org) - Self-hosted, enterprise-grade uptime monitoring and alerting system (TS)
-- [send_to_ntfy_extension](https://github.com/TheDuffman85/send_to_ntfy_extension/) ⭐ - A browser extension to send the notifications to ntfy (JS)
-- [SIA-Server](https://github.com/ZebMcKayhan/SIA-Server) - A light weight, self-hosted notification Server for Honywell Galaxy Flex alarm systems (Python)
-- [zabbix-ntfy](https://github.com/torgrimt/zabbix-ntfy) - Zabbix server Mediatype to add support for ntfy.sh services
-- [Rubix Notify](https://wordpress.org/plugins/rubix-notify) - WordPress Integration with ntfy (PHP + React).
 
 ## Blog + forum posts
 
-- [Push alerts for WHM using ntfy](https://rubixstudios.com.au/insights/push-alerts-for-whm-using-ntfy) - rubixstudios.com.au - 5/2026
-- [Device notifications via HTTP with ntfy](https://alistairshepherd.uk/writing/ntfy/) - alistairshepherd.uk - 6/2025
-- [Notifications about (almost) anything with ntfy.sh](https://hamatti.org/posts/notifications-about-almost-anything-with-ntfy-sh/) - hamatti.org - 6/2025
-- [I set up a self-hosted notification service for everything, and I'll never look back](https://www.xda-developers.com/set-up-self-hosted-notification-service/) ⭐ - xda-developers.com - 5/2025
-- [How to Set Up Ntfy: Self-Hosted Push Notifications Made Easy](https://www.youtube.com/watch?v=wDJDiAYZ3H0) - youtube.com (sass drew) - 1/2025
-- [The NTFY is a game-changer FREE solution for IT people](https://www.youtube.com/watch?v=NtlztHT-sRw) - youtube.com (Valters Tech Turf) - 1/2025
-- [Notify: A Powerful Tool for Real-Time Notifications (ntfy.sh)](https://www.youtube.com/watch?v=XXTTeVfGBz0) - youtube.com (LinuxCloudHacks) - 12/2025
-- [Push notifications with ntfy and n8n](https://www.youtube.com/watch?v=DKG1R3xYvwQ) - youtube.com (Oskar) - 10/2024
-- [Setup ntfy for selfhosted notifications with Cloudflare Tunnel](https://medium.com/@svenvanginkel/setup-ntfy-for-selfhosted-notifications-with-cloudflare-tunnel-e342f470177d) - medium.com (Sven van Ginkel) - 10/2024
-- [Self-Host NTFY - How It Works & Easy Setup Guide](https://www.youtube.com/watch?v=79wHc_jfrJE) ⭐ - youtube.com (Techdox)- 9/2024
-- [ntfy / Emacs Lisp](https://speechcode.com/blog/ntfy/) - speechcode.com - 3/2024
-- [Boost Your Productivity with ntfy.sh: The Ultimate Notification Tool for Command-Line Users](https://dev.to/archetypal/boost-your-productivity-with-ntfysh-the-ultimate-notification-tool-for-command-line-users-iil) - dev.to - 3/2024
-- [Nextcloud Talk (F-Droid version) notifications using ntfy (ntfy.sh)](https://www.youtube.com/watch?v=0a6PpfN5PD8) - youtube.com - 2/2024
-- [ZFS and SMART Warnings via Ntfy](https://rair.dev/zfs-smart-ntfy/) - rair.dev - 2/2024
-- [Automating Security Camera Notifications With Home Assistant and Ntfy](https://runtimeterror.dev/automating-camera-notifications-home-assistant-ntfy/) ⭐ - runtimeterror.dev - 2/2024
-- [Ntfy: self-hosted notification service](https://medium.com/@williamdonze/ntfy-self-hosted-notification-service-0f3eada6e657) ⭐ - williamdonze.medium.com - 1/2024
-- [Let’s Supercharge Snowflake Alerts with Cool ntfy Open-source Notifications!](https://sarathi-data-ml-cloud.medium.com/lets-supercharge-snowflake-alerts-with-cool-ntfy-open-source-notifications-296da442c331) - sarathi-data-ml-cloud.medium.com - 1/2024
-- [Setting up NTFY with Ngnix-Proxy-Manager, authentication and Ansible notifications](https://random-it-blog.de/rocky-linux/setting-up-ntfy-with-ngnix-proxy-manager-authentication-and-ansible-notifications/) - random-it-blog.de - 12/2023
-- [Introducing the Monitoring Ntfy.sh Integration Module: Real-time Notifications for Drupal Monitoring](https://cyberschorsch.dev/drupal/introducing-monitoring-ntfysh-integration-module-real-time-notifications-drupal-monitoring) - cyberschorsch.dev - 11/2023
-- [How to install Ntfy.sh on CasaOS using BigBearCasaOS](https://www.youtube.com/watch?v=wSWhtSNwTd8) - youtube.com - 10/2023
-- [Podman Update Notifications via Ntfy](https://rair.dev/podman-update-notifications-ntfy/) - rair.dev - 9/2023
-- [Easy Push Notifications With ntfy.sh](https://runtimeterror.dev/easy-push-notifications-with-ntfy/) ⭐ - runtimeterror.dev - 9/2023
-- [Ntfy: Your Ultimate Push Notification Powerhouse!](https://kkamalesh117.medium.com/ntfy-your-ultimate-push-notification-powerhouse-1968c070f1d1) - kkamalesh117.medium.com - 9/2023
-- [Installing Self Host NTFY On Linux Using Docker Container](https://www.pinoylinux.org/topicsplus/containers/installing-self-host-ntfy-on-linux-using-docker-container/) - pinoylinux.org - 9/2023
-- [Homelab Notifications with ntfy](https://blog.alexsguardian.net/posts/2023/09/12/selfhosting-ntfy/) ⭐ - alexsguardian.net - 9/2023 
-- [Why NTFY is the Ultimate Push Notification Tool for Your Needs](https://osintph.medium.com/why-ntfy-is-the-ultimate-push-notification-tool-for-your-needs-e767421c84c5) - osintph.medium.com - 9/2023
-- [Supercharge Your Alerts: Ntfy — The Ultimate Push Notification Solution](https://medium.com/spring-boot/supercharge-your-alerts-ntfy-the-ultimate-push-notification-solution-a3dda79651fe) - spring-boot.medium.com - 9/2023
-- [Deploy Ntfy using Docker](https://www.linkedin.com/pulse/deploy-ntfy-mohamed-sharfy/) - linkedin.com - 9/2023
-- [Send Notifications With Ntfy for New WordPress Posts](https://www.activepieces.com/blog/ntfy-notifications-for-wordpress-new-posts) - activepieces.com - 9/2023
-- [Get Ntfy Notifications About New Zendesk Ticket](https://www.activepieces.com/blog/ntfy-notifications-about-new-zendesk-tickets) - activepieces.com - 9/2023
-- [Set reminder for recurring events using ntfy & Cron](https://www.youtube.com/watch?v=J3O4aQ-EcYk) - youtube.com - 9/2023
-- [ntfy - Installation and full configuration setup](https://www.youtube.com/watch?v=QMy14rGmpFI) - youtube.com - 9/2023
-- [How to install Ntfy.sh on Portainer / Docker Compose](https://www.youtube.com/watch?v=utD9GNbAwyg) - youtube.com - 9/2023
-- [ntfy - Push-Benachrichtigungen // Push Notifications](https://www.youtube.com/watch?v=LE3vRPPqZOU) - youtube.com - 9/2023
-- [Podman Update Notifications via Ntfy](https://rair.dev/podman-upadte-notifications-ntfy/) - rair.dev - 9/2023
-- [How to Send Alerts From Raspberry Pi Pico W to a Phone or Tablet](https://www.tomshardware.com/how-to/send-alerts-raspberry-pi-pico-w-to-mobile-device) - tomshardware.com - 8/2023
-- [NetworkChunk - how did I NOT know about this?](https://www.youtube.com/watch?v=poDIT2ruQ9M) ⭐ - youtube.com - 8/2023
-- [NTFY - Command-Line Notifications](https://academy.networkchuck.com/blog/ntfy/) - academy.networkchuck.com - 8/2023
-- [Open Source Push Notifications! Get notified of any event you can imagine. Triggers abound!](https://www.youtube.com/watch?v=WJgwWXt79pE) ⭐ - youtube.com - 8/2023
-- [How to install and self host an Ntfy server on Linux](https://linuxconfig.org/how-to-install-and-self-host-an-ntfy-server-on-linux) - linuxconfig.org - 7/2023
 - [Basic website monitoring using cronjobs and ntfy.sh](https://burkhardt.dev/2023/website-monitoring-cron-ntfy/) - burkhardt.dev - 6/2023 
 - [Pingdom alternative in one line of curl through ntfy.sh](https://piqoni.bearblog.dev/uptime-monitoring-in-one-line-of-curl/) - bearblog.dev - 6/2023 
 - [#OpenSourceDiscovery 78: ntfy.sh](https://opensourcedisc.substack.com/p/opensourcediscovery-78-ntfysh) - opensourcedisc.substack.com - 6/2023 
@@ -261,7 +155,6 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [NTFY - système de notification hyper simple et complet](https://www.youtube.com/watch?v=UieZYWVVgA4) - youtube.com - 12/2022
 - [ntfy.sh](https://paramdeo.com/til/ntfy-sh) - paramdeo.com - 11/2022
 - [Using ntfy to warn me when my computer is discharging](https://ulysseszh.github.io/programming/2022/11/28/ntfy-warn-discharge.html) - ulysseszh.github.io - 11/2022
-- [Enabling SSH Login Notifications using Ntfy](https://paramdeo.com/blog/enabling-ssh-login-notifications-using-ntfy) - paramdeo.com - 11/2022
 - [ntfy - Push Notification Service](https://dizzytech.de/posts/ntfy/) - dizzytech.de - 11/2022 
 - [Console #132](https://console.substack.com/p/console-132) ⭐ - console.substack.com - 11/2022
 - [How to make my phone buzz*](https://evbogue.com/howtomakemyphonebuzz) - evbogue.com - 11/2022
@@ -302,8 +195,7 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [ntfy otro sistema de notificaciones pub-sub simple basado en HTTP](https://ugeek.github.io/blog/post/2021-11-05-ntfy-sh-otro-sistema-de-notificaciones-pub-sub-simple-basado-en-http.html) - ugeek.github.io - 11/2021
 - [Show HN: A tool to send push notifications to your phone, written in Go](https://news.ycombinator.com/item?id=29715464) ⭐ - news.ycombinator.com - 12/2021
 - [Reddit selfhostable post](https://www.reddit.com/r/selfhosted/comments/qxlsm9/my_open_source_notification_android_app_and/) ⭐ - reddit.com - 11/2021
-- [ntfy on The Canary in the Cage Podcast](https://odysee.com/@TheCanaryInTheCage:b/The-Canary-in-the-Cage-Episode-42:1?r=4gitYjTacQqPEjf22874USecDQYJ5y5E&t=3062) - odysee.com - 1/2025
-- [NtfyPwsh - A PowerShell Module to Send Ntfy Messages](https://ptmorris1.github.io/posts/NtfyPwsh/) - github.io - 5/2025
+
 
 ## Alternative ntfy servers
 
@@ -313,13 +205,12 @@ ntfy community. Thanks to everyone running a public server. **You guys rock!**
 | URL                                               | Country            |
 |---------------------------------------------------|--------------------|
 | [ntfy.sh](https://ntfy.sh/) (*Official*)          | 🇺🇸 United States |
-| [ntfy.tedomum.fr](https://ntfy.tedomum.fr/)     | 🇫🇷 France        |
+| [ntfy.tedomum.net](https://ntfy.tedomum.net/)     | 🇫🇷 France        |
 | [ntfy.jae.fi](https://ntfy.jae.fi/)               | 🇫🇮 Finland       |
 | [ntfy.adminforge.de](https://ntfy.adminforge.de/) | 🇩🇪 Germany       |
 | [ntfy.envs.net](https://ntfy.envs.net)            | 🇩🇪 Germany       |
 | [ntfy.mzte.de](https://ntfy.mzte.de/)             | 🇩🇪 Germany       |
 | [ntfy.hostux.net](https://ntfy.hostux.net/)       | 🇫🇷 France        |
-| [ntfy.fossman.de](https://ntfy.fossman.de/)       | 🇩🇪 Germany       |
 
 Please be aware that **server operators can log your messages**. The project also cannot guarantee the reliability
 and uptime of third party servers, so use of each server is **at your own discretion**.

docs/known-issues.md

@@ -27,12 +27,11 @@ Be sure that in your selfhosted server:
 * Set `upstream-base-url: "https://ntfy.sh"` (**not your own hostname!**)
 * Ensure that the URL you set in `base-url` **matches exactly** what you set the Default Server in iOS to 
 
-## iOS app seeing "New message", but not real message content
-If you see `New message` notifications on iOS, your iPhone can likely not talk to your self-hosted server. Be sure that
-your iOS device and your ntfy server are either on the same network, or that your phone can actually reach the server.
-
-Turn on tracing/debugging on the server (via `log-level: trace` or `log-level: debug`, see [troubleshooting](troubleshooting.md)),
-and read docs on [iOS instant notifications](https://docs.ntfy.sh/config/#ios-instant-notifications).
+## Firefox on Android not automatically subscribing to web push (see [#789](https://github.com/binwiederhier/ntfy/issues/789))
+ntfy defaults to web-push based subscriptions when installed as a [progressive web app](./subscribe/pwa.md). Firefox
+Android has an [open bug](https://bugzilla.mozilla.org/show_bug.cgi?id=1796434) where it reports the PWA mode incorrectly.
+This causes ntfy to not automatically subscribe to web push, and requires you to go to the ntfy Settings page to enable
+it manually.
 
 ## Safari does not play sounds for web push notifications
 Safari does not support playing sounds for web push notifications, and treats them all as silent. This will be fixed with

docs/privacy.md

@@ -1,198 +1,12 @@
 # Privacy policy
 
-**Last updated:** June 15, 2026
+I love free software, and I'm doing this because it's fun. I have no bad intentions, and **I will
+never monetize or sell your information, and this service and software will always stay free and open.**
 
-This privacy policy describes how ntfy ("we", "us", or "our") collects, uses, and handles your information
-when you use the ntfy.sh service, web app, and mobile applications (Android and iOS).
+Neither the server nor the app record any personal information, or share any of the messages and topics with
+any outside service. All data is exclusively used to make the service function properly. The only external service
+I use is Firebase Cloud Messaging (FCM) service, which is required to provide instant Android notifications (see
+[FAQ](faq.md) for details). To avoid FCM altogether, download the F-Droid version.
 
-## Our commitment to privacy
-
-We love free software, and we're doing this because it's fun. We have no bad intentions, and **we will
-never monetize or sell your information**. The ntfy service and software will always stay free and open source.
-If you don't trust us or your messages are sensitive, you can [self-host your own ntfy server](install.md).
-
-## Information we collect
-
-### Account information (optional)
-
-If you create an account on ntfy.sh, we collect:
-
-- **Username** - A unique identifier you choose
-- **Password** - Stored as a secure bcrypt hash (we never store your plaintext password)
-- **Email address** - If you add an email address to your account for account recovery and password resets, for use
-  with the email notification feature, or if you subscribe to a paid plan (for billing purposes via Stripe). Email
-  addresses you add to your account are verified by sending a confirmation link.
-- **Phone number** - Only if you enable the phone call notification feature (verified via SMS/call)
-
-You can use ntfy without creating an account. Anonymous usage is fully supported.
-
-### Messages and notifications
-
-- **Message content** - Messages you publish are temporarily cached on our servers (default: 12 hours) to support 
-  message polling and to overcome client network disruptions. Messages are deleted after the cache duration expires.
-- **Attachments** - File attachments are temporarily stored (default: 3 hours) and then automatically deleted.
-- **Topic names** - The topic names you publish to or subscribe to are processed by our servers.
-
-### Technical information
-
-- **IP addresses** - Used for rate limiting to prevent abuse. May be temporarily logged for debugging purposes,
-  though this is typically turned off.
-- **Access tokens** - If you create access tokens, we store the token value, an optional label, last access time, 
-  and the IP address of the last access.
-- **Web push subscriptions** - If you enable browser notifications, we store your browser's push subscription 
-  endpoint to deliver notifications.
-
-### Billing information (paid plans only)
-
-If you subscribe to a paid plan, payment processing is handled by Stripe. We store:
-
-- Stripe customer ID
-- Subscription status and billing period
-
-We do not store your credit card numbers or payment details directly. These are handled entirely by Stripe.
-
-## Third-party services
-
-To provide the ntfy.sh service, we use the following third-party services:
-
-### Firebase Cloud Messaging (FCM)
-
-We use Google's Firebase Cloud Messaging to deliver push notifications to Android and iOS devices. When you 
-receive a notification through the mobile apps (Google Play or App Store versions):
-
-- Message metadata and content may be transmitted through Google's FCM infrastructure
-- Google's [privacy policy](https://policies.google.com/privacy) applies to their handling of this data
-
-**To avoid FCM entirely:** Download the [F-Droid version](https://f-droid.org/en/packages/io.heckel.ntfy/) of 
-the Android app and use a self-hosted server, or use the instant delivery feature with your own server.
-
-### Twilio (phone calls)
-
-If you use the phone call notification feature (`X-Call` header), we use Twilio to:
-
-- Make voice calls to your verified phone number
-- Send SMS or voice calls for phone number verification
-
-Your phone number is shared with Twilio to deliver these services. Twilio's 
-[privacy policy](https://www.twilio.com/legal/privacy) applies.
-
-### Amazon SES (email delivery)
-
-If you use the email notification feature (`X-Email` header), or when ntfy sends account-related emails (email 
-address verification and password reset links), we use Amazon Simple Email Service (SES) to deliver emails. The 
-recipient email address and message content are transmitted through Amazon's infrastructure. Amazon's 
-[privacy policy](https://aws.amazon.com/privacy/) applies.
-
-### Stripe (payments)
-
-If you subscribe to a paid plan, payments are processed by Stripe. Your payment information is handled directly 
-by Stripe and is subject to Stripe's [privacy policy](https://stripe.com/privacy).
-
-Note: We have explicitly disabled Stripe's telemetry features in our integration.
-
-### Web push providers
-
-If you enable browser notifications in the ntfy web app, push messages are delivered through your browser 
-vendor's push service:
-
-- Google (Chrome)
-- Mozilla (Firefox)
-- Apple (Safari)
-- Microsoft (Edge)
-
-Your browser's push subscription endpoint is shared with these providers to deliver notifications.
-
-## Mobile applications
-
-### Android app
-
-The Android app is available from two sources:
-
-- **Google Play Store** - Uses Firebase Cloud Messaging for push notifications. Firebase Analytics is 
-  **explicitly disabled** in our app.
-- **F-Droid** - Does not include any Google services or Firebase. Uses a foreground service to maintain 
-  a direct connection to the server.
-
-The Android app stores the following data locally on your device:
-
-- Subscribed topics and their settings
-- Cached notifications
-- User credentials (if you add a server with authentication)
-- Application logs (for debugging, stored locally only)
-
-### iOS app
-
-The iOS app uses Firebase Cloud Messaging (via Apple Push Notification service) to deliver notifications. 
-The app stores the following data locally on your device:
-
-- Subscribed topics
-- Cached notifications
-- User credentials (if configured)
-
-## Web application
-
-The ntfy web app is a static website that stores all data locally in your browser:
-
-- **IndexedDB** - Stores your subscriptions and cached notifications
-- **Local Storage** - Stores your preferences and session information
-
-No cookies are used for tracking. The web app does not have a backend beyond the ntfy API.
-
-## Data retention
-
-| Data type              | Retention period                                  |
-|------------------------|---------------------------------------------------|
-| Messages               | 12 hours (configurable by server operators)       |
-| Attachments            | 3 hours (configurable by server operators)        |
-| User accounts          | Until you delete your account                     |
-| Access tokens          | Until you revoke them or delete your account      |
-| Email addresses        | Until you remove them or delete your account      |
-| Phone numbers          | Until you remove them or delete your account      |
-| Web push subscriptions | 60 days of inactivity, then automatically removed |
-| Server logs            | Varies; debugging logs are typically temporary    |
-
-## Self-hosting
-
-If you prefer complete control over your data, you can [self-host your own ntfy server](install.md). 
-When self-hosting:
-
-- You control all data storage and retention
-- You can choose whether to use Firebase, Twilio, email delivery, or any other integrations
-- No data is shared with ntfy.sh or any third party (unless you configure those integrations)
-
-The server and all apps are fully open source:
-
-- Server: [github.com/binwiederhier/ntfy](https://github.com/binwiederhier/ntfy)
-- Android app: [github.com/binwiederhier/ntfy-android](https://github.com/binwiederhier/ntfy-android)
-- iOS app: [github.com/binwiederhier/ntfy-ios](https://github.com/binwiederhier/ntfy-ios)
-
-## Data security
-
-- All connections to ntfy.sh are encrypted using TLS/HTTPS
-- Passwords are hashed using bcrypt before storage
-- Access tokens are generated using cryptographically secure random values
-- The server does not log message content by default
-
-## Your rights
-
-You have the right to:
-
-- **Access** - View your account information and data
-- **Delete** - Delete your account and associated data via the web app
-- **Export** - Your messages are available via the API while cached
-
-To delete your account, use the account settings in the web app or contact us.
-
-## Changes to this policy
-
-We may update this privacy policy from time to time. Changes will be posted on this page with an updated 
-"Last updated" date. You may also review all changes in the [Git history](https://github.com/binwiederhier/ntfy/commits/main/docs/privacy.md). 
-
-For significant changes, we may provide additional notice on Discord/Matrix or through the
-[announcements](https://ntfy.sh/announcements) ntfy topic.
-
-## Contact
-
-For privacy-related inquiries, please email [privacy@mail.ntfy.sh](mailto:privacy@mail.ntfy.sh).
-
-For all other contact options, see the [contact page](contact.md).
+For debugging purposes, the ntfy server may temporarily log request paths, remote IP addresses or even topics 
+or messages, though typically this is turned off.