Merge branch 'main' into e2e

.dockerignore

@@ -1,3 +0,0 @@
-dist
-*/node_modules
-Dockerfile*

.git-blame-ignore-revs

@@ -1,11 +0,0 @@
-# https://docs.github.com/en/repositories/working-with-files/using-files/viewing-a-file#ignore-commits-in-the-blame-view
-
-# Run prettier (https://github.com/binwiederhier/ntfy/pull/746)
-6f6a2d1f693070bf72e89d86748080e4825c9164
-c87549e71a10bc789eac8036078228f06e515a8e
-ca5d736a7169eb6b4b0d849e061d5bf9565dcc53
-2e27f58963feb9e4d1c573d4745d07770777fa7d
-
-# Run eslint (https://github.com/binwiederhier/ntfy/pull/748)
-f558b4dbe9bb5b9e0e87fada1215de2558353173
-8319f1cf26113167fb29fe12edaff5db74caf35f

.github/FUNDING.yml

@@ -1,2 +1 @@
 github: [binwiederhier]
-liberapay: ntfy

.github/ISSUE_TEMPLATE/1_bug_report.md

@@ -1,26 +0,0 @@
----
-name: 🐛 Bug Report
-about: Report any errors and problems
-title: ''
-labels: '🪲 bug'
-assignees: ''
-
----
-
-:lady_beetle: **Describe the bug**
-<!-- A clear and concise description of the problem. -->
-
-:computer: **Components impacted**
-<!-- ntfy server, Android app, iOS app, web app  -->
-
-:bulb: **Screenshots and/or logs**
-<!-- 
-If applicable, add screenshots or share logs help explain your problem.
-To get logs from the ...
-- ntfy server: Enable "log-level: trace" in your server.yml file
-- Android app: Go to "Settings" -> "Record logs", then eventually "Copy/upload logs"
-- web app: Press "F12" and find the "Console" window 
--->
-
-:crystal_ball: **Additional context**
-<!-- Add any other context about the problem here. -->

.github/ISSUE_TEMPLATE/2_enhancement_request.md

@@ -1,26 +0,0 @@
----
-name: 💡 Feature/Enhancement Request
-about: Got a great idea? Let us know!
-title: ''
-labels: 'enhancement'
-assignees: ''
-
----
-
-<!--
-
-Before you submit, consider asking on Discord/Matrix instead. You'll usually get an answer
-sooner, and there are more people there to help!
-
-- Discord: https://discord.gg/cT7ECsZj9w
-- Matrix: https://matrix.to/#/#ntfy:matrix.org / https://matrix.to/#/#ntfy-space:matrix.org
-
--->
-
-:bulb: **Idea**
-<!-- Share your thoughts; try to be detailed if you can -->
-
-:computer: **Target components**
-<!-- Where should this feature/enhancement be added? -->
-<!-- e.g. ntfy server, Android app, iOS app, web app -->
-

.github/ISSUE_TEMPLATE/3_tech_support.md

@@ -1,21 +0,0 @@
----
-name: 🆘 I need help with ...
-about: Installing ntfy, configuring the app, etc.
-title: ''
-labels: 'tech-support'
-assignees: ''
-
----
-
-
-<!--
-
-STOP! 
-
-This is not the right place to ask for help. Consider asking on Discord/Matrix instead. 
-You'll usually get an answer sooner, and there are more people there to help!
-
-- Discord: https://discord.gg/cT7ECsZj9w
-- Matrix: https://matrix.to/#/#ntfy:matrix.org / https://matrix.to/#/#ntfy-space:matrix.org
-
--->

.github/ISSUE_TEMPLATE/4_question.md

@@ -1,21 +0,0 @@
----
-name: ❓ Question
-about: Ask a question about ntfy
-title: ''
-labels: 'question'
-assignees: ''
-
----
-
-<!--
-
-Before you submit, consider asking on Discord/Matrix instead. You'll usually get an answer
-sooner, and there are more people there to help!
-
-- Discord: https://discord.gg/cT7ECsZj9w
-- Matrix: https://matrix.to/#/#ntfy:matrix.org / https://matrix.to/#/#ntfy-space:matrix.org
-
--->
-
-:question: **Question**
-<!-- Go ahead and ask your question here :) -->

.github/dependabot.yml

@@ -1,26 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "npm"
-    directory: "/web"
-    schedule:
-      interval: "weekly"
-    cooldown:
-      default-days: 7
-
-  - package-ecosystem: "gomod"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    cooldown:
-      default-days: 7
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    cooldown:
-      default-days: 7
-    groups:
-      all:
-        patterns:
-          - "*"

.github/workflows/build.yaml

@@ -1,27 +1,39 @@
 name: build
-on:
-  push:
-    branches: [ main ]
-  pull_request:
+on: [push, pull_request]
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      -
+        name: Install Go
+        uses: actions/setup-go@v2
         with:
-          go-version-file: '.go-version'
-      - name: Install node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+          go-version: '1.18.x'
+      -
+        name: Install node
+        uses: actions/setup-node@v2
         with:
-          node-version: '24'
-          cache: 'npm'
-          cache-dependency-path: './web/package-lock.json'
-      - name: Install dependencies
+          node-version: '17'
+      -
+        name: Checkout code
+        uses: actions/checkout@v2
+      -
+        name: Cache Go and npm modules
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/go/bin
+            ~/.npm
+            web/node_modules
+          key: ${{ runner.os }}-ntfy-${{ hashFiles('**/go.sum', '**/package.lock') }}
+          restore-keys: ${{ runner.os }}-ntfy-
+      -
+        name: Install dependencies
         run: make build-deps-ubuntu
-      - name: Build all the things
+      -
+        name: Build all the things
         run: make build
-      - name: Print build results and checksums
+      -
+        name: Print build results and checksums
         run: make cli-build-results

.github/workflows/docs.yaml

@@ -1,36 +0,0 @@
-name: docs
-on:
-  push:
-    branches:
-      - main
-jobs:
-  publish-docs:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout ntfy code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Checkout docs pages code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: binwiederhier/ntfy-docs.github.io
-          path: build/ntfy-docs.github.io
-          token: ${{secrets.NTFY_DOCS_PUSH_TOKEN}}
-          # Expires after 1 year, re-generate via
-          # User -> Settings -> Developer options -> Personal Access Tokens -> Fine Grained Token
-      -
-        name: Build docs
-        run: make docs
-      -
-        name: Copy generated docs
-        run: rsync -av --exclude CNAME --delete server/docs/ build/ntfy-docs.github.io/docs/
-      -
-        name: Publish docs
-        run: |
-          cd build/ntfy-docs.github.io
-          git config user.name "GitHub Actions Bot"
-          git config user.email "<actions@github.com>"          
-          git add docs/
-          git commit -m "Updated docs"
-          git push origin main

.github/workflows/release.yaml

@@ -6,46 +6,45 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:17
-        env:
-          POSTGRES_USER: ntfy
-          POSTGRES_PASSWORD: ntfy
-          POSTGRES_DB: ntfy_test
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U ntfy"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-    env:
-      NTFY_TEST_DATABASE_URL: "postgres://ntfy:ntfy@localhost:5432/ntfy_test?sslmode=disable"
-      NTFY_TEST_S3_URL: ${{ secrets.NTFY_TEST_S3_URL }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      -
+        name: Install Go
+        uses: actions/setup-go@v2
         with:
-          go-version-file: '.go-version'
-      - name: Install node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+          go-version: '1.18.x'
+      -
+        name: Install node
+        uses: actions/setup-node@v2
         with:
-          node-version: '24'
-          cache: 'npm'
-          cache-dependency-path: './web/package-lock.json'
-      - name: Docker login
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+          node-version: '17'
+      -
+        name: Checkout code
+        uses: actions/checkout@v2
+      -
+        name: Cache Go and npm modules
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/go/bin
+            ~/.npm
+            web/node_modules
+          key: ${{ runner.os }}-ntfy-${{ hashFiles('**/go.sum', '**/package.lock') }}
+          restore-keys: ${{ runner.os }}-ntfy-
+      -
+        name: Docker login
+        uses: docker/login-action@v2
         with:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
-      - name: Install dependencies
+      -
+        name: Install dependencies
         run: make build-deps-ubuntu
-      - name: Build and publish
+      -
+        name: Build and publish
         run: make release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Print build results and checksums
+      -
+        name: Print build results and checksums
         run: make cli-build-results

.github/workflows/test.yaml

@@ -1,48 +1,48 @@
 name: test
-on:
-  push:
-    branches: [ main ]
-  pull_request:
+on: [push, pull_request]
 jobs:
   test:
     runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:17
-        env:
-          POSTGRES_USER: ntfy
-          POSTGRES_PASSWORD: ntfy
-          POSTGRES_DB: ntfy_test
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U ntfy"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-    env:
-      NTFY_TEST_DATABASE_URL: "postgres://ntfy:ntfy@localhost:5432/ntfy_test?sslmode=disable"
-      NTFY_TEST_S3_URL: ${{ secrets.NTFY_TEST_S3_URL }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      -
+        name: Install Go
+        uses: actions/setup-go@v2
         with:
-          go-version-file: '.go-version'
-      - name: Install node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+          go-version: '1.18.x'
+      -
+        name: Install node
+        uses: actions/setup-node@v2
         with:
-          node-version: '24'
-          cache: 'npm'
-          cache-dependency-path: './web/package-lock.json'
-      - name: Install dependencies
+          node-version: '17'
+      -
+        name: Checkout code
+        uses: actions/checkout@v2
+      -
+        name: Cache Go and npm modules
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/go/bin
+            ~/.npm
+            web/node_modules
+          key: ${{ runner.os }}-ntfy-${{ hashFiles('**/go.sum', '**/package.lock') }}
+          restore-keys: ${{ runner.os }}-ntfy-
+      -
+        name: Install dependencies
         run: make build-deps-ubuntu
-      - name: Build docs (required for tests)
+      -
+        name: Build docs (required for tests)
         run: make docs
-      - name: Build web app (required for tests)
+      -
+        name: Build web app (required for tests)
         run: make web
-      - name: Run tests, formatting, vetting and linting
-        run: make checkv
-      - name: Run coverage
+      -
+        name: Run tests, formatting, vetting and linting
+        run: make check
+      -
+        name: Run coverage
         run: make coverage
+      -
+        name: Upload coverage to codecov.io
+        run: make coverage-upload

.gitignore

@@ -1,5 +1,4 @@
 dist/
-dev-dist/
 build/
 .idea/
 .vscode/
@@ -7,15 +6,8 @@ build/
 server/docs/
 server/site/
 tools/fbsend/fbsend
-tools/pgimport/pgimport
-tools/loadtest/loadtest
-tools/s3cli/s3cli
 playground/
 secrets/
 *.iml
 node_modules/
 .DS_Store
-__pycache__
-web/dev-dist/
-venv/
-cmd/key-file.yaml

.gitpod.yml

@@ -1,28 +0,0 @@
-tasks:
-  - name: docs
-    before: make docs-deps
-    command: mkdocs serve
-  - name: binary
-    before: |
-      npm install --global nodemon
-      make cli-deps-static-sites
-    command: |
-      nodemon --watch './**/*.go' --ext go --signal SIGTERM --exec "CGO_ENABLED=1 go run main.go serve --listen-http :2586 --debug --base-url $(gp url 2586)"
-    openMode: split-right
-  - name: web
-    before: make web-deps
-    command: cd web && npm start
-    openMode: split-right
-
-vscode:
-  extensions:
-    - golang.go
-    - ms-azuretools.vscode-docker
-
-ports:
-  - name: docs
-    port: 8000
-  - name: binary
-    port: 2586
-  - name: web
-    port: 3000

.go-version

@@ -1 +0,0 @@
-1.26.5

.goreleaser.yml

@@ -1,72 +1,83 @@
-version: 2
 before:
   hooks:
     - go mod download
     - go mod tidy
 builds:
-  - id: ntfy_linux_amd64
+  -
+    id: ntfy_linux_amd64
     binary: ntfy
     env:
       - CGO_ENABLED=1 # required for go-sqlite3
-    tags: [ sqlite_omit_load_extension,osusergo,netgo ]
+    tags: [sqlite_omit_load_extension,osusergo,netgo]
     ldflags:
       - "-linkmode=external -extldflags=-static -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
-    goos: [ linux ]
-    goarch: [ amd64 ]
-  - id: ntfy_linux_armv6
+    goos: [linux]
+    goarch: [amd64]
+    hooks:
+      post:
+        - upx "{{ .Path }}" # apt install upx
+  -
+    id: ntfy_linux_armv6
     binary: ntfy
     env:
       - CGO_ENABLED=1 # required for go-sqlite3
       - CC=arm-linux-gnueabi-gcc # apt install gcc-arm-linux-gnueabi
-    tags: [ sqlite_omit_load_extension,osusergo,netgo ]
+    tags: [sqlite_omit_load_extension,osusergo,netgo]
     ldflags:
       - "-linkmode=external -extldflags=-static -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
-    goos: [ linux ]
-    goarch: [ arm ]
-    goarm: [ 6 ]
-  - id: ntfy_linux_armv7
+    goos: [linux]
+    goarch: [arm]
+    goarm: [6]
+    # No "upx" for ARM, see https://github.com/binwiederhier/ntfy/issues/191#issuecomment-1083406546
+  -
+    id: ntfy_linux_armv7
     binary: ntfy
     env:
       - CGO_ENABLED=1 # required for go-sqlite3
       - CC=arm-linux-gnueabi-gcc # apt install gcc-arm-linux-gnueabi
-    tags: [ sqlite_omit_load_extension,osusergo,netgo ]
+    tags: [sqlite_omit_load_extension,osusergo,netgo]
     ldflags:
       - "-linkmode=external -extldflags=-static -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
-    goos: [ linux ]
-    goarch: [ arm ]
-    goarm: [ 7 ]
-  - id: ntfy_linux_arm64
+    goos: [linux]
+    goarch: [arm]
+    goarm: [7]
+    # No "upx" for ARM, see https://github.com/binwiederhier/ntfy/issues/191#issuecomment-1083406546
+  -
+    id: ntfy_linux_arm64
     binary: ntfy
     env:
       - CGO_ENABLED=1 # required for go-sqlite3
       - CC=aarch64-linux-gnu-gcc # apt install gcc-aarch64-linux-gnu
-    tags: [ sqlite_omit_load_extension,osusergo,netgo ]
+    tags: [sqlite_omit_load_extension,osusergo,netgo]
     ldflags:
       - "-linkmode=external -extldflags=-static -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
-    goos: [ linux ]
-    goarch: [ arm64 ]
-  - id: ntfy_windows_amd64
+    goos: [linux]
+    goarch: [arm64]
+    # No "upx" for ARM, see https://github.com/binwiederhier/ntfy/issues/191#issuecomment-1083406546
+  -
+    id: ntfy_windows_amd64
     binary: ntfy
     env:
-      - CGO_ENABLED=1 # required for go-sqlite3
-      - CC=x86_64-w64-mingw32-gcc # apt install gcc-mingw-w64-x86-64
-    tags: [ sqlite_omit_load_extension,osusergo,netgo ]
+      - CGO_ENABLED=0 # explicitly disable, since we don't need go-sqlite3
+    tags: [noserver] # don't include server files
     ldflags:
-      - "-s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
-    goos: [ windows ]
-    goarch: [amd64 ]
+      - "-X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
+    goos: [windows]
+    goarch: [amd64]
+    # No "upx" for Windows to hopefully avoid Virus warnings
   -
     id: ntfy_darwin_all
     binary: ntfy
     env:
       - CGO_ENABLED=0 # explicitly disable, since we don't need go-sqlite3
-    tags: [ noserver ] # don't include server files
+    tags: [noserver] # don't include server files
     ldflags:
       - "-X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
-    goos: [ darwin ]
-    goarch: [ amd64, arm64 ] # will be combined to "universal binary" (see below)
+    goos: [darwin]
+    goarch: [amd64, arm64] # will be combined to "universal binary" (see below)
 nfpms:
-  - package_name: ntfy
+  -
+    package_name: ntfy
     homepage: https://heckel.io/ntfy
     maintainer: Philipp C. Heckel <philipp.heckel@gmail.com>
     description: Simple pub-sub notification service
@@ -86,8 +97,6 @@ nfpms:
         type: "config|noreplace"
       - src: client/ntfy-client.service
         dst: /lib/systemd/system/ntfy-client.service
-      - src: client/user/ntfy-client.service
-        dst: /lib/systemd/user/ntfy-client.service
       - dst: /var/cache/ntfy
         type: dir
       - dst: /var/cache/ntfy/attachments
@@ -95,15 +104,16 @@ nfpms:
       - dst: /var/lib/ntfy
         type: dir
       - dst: /usr/share/ntfy/logo.png
-        src: web/public/static/images/ntfy.png
+        src: web/public/static/img/ntfy.png
     scripts:
       preinstall: "scripts/preinst.sh"
       postinstall: "scripts/postinst.sh"
       preremove: "scripts/prerm.sh"
       postremove: "scripts/postrm.sh"
 archives:
-  - id: ntfy_linux
-    ids:
+  -
+    id: ntfy_linux
+    builds:
       - ntfy_linux_amd64
       - ntfy_linux_armv6
       - ntfy_linux_armv7
@@ -116,32 +126,40 @@ archives:
       - server/ntfy.service
       - client/client.yml
       - client/ntfy-client.service
-      - client/user/ntfy-client.service
-  - id: ntfy_windows
-    ids:
+    replacements:
+      amd64: x86_64
+  -
+    id: ntfy_windows
+    builds:
       - ntfy_windows_amd64
-    formats: [ zip ]
+    format: zip
     wrap_in_directory: true
     files:
       - LICENSE
       - README.md
       - client/client.yml
-  - id: ntfy_darwin
-    ids:
+    replacements:
+      amd64: x86_64
+  -
+    id: ntfy_darwin
+    builds:
       - ntfy_darwin_all
     wrap_in_directory: true
     files:
       - LICENSE
       - README.md
       - client/client.yml
+    replacements:
+      darwin: macOS
 universal_binaries:
-  - id: ntfy_darwin_all
+  -
+    id: ntfy_darwin_all
     replace: true
     name_template: ntfy
 checksum:
   name_template: 'checksums.txt'
 snapshot:
-  version_template: "{{ .Tag }}-next"
+  name_template: "{{ .Tag }}-next"
 changelog:
   sort: asc
   filters:
@@ -159,14 +177,14 @@ dockers:
   - image_templates:
       - &arm64v8_image "binwiederhier/ntfy:{{ .Tag }}-arm64v8"
     use: buildx
-    dockerfile: Dockerfile-arm
+    dockerfile: Dockerfile
     goarch: arm64
     build_flag_templates:
       - "--platform=linux/arm64/v8"
   - image_templates:
       - &armv7_image "binwiederhier/ntfy:{{ .Tag }}-armv7"
     use: buildx
-    dockerfile: Dockerfile-arm
+    dockerfile: Dockerfile
     goarch: arm
     goarm: 7
     build_flag_templates:
@@ -174,7 +192,7 @@ dockers:
   - image_templates:
       - &armv6_image "binwiederhier/ntfy:{{ .Tag }}-armv6"
     use: buildx
-    dockerfile: Dockerfile-arm
+    dockerfile: Dockerfile
     goarch: arm
     goarm: 6
     build_flag_templates:
@@ -192,15 +210,3 @@ docker_manifests:
       - *arm64v8_image
       - *armv7_image
       - *armv6_image
-  - name_template: "binwiederhier/ntfy:v{{ .Major }}"
-    image_templates:
-      - *amd64_image
-      - *arm64v8_image
-      - *armv7_image
-      - *armv6_image
-  - name_template: "binwiederhier/ntfy:v{{ .Major }}.{{ .Minor }}"
-    image_templates:
-      - *amd64_image
-      - *arm64v8_image
-      - *armv7_image
-      - *armv6_image

CODE_OF_CONDUCT.md

@@ -1,133 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, caste, color, religion, or sexual
-identity and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our
-community include:
-
-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the overall
-  community
-
-Examples of unacceptable behavior include:
-
-* The use of sexualized language or imagery, and sexual attention or advances of
-  any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email address,
-  without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
-
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement via Discord/Matrix (binwiederhier),
-or email (contact@mail.ntfy.sh). All complaints will be reviewed and investigated promptly 
-and fairly.
-
-All community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-## Enforcement Guidelines
-
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series of
-actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or permanent
-ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior, harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
-
-**Consequence**: A permanent ban from any sort of public interaction within the
-community.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.1, available at
-[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
-
-Community Impact Guidelines were inspired by
-[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
-
-For answers to common questions about this code of conduct, see the FAQ at
-[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
-[https://www.contributor-covenant.org/translations][translations].
-
-[homepage]: https://www.contributor-covenant.org
-[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
-[Mozilla CoC]: https://github.com/mozilla/diversity
-[FAQ]: https://www.contributor-covenant.org/faq
-[translations]: https://www.contributor-covenant.org/translations
-

Dockerfile

@@ -1,15 +1,6 @@
 FROM alpine
+MAINTAINER Philipp C. Heckel <philipp.heckel@gmail.com>
 
-LABEL org.opencontainers.image.authors="philipp.heckel@gmail.com"
-LABEL org.opencontainers.image.url="https://ntfy.sh/"
-LABEL org.opencontainers.image.documentation="https://docs.ntfy.sh/"
-LABEL org.opencontainers.image.source="https://github.com/binwiederhier/ntfy"
-LABEL org.opencontainers.image.vendor="Philipp C. Heckel"
-LABEL org.opencontainers.image.licenses="Apache-2.0, GPL-2.0"
-LABEL org.opencontainers.image.title="ntfy"
-LABEL org.opencontainers.image.description="Send push notifications to your phone or desktop using PUT/POST"
-
-RUN apk add --no-cache tzdata
 COPY ntfy /usr/bin
 
 EXPOSE 80/tcp

Dockerfile-arm

@@ -1,18 +0,0 @@
-FROM alpine
-
-LABEL org.opencontainers.image.authors="philipp.heckel@gmail.com"
-LABEL org.opencontainers.image.url="https://ntfy.sh/"
-LABEL org.opencontainers.image.documentation="https://docs.ntfy.sh/"
-LABEL org.opencontainers.image.source="https://github.com/binwiederhier/ntfy"
-LABEL org.opencontainers.image.vendor="Philipp C. Heckel"
-LABEL org.opencontainers.image.licenses="Apache-2.0, GPL-2.0"
-LABEL org.opencontainers.image.title="ntfy"
-LABEL org.opencontainers.image.description="Send push notifications to your phone or desktop using PUT/POST"
-
-# Alpine does not support adding "tzdata" on ARM anymore, see
-# https://github.com/binwiederhier/ntfy/issues/894
-
-COPY ntfy /usr/bin
-
-EXPOSE 80/tcp
-ENTRYPOINT ["ntfy"]

Dockerfile-build

@@ -1,73 +0,0 @@
-FROM golang:1.25-bookworm AS builder
-
-ARG VERSION=dev
-ARG COMMIT=unknown
-ARG NODE_MAJOR=24
-
-RUN apt-get update && apt-get install -y \
-       build-essential ca-certificates curl gnupg \
-    && mkdir -p /etc/apt/keyrings \
-    && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
-    && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" >> /etc/apt/sources.list.d/nodesource.list \
-    && apt-get update \
-    && apt-get install -y \
-      python3-pip \
-      python3-venv \
-      nodejs \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /app
-ADD Makefile .
-
-# docs
-ADD ./requirements.txt .
-RUN --mount=type=cache,target=/root/.cache/pip make docs-deps
-ADD ./mkdocs.yml .
-ADD ./docs ./docs
-RUN make docs-build
-
-# web
-ADD ./web/package.json ./web/package-lock.json ./web/
-RUN --mount=type=cache,target=/root/.npm make web-deps
-ADD ./web ./web
-RUN make web-build
-
-# cli & server
-ADD go.mod go.sum main.go ./
-ADD ./client ./client
-ADD ./cmd ./cmd
-ADD ./log ./log
-ADD ./server ./server
-ADD ./user ./user
-ADD ./util ./util
-ADD ./payments ./payments
-ADD ./db ./db
-ADD ./message ./message
-ADD ./model ./model
-ADD ./webpush ./webpush
-ADD ./attachment ./attachment
-ADD ./mail ./mail
-ADD ./s3 ./s3
-ADD ./action ./action
-ADD ./template/gotext ./template/gotext
-
-RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build make VERSION=$VERSION COMMIT=$COMMIT cli-linux-server
-
-FROM alpine
-
-ARG VERSION=dev
-
-LABEL org.opencontainers.image.authors="philipp.heckel@gmail.com"
-LABEL org.opencontainers.image.url="https://ntfy.sh/"
-LABEL org.opencontainers.image.documentation="https://docs.ntfy.sh/"
-LABEL org.opencontainers.image.source="https://github.com/binwiederhier/ntfy"
-LABEL org.opencontainers.image.vendor="Philipp C. Heckel"
-LABEL org.opencontainers.image.licenses="Apache-2.0, GPL-2.0"
-LABEL org.opencontainers.image.title="ntfy"
-LABEL org.opencontainers.image.description="Send push notifications to your phone or desktop using PUT/POST"
-LABEL org.opencontainers.image.version="$VERSION"
-
-COPY --from=builder /app/dist/ntfy_linux_server/ntfy /usr/bin/ntfy
-
-EXPOSE 80/tcp
-ENTRYPOINT ["ntfy"]

Makefile

@@ -1,13 +1,8 @@
 MAKEFLAGS := --jobs=1
-NPM := npm
-PYTHON := python3
-PIP := pip3
 VERSION := $(shell git describe --tag)
 COMMIT := $(shell git rev-parse --short HEAD)
 
-# FORCE is an always-out-of-date target with no recipe; listing it as a prerequisite
-# forces that target's recipe to run every time (the classic "FORCE target" idiom).
-FORCE:
+.PHONY:
 
 help:
 	@echo "Typical commands (more see below):"
@@ -34,20 +29,12 @@ help:
 	@echo "Build server & client (without GoReleaser):"
 	@echo "  make cli-linux-server           - Build client & server (no GoReleaser, current arch, Linux)"
 	@echo "  make cli-darwin-server          - Build client & server (no GoReleaser, current arch, macOS)"
-	@echo "  make cli-windows-server         - Build client & server (no GoReleaser, amd64 only, Windows)"
 	@echo "  make cli-client                 - Build client only (no GoReleaser, current arch, Linux/macOS/Windows)"
 	@echo
-	@echo "Build dev Docker:"
-	@echo "  make docker-dev                 - Build client & server for current architecture using Docker only"
-	@echo
 	@echo "Build web app:"
 	@echo "  make web                        - Build the web app"
 	@echo "  make web-deps                   - Install web app dependencies (npm install the universe)"
 	@echo "  make web-build                  - Actually build the web app"
-	@echo "  make web-lint                   - Run eslint on the web app"
-	@echo "  make web-test                   - Run vitest unit tests for the web app"
-	@echo "  make web-fmt                    - Run prettier on the web app"
-	@echo "  make web-fmt-check              - Run prettier on the web app, but don't change anything"
 	@echo
 	@echo "Build documentation:"
 	@echo "  make docs                       - Build the documentation"
@@ -55,9 +42,7 @@ help:
 	@echo "  make docs-build                 - Actually build the documentation"
 	@echo
 	@echo "Test/check:"
-	@echo "  make test                       - Run all tests (Go + web)"
-	@echo "  make cli-test                   - Run Go tests only"
-	@echo "  make web-test                   - Run web app tests only"
+	@echo "  make test                       - Run tests"
 	@echo "  make race                       - Run tests with -race flag"
 	@echo "  make coverage                   - Run tests and show coverage"
 	@echo "  make coverage-html              - Run tests and show coverage (as HTML)"
@@ -87,54 +72,49 @@ help:
 
 # Building everything
 
-clean: FORCE
+clean: .PHONY
 	rm -rf dist build server/docs server/site
 
 build: web docs cli
 
-update: web-deps-update cli-deps-update docs-deps-update go-check
+update: web-deps-update cli-deps-update docs-deps-update
 	docker pull alpine
 
-docker-dev:
-	docker build \
-		--file ./Dockerfile-build \
-		--tag binwiederhier/ntfy:$(VERSION) \
-		--tag binwiederhier/ntfy:dev \
-		--build-arg VERSION=$(VERSION) \
-		--build-arg COMMIT=$(COMMIT) \
-		./
-
-
 # Ubuntu-specific
 
 build-deps-ubuntu:
-	sudo apt-get update
-	sudo apt-get install -y \
+	sudo apt update
+	sudo apt install -y \
 		curl \
 		gcc-aarch64-linux-gnu \
 		gcc-arm-linux-gnueabi \
-		gcc-mingw-w64-x86-64 \
-		python3 \
-		python3-venv \
+		upx \
 		jq
-	which pip3 || sudo apt-get install -y python3-pip
-
+	which pip3 || sudo apt install -y python3-pip
 
 # Documentation
 
 docs: docs-deps docs-build
 
-docs-venv: FORCE
-	$(PYTHON) -m venv ./venv
+docs-build: .PHONY
+	@if ! /bin/echo -e "import sys\nif sys.version_info < (3,8):\n exit(1)" | python3; then \
+	  if which python3.8; then \
+	  	echo "python3.8 $(shell which mkdocs) build"; \
+	    python3.8 $(shell which mkdocs) build; \
+	  else \
+	    echo "ERROR: Python version too low. mkdocs-material needs >= 3.8"; \
+	    exit 1; \
+	  fi; \
+	else \
+	  echo "mkdocs build"; \
+	  mkdocs build; \
+	fi
 
-docs-build: docs-venv
-	(. venv/bin/activate && $(PYTHON) -m mkdocs build)
+docs-deps: .PHONY
+	pip3 install -r requirements.txt
 
-docs-deps: docs-venv
-	(. venv/bin/activate && $(PIP) install -r requirements.txt)
-
-docs-deps-update: FORCE
-	(. venv/bin/activate && $(PIP) install -r requirements.txt --upgrade)
+docs-deps-update: .PHONY
+	pip3 install -r requirements.txt --upgrade
 
 
 # Web app
@@ -143,56 +123,44 @@ web: web-deps web-build
 
 web-build:
 	cd web \
-		&& $(NPM) run build \
+		&& npm run build \
 		&& mv build/index.html build/app.html \
 		&& rm -rf ../server/site \
 		&& mv build ../server/site \
 		&& rm \
-			../server/site/config.js
+			../server/site/config.js \
+			../server/site/asset-manifest.json
 
 web-deps:
-	cd web && $(NPM) ci
-	# Use "npm ci" so that we don't change the package lock file
+	cd web && npm install
 	# If this fails for .svg files, optimize them with svgo
 
 web-deps-update:
-	cd web && $(NPM) update --before="$(shell date -d '7 days ago' +%Y-%m-%d)"
-	cd web && $(NPM) install
+	cd web && npm update
 
-web-fmt:
-	cd web && $(NPM) run format
-
-web-fmt-check:
-	cd web && $(NPM) run format:check
-
-web-lint:
-	cd web && $(NPM) run lint
-
-web-test:
-	cd web && $(NPM) run test
 
 # Main server/client build
 
 cli: cli-deps
-	goreleaser build --snapshot --clean
+	goreleaser build --snapshot --rm-dist
 
 cli-linux-amd64: cli-deps-static-sites
-	goreleaser build --snapshot --clean --id ntfy_linux_amd64
+	goreleaser build --snapshot --rm-dist --id ntfy_linux_amd64
 
 cli-linux-armv6: cli-deps-static-sites cli-deps-gcc-armv6-armv7
-	goreleaser build --snapshot --clean --id ntfy_linux_armv6
+	goreleaser build --snapshot --rm-dist --id ntfy_linux_armv6
 
 cli-linux-armv7: cli-deps-static-sites cli-deps-gcc-armv6-armv7
-	goreleaser build --snapshot --clean --id ntfy_linux_armv7
+	goreleaser build --snapshot --rm-dist --id ntfy_linux_armv7
 
 cli-linux-arm64: cli-deps-static-sites cli-deps-gcc-arm64
-	goreleaser build --snapshot --clean --id ntfy_linux_arm64
+	goreleaser build --snapshot --rm-dist --id ntfy_linux_arm64
 
 cli-windows-amd64: cli-deps-static-sites
-	goreleaser build --snapshot --clean --id ntfy_windows_amd64
+	goreleaser build --snapshot --rm-dist --id ntfy_windows_amd64
 
 cli-darwin-all: cli-deps-static-sites
-	goreleaser build --snapshot --clean --id ntfy_darwin_all
+	goreleaser build --snapshot --rm-dist --id ntfy_darwin_all
 
 cli-linux-server: cli-deps-static-sites
 	# This is a target to build the CLI (including the server) manually.
@@ -214,16 +182,6 @@ cli-darwin-server: cli-deps-static-sites
 		-ldflags \
 		"-linkmode=external -s -w -X main.version=$(VERSION) -X main.commit=$(COMMIT) -X main.date=$(shell date +%s)"
 
-cli-windows-server: cli-deps-static-sites
-	# This is a target to build the CLI (including the server) for Windows.
-	# Use this for Windows development, if you really don't want to install GoReleaser ...
-	mkdir -p dist/ntfy_windows_server server/docs
-	CC=x86_64-w64-mingw32-gcc GOOS=windows GOARCH=amd64 CGO_ENABLED=1 go build \
-		-o dist/ntfy_windows_server/ntfy.exe \
-		-tags sqlite_omit_load_extension,osusergo,netgo \
-		-ldflags \
-		"-s -w -X main.version=$(VERSION) -X main.commit=$(COMMIT) -X main.date=$(shell date +%s)"
-
 cli-client: cli-deps-static-sites
 	# This is a target to build the CLI (excluding the server) manually. This should work on Linux/macOS/Windows.
 	# Use this for development, if you really don't want to install GoReleaser ...
@@ -236,14 +194,15 @@ cli-client: cli-deps-static-sites
 
 cli-deps: cli-deps-static-sites cli-deps-all cli-deps-gcc
 
-cli-deps-gcc: cli-deps-gcc-armv6-armv7 cli-deps-gcc-arm64 cli-deps-gcc-windows
+cli-deps-gcc: cli-deps-gcc-armv6-armv7 cli-deps-gcc-arm64
 
 cli-deps-static-sites:
 	mkdir -p server/docs server/site
 	touch server/docs/index.html server/site/app.html
 
 cli-deps-all:
-	go install github.com/goreleaser/goreleaser/v2@latest
+	which upx || { echo "ERROR: upx not installed. On Ubuntu, run: apt install upx"; exit 1; }
+	go install github.com/goreleaser/goreleaser@latest
 
 cli-deps-gcc-armv6-armv7:
 	which arm-linux-gnueabi-gcc || { echo "ERROR: ARMv6/ARMv7 cross compiler not installed. On Ubuntu, run: apt install gcc-arm-linux-gnueabi"; exit 1; }
@@ -251,15 +210,11 @@ cli-deps-gcc-armv6-armv7:
 cli-deps-gcc-arm64:
 	which aarch64-linux-gnu-gcc || { echo "ERROR: ARM64 cross compiler not installed. On Ubuntu, run: apt install gcc-aarch64-linux-gnu"; exit 1; }
 
-cli-deps-gcc-windows:
-	which x86_64-w64-mingw32-gcc || { echo "ERROR: Windows cross compiler not installed. On Ubuntu, run: apt install gcc-mingw-w64-x86-64"; exit 1; }
-
 cli-deps-update:
 	go get -u
-	go mod tidy
 	go install honnef.co/go/tools/cmd/staticcheck@latest
 	go install golang.org/x/lint/golint@latest
-	go install github.com/goreleaser/goreleaser/v2@latest
+	go install github.com/goreleaser/goreleaser@latest
 
 cli-build-results:
 	cat dist/config.yaml
@@ -273,31 +228,22 @@ cli-build-results:
 
 # Test/check targets
 
-check: test web-fmt-check fmt-check vet web-lint lint staticcheck template-check go-check
+check: test fmt-check vet lint staticcheck
 
-checkv: testv web-fmt-check fmt-check vet web-lint lint staticcheck template-check go-check
+test: .PHONY
+	go test -v $(shell go list ./... | grep -vE 'ntfy/(test|examples|tools)')
 
-test: cli-test web-test
-
-testv: cli-testv web-test
-
-cli-test: FORCE
-	go test $(shell go list -f '{{if .TestGoFiles}}{{.ImportPath}}{{end}}' ./... | grep -vE 'ntfy/v2/(test|examples|tools)')
-
-cli-testv: FORCE
-	go test -v $(shell go list -f '{{if .TestGoFiles}}{{.ImportPath}}{{end}}' ./... | grep -vE 'ntfy/v2/(test|examples|tools)')
-
-race: FORCE
-	go test -v -race $(shell go list -f '{{if .TestGoFiles}}{{.ImportPath}}{{end}}' ./... | grep -vE 'ntfy/v2/(test|examples|tools)')
+race: .PHONY
+	go test -race $(shell go list ./... | grep -vE 'ntfy/(test|examples|tools)')
 
 coverage:
 	mkdir -p build/coverage
-	go test -v -race -coverprofile=build/coverage/coverage.txt -covermode=atomic $(shell go list -f '{{if .TestGoFiles}}{{.ImportPath}}{{end}}' ./... | grep -vE 'ntfy/v2/(test|examples|tools|web)')
+	go test -race -coverprofile=build/coverage/coverage.txt -covermode=atomic $(shell go list ./... | grep -vE 'ntfy/(test|examples|tools)')
 	go tool cover -func build/coverage/coverage.txt
 
 coverage-html:
 	mkdir -p build/coverage
-	go test -race -coverprofile=build/coverage/coverage.txt -covermode=atomic $(shell go list -f '{{if .TestGoFiles}}{{.ImportPath}}{{end}}' ./... | grep -vE 'ntfy/v2/(test|examples|tools)')
+	go test -race -coverprofile=build/coverage/coverage.txt -covermode=atomic $(shell go list ./... | grep -vE 'ntfy/(test|examples|tools)')
 	go tool cover -html build/coverage/coverage.txt
 
 coverage-upload:
@@ -306,7 +252,7 @@ coverage-upload:
 
 # Lint/formatting targets
 
-fmt: web-fmt
+fmt:
 	gofmt -s -w .
 
 fmt-check:
@@ -317,87 +263,27 @@ vet:
 
 lint:
 	which golint || go install golang.org/x/lint/golint@latest
-	go list ./... | grep -v /vendor/ | grep -vE 'ntfy/v2/template/gotext' | xargs -L1 golint -set_exit_status
+	go list ./... | grep -v /vendor/ | xargs -L1 golint -set_exit_status
 
-staticcheck: FORCE
+staticcheck: .PHONY
 	rm -rf build/staticcheck
 	which staticcheck || go install honnef.co/go/tools/cmd/staticcheck@latest
 	mkdir -p build/staticcheck
 	ln -s "go" build/staticcheck/go
-	PATH="$(PWD)/build/staticcheck:$(PATH)" staticcheck $$(go list ./... | grep -vE 'ntfy/v2/template/gotext')
+	PATH="$(PWD)/build/staticcheck:$(PATH)" staticcheck ./...
 	rm -rf build/staticcheck
 
 
-# Vendored template targets (see template/README.md)
-
-TEMPLATE_GO_VERSION := go$(shell cat .go-version 2>/dev/null)
-
-update-template:
-	@if [ "$$(go env GOVERSION)" != "$(TEMPLATE_GO_VERSION)" ]; then \
-		echo "ERROR: local Go $$(go env GOVERSION) != $(TEMPLATE_GO_VERSION) pinned in .go-version."; \
-		echo "Bump .go-version and install that toolchain first: go install golang.org/dl/$(TEMPLATE_GO_VERSION)@latest && $(TEMPLATE_GO_VERSION) download"; \
-		exit 1; \
-	fi
-	src="$$(go env GOROOT)/src"; \
-	rm -f template/gotext/*.go template/gotext/fmtsort/*.go; \
-	for f in $$(go list -f '{{range .GoFiles}}{{.}} {{end}}' text/template); do cp "$$src/text/template/$$f" template/gotext/; done; \
-	for f in $$(go list -f '{{range .GoFiles}}{{.}} {{end}}' internal/fmtsort); do cp "$$src/internal/fmtsort/$$f" template/gotext/fmtsort/; done; \
-	sed -i 's/^package template$$/package gotext/' template/gotext/*.go; \
-	sed -i 's#"internal/fmtsort"#"heckel.io/ntfy/v2/template/gotext/fmtsort"#' template/gotext/*.go; \
-	( cd template/gotext && for p in patches/*.patch; do echo "Applying $$p"; git apply "$$p" || exit 1; done )
-	go env GOVERSION > template/gotext/GENERATED_FROM
-	@echo "Regenerated template/gotext/ from $(TEMPLATE_GO_VERSION) (files enumerated via 'go list'); review with 'git diff'."
-
-template-check: FORCE
-	@if [ "$$(cat template/gotext/GENERATED_FROM)" != "$(TEMPLATE_GO_VERSION)" ]; then \
-		echo "ERROR: template/gotext was generated from $$(cat template/gotext/GENERATED_FROM), but .go-version pins $(TEMPLATE_GO_VERSION). Run 'make update-template' on the pinned Go."; \
-		exit 1; \
-	fi
-	@if [ "$$(go env GOVERSION)" != "$(TEMPLATE_GO_VERSION)" ]; then \
-		echo "SKIP: local Go $$(go env GOVERSION) != pinned $(TEMPLATE_GO_VERSION); skipping vendored template content check (version marker already verified)."; \
-		exit 0; \
-	fi
-	@tmp=$$(mktemp -d); src="$$(go env GOROOT)/src"; \
-	mkdir -p "$$tmp/gotext/fmtsort"; \
-	for f in $$(go list -f '{{range .GoFiles}}{{.}} {{end}}' text/template); do cp "$$src/text/template/$$f" "$$tmp/gotext/"; done; \
-	for f in $$(go list -f '{{range .GoFiles}}{{.}} {{end}}' internal/fmtsort); do cp "$$src/internal/fmtsort/$$f" "$$tmp/gotext/fmtsort/"; done; \
-	sed -i 's/^package template$$/package gotext/' "$$tmp/gotext/"*.go; \
-	sed -i 's#"internal/fmtsort"#"heckel.io/ntfy/v2/template/gotext/fmtsort"#' "$$tmp/gotext/"*.go; \
-	cp template/gotext/patches/*.patch "$$tmp/"; \
-	( cd "$$tmp/gotext" && for p in "$$tmp"/*.patch; do git apply "$$p" || exit 1; done ); \
-	if diff -rq -x 'README.md' -x 'GENERATED_FROM' -x 'patches' "$$tmp/gotext" template/gotext >/dev/null 2>&1; then \
-		rm -rf "$$tmp"; \
-	else \
-		echo "ERROR: template/gotext/ drifted from GOROOT+patches (or its file set changed). Run 'make update-template' on Go $(TEMPLATE_GO_VERSION):"; \
-		diff -rq -x 'README.md' -x 'GENERATED_FROM' -x 'patches' "$$tmp/gotext" template/gotext; \
-		rm -rf "$$tmp"; exit 1; \
-	fi
-
-# go-check is advisory only (never fails): it warns when the pinned Go (.go-version) is behind the
-# latest upstream release, so template/gotext doesn't silently fall behind on text/template fixes.
-go-check: FORCE
-	@latest=$$(curl -s --max-time 10 'https://go.dev/VERSION?m=text' 2>/dev/null | head -1); \
-	if [ -n "$$latest" ] && [ "$$latest" != "$(TEMPLATE_GO_VERSION)" ]; then \
-		echo ""; \
-		echo "note: latest Go is $$latest, but template/gotext is pinned to $(TEMPLATE_GO_VERSION) (.go-version)."; \
-		echo "      to bump: install $$latest, set .go-version to $${latest#go}, then run 'make update-template'."; \
-	fi
-
-
 # Releasing targets
 
-release: clean cli-deps release-checks docs web check
-	goreleaser release --clean
+release: clean update cli-deps release-checks docs web check
+	goreleaser release --rm-dist
 
-release-snapshot: clean cli-deps docs web check
-	goreleaser release --snapshot --clean
+release-snapshot: clean update cli-deps docs web check
+	goreleaser release --snapshot --skip-publish --rm-dist
 
 release-checks:
 	$(eval LATEST_TAG := $(shell git describe --abbrev=0 --tags | cut -c2-))
-	if [ "$$(go env GOVERSION)" != "go$$(cat .go-version)" ]; then\
-		echo "ERROR: releases must use the pinned Go toolchain (go$$(cat .go-version) from .go-version), but this is $$(go env GOVERSION). This also ensures 'make check' enforces (not skips) the template/gotext drift check.";\
-		exit 1;\
-	fi
 	if ! grep -q $(LATEST_TAG) docs/install.md; then\
 	 	echo "ERROR: Must update docs/install.md with latest tag first.";\
 	 	exit 1;\

README.md

@@ -1,21 +1,16 @@
-<div align="center" markdown="1">
-<sup>Special thanks to:</sup>
-<br>
-<br>
-<a href="https://go.warp.dev/ntfy">
-  <img alt="Warp sponsorship" width="400" src="https://raw.githubusercontent.com/warpdotdev/brand-assets/refs/heads/main/Github/Sponsor/Warp-Github-LG-02.png">
-</a>
+![ntfy](web/public/static/img/ntfy.png)
 
-### [Warp, built for coding with multiple AI agents.](https://go.warp.dev/ntfy)
-[Available for MacOS, Linux, & Windows](https://go.warp.dev/ntfy)<br>
-</div>
-<hr>
+---
 
-![ntfy](web/public/static/images/ntfy.png)
+## 👶 Baby break - My baby girl was born!
+Hey folks, my daughter was born on 8/30/22, so I'll be taking some time off from working on ntfy. I'll likely return 
+to working on features and bugs in a few weeks. I hope you understand. I posted some pictures in [#387](https://github.com/binwiederhier/ntfy/issues/387) 🥰   
+
+---
 
 # ntfy.sh | Send push notifications to your phone or desktop via PUT/POST
 [![Release](https://img.shields.io/github/release/binwiederhier/ntfy.svg?color=success&style=flat-square)](https://github.com/binwiederhier/ntfy/releases/latest)
-[![Go Reference](https://pkg.go.dev/badge/heckel.io/ntfy.svg)](https://pkg.go.dev/heckel.io/ntfy/v2)
+[![Go Reference](https://pkg.go.dev/badge/heckel.io/ntfy.svg)](https://pkg.go.dev/heckel.io/ntfy)
 [![Tests](https://github.com/binwiederhier/ntfy/workflows/test/badge.svg)](https://github.com/binwiederhier/ntfy/actions)
 [![Go Report Card](https://goreportcard.com/badge/github.com/binwiederhier/ntfy)](https://goreportcard.com/report/github.com/binwiederhier/ntfy)
 [![codecov](https://codecov.io/gh/binwiederhier/ntfy/branch/main/graph/badge.svg?token=A597KQ463G)](https://codecov.io/gh/binwiederhier/ntfy)
@@ -23,37 +18,21 @@
 [![Matrix](https://img.shields.io/matrix/ntfy:matrix.org?label=Matrix)](https://matrix.to/#/#ntfy:matrix.org)
 [![Matrix space](https://img.shields.io/matrix/ntfy-space:matrix.org?label=Matrix+space)](https://matrix.to/#/#ntfy-space:matrix.org)
 [![Healthcheck](https://healthchecks.io/badge/68b65976-b3b0-4102-aec9-980921/kcoEgrLY.svg)](https://ntfy.statuspage.io/)
-[![Gitpod](https://img.shields.io/badge/Contribute%20with-Gitpod-908a85?logo=gitpod)](https://gitpod.io/#https://github.com/binwiederhier/ntfy)
 
-**ntfy** (pronounced "*notify*") is a simple HTTP-based [pub-sub](https://en.wikipedia.org/wiki/Publish%E2%80%93subscribe_pattern) 
-notification service. With ntfy, you can **send notifications to your phone or desktop via scripts** from any computer, 
-**without having to sign up or pay any fees**. If you'd like to run your own instance of the service, you can easily do 
-so since ntfy is open source.
+**ntfy** (pronounce: *notify*) is a simple HTTP-based [pub-sub](https://en.wikipedia.org/wiki/Publish%E2%80%93subscribe_pattern) notification service.
+It allows you to **send notifications to your phone or desktop via scripts** from any computer, entirely **without signup or cost**.
+It's also open source (as you can plainly see) if you want to run your own.
 
-You can access the free version of ntfy at **[ntfy.sh](https://ntfy.sh)**. There is also an [open-source Android app](https://github.com/binwiederhier/ntfy-android)
-available on [Google Play](https://play.google.com/store/apps/details?id=io.heckel.ntfy) or [F-Droid](https://f-droid.org/en/packages/io.heckel.ntfy/),
-as well as an [open source iOS app](https://github.com/binwiederhier/ntfy-ios) available on the [App Store](https://apps.apple.com/us/app/ntfy/id1625396347).
+I run a free version of it at **[ntfy.sh](https://ntfy.sh)**. There's also an [open source Android app](https://github.com/binwiederhier/ntfy-android) (see [Google Play](https://play.google.com/store/apps/details?id=io.heckel.ntfy) or [F-Droid](https://f-droid.org/en/packages/io.heckel.ntfy/)), and an [open source iOS app](https://github.com/binwiederhier/ntfy-ios) (see [App Store](https://apps.apple.com/us/app/ntfy/id1625396347)).
 
 <p>
-  <a href="https://play.google.com/store/apps/details?id=io.heckel.ntfy"><img height="50" src="docs/static/img/badge-googleplay.png"></a>
-  <a href="https://f-droid.org/en/packages/io.heckel.ntfy/"><img width="170" src="docs/static/img/badge-fdroid.svg"></a>
-  <a href="https://apps.apple.com/us/app/ntfy/id1625396347"><img height="50" src="docs/static/img/badge-appstore.png"></a>
+  <img src="web/public/static/img/screenshot-curl.png" height="180">
+  <img src="web/public/static/img/screenshot-web-detail.png" height="180">
+  <img src="web/public/static/img/screenshot-phone-main.jpg" height="180">
+  <img src="web/public/static/img/screenshot-phone-detail.jpg" height="180">
+  <img src="web/public/static/img/screenshot-phone-notification.jpg" height="180">
 </p>
 
-<p>
-  <img src=".github/images/screenshot-curl.png" height="180">
-  <img src=".github/images/screenshot-web-detail.png" height="180">
-  <img src=".github/images/screenshot-phone-main.jpg" height="180">
-  <img src=".github/images/screenshot-phone-detail.jpg" height="180">
-  <img src=".github/images/screenshot-phone-notification.jpg" height="180">
-</p>
-
-## [ntfy Pro](https://ntfy.sh/app) 💸 🎉
-I now offer paid plans for [ntfy.sh](https://ntfy.sh/) if you don't want to self-host, or you want to support the development of 
-ntfy (→ [Purchase via web app](https://ntfy.sh/app)). You can **buy a plan for as low as $5/month**.
-You can also donate via [GitHub Sponsors](https://github.com/sponsors/binwiederhier), and [Liberapay](https://liberapay.com/ntfy).
-I would be very humbled by your sponsorship. ❤️ 
-
 ## **[Documentation](https://ntfy.sh/docs/)**
 
 [Getting started](https://ntfy.sh/docs/) |
@@ -62,196 +41,45 @@ I would be very humbled by your sponsorship. ❤️
 [Install / Self-hosting](https://ntfy.sh/docs/install/) |
 [Building](https://ntfy.sh/docs/develop/)
 
-## Chat/forum
-There are a few ways to get in touch with me and/or the rest of the community. Feel free to use any of these methods. Whatever
-works best for you:
+## Chat
+You can directly contact me **[on Discord](https://discord.gg/cT7ECsZj9w)** or [on Matrix](https://matrix.to/#/#ntfy:matrix.org) 
+(bridged from Discord), or via the [GitHub issues](https://github.com/binwiederhier/ntfy/issues), or find more contact information
+[on my website](https://heckel.io/about).
 
-* [Discord server](https://discord.gg/cT7ECsZj9w) - direct chat with the community
-* [Matrix room #ntfy](https://matrix.to/#/#ntfy:matrix.org) (+ [Matrix space](https://matrix.to/#/#ntfy-space:matrix.org)) - same chat, bridged from Discord
-* [GitHub issues](https://github.com/binwiederhier/ntfy/issues) - questions, features, bugs
-
-## Announcements/beta testers
+## Announcements / beta testers
 For announcements of new releases and cutting-edge beta versions, please subscribe to the [ntfy.sh/announcements](https://ntfy.sh/announcements) 
 topic. If you'd like to test the iOS app, join [TestFlight](https://testflight.apple.com/join/P1fFnAm9). For Android betas,
 join Discord/Matrix (I'll eventually make a testing channel in Google Play).
 
-## Sponsors
-If you'd like to support the ntfy maintainers, please consider donating to [GitHub Sponsors](https://github.com/sponsors/binwiederhier) or
-and [Liberapay](https://liberapay.com/ntfy). We would be humbled if you helped carry the server and developer 
-account costs. Even small donations are very much appreciated. 
-
-Thank you to our commercial sponsors, who help keep the service running and the development going:
-
-<a href="https://m.do.co/c/442b929528db"><img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" width="201px"></a>
-
-<a href="https://go.warp.dev/ntfy"><img src="https://raw.githubusercontent.com/warpdotdev/brand-assets/refs/heads/main/Logos/Warp-Wordmark-Black.png" width="160px"></a>
-
-And a big fat **Thank You** to the individuals who have sponsored ntfy in the past, or are still sponsoring ntfy:
-
-<a href="https://github.com/neutralinsomniac"><img src="https://github.com/neutralinsomniac.png" width="40px" /></a>
-<a href="https://github.com/aspyct"><img src="https://github.com/aspyct.png" width="40px" /></a>
-<a href="https://github.com/nickexyz"><img src="https://github.com/nickexyz.png" width="40px" /></a>
-<a href="https://github.com/qcasey"><img src="https://github.com/qcasey.png" width="40px" /></a>
-<a href="https://github.com/mckay115"><img src="https://github.com/mckay115.png" width="40px" /></a>
-<a href="https://github.com/Salamafet"><img src="https://github.com/Salamafet.png" width="40px" /></a>
-<a href="https://github.com/codinghipster"><img src="https://github.com/codinghipster.png" width="40px" /></a>
-<a href="https://github.com/HinFort"><img src="https://github.com/HinFort.png" width="40px" /></a>
-<a href="https://github.com/Lexevolution"><img src="https://github.com/Lexevolution.png" width="40px" /></a>
-<a href="https://github.com/johnnyip"><img src="https://github.com/johnnyip.png" width="40px" /></a>
-<a href="https://github.com/JonDerThan"><img src="https://github.com/JonDerThan.png" width="40px" /></a>
-<a href="https://github.com/12nick12"><img src="https://github.com/12nick12.png" width="40px" /></a>
-<a href="https://github.com/eanplatter"><img src="https://github.com/eanplatter.png" width="40px" /></a>
-<a href="https://github.com/fnoelscher"><img src="https://github.com/fnoelscher.png" width="40px" /></a>
-<a href="https://github.com/bnorick"><img src="https://github.com/bnorick.png" width="40px" /></a>
-<a href="https://github.com/snh"><img src="https://github.com/snh.png" width="40px" /></a>
-<a href="https://github.com/hen-x"><img src="https://github.com/hen-x.png" width="40px" /></a>
-<a href="https://github.com/JamieGoodson"><img src="https://github.com/JamieGoodson.png" width="40px" /></a>
-<a href="https://github.com/cremesk"><img src="https://github.com/cremesk.png" width="40px" /></a>
-<a href="https://github.com/dangowans"><img src="https://github.com/dangowans.png" width="40px" /></a>
-<a href="https://github.com/mnault"><img src="https://github.com/mnault.png" width="40px" /></a>
-<a href="https://github.com/nwithan8"><img src="https://github.com/nwithan8.png" width="40px" /></a>
-<a href="https://github.com/peterleiser"><img src="https://github.com/peterleiser.png" width="40px" /></a>
-<a href="https://github.com/portothree"><img src="https://github.com/portothree.png" width="40px" /></a>
-<a href="https://github.com/finngreig"><img src="https://github.com/finngreig.png" width="40px" /></a>
-<a href="https://github.com/skrollme"><img src="https://github.com/skrollme.png" width="40px" /></a>
-<a href="https://github.com/gergepalfi"><img src="https://github.com/gergepalfi.png" width="40px" /></a>
-<a href="https://github.com/tonyakwei"><img src="https://github.com/tonyakwei.png" width="40px" /></a>
-<a href="https://github.com/crosbyh"><img src="https://github.com/crosbyh.png" width="40px" /></a>
-<a href="https://github.com/mdlnr"><img src="https://github.com/mdlnr.png" width="40px" /></a>
-<a href="https://github.com/p-samuel"><img src="https://github.com/p-samuel.png" width="40px" /></a>
-<a href="https://github.com/zugaldia"><img src="https://github.com/zugaldia.png" width="40px" /></a>
-<a href="https://github.com/NathanSweet"><img src="https://github.com/NathanSweet.png" width="40px" /></a>
-<a href="https://github.com/msdeibel"><img src="https://github.com/msdeibel.png" width="40px" /></a>
-<a href="https://github.com/ksurl"><img src="https://github.com/ksurl.png" width="40px" /></a>
-<a href="https://github.com/CodingTimeDEV"><img src="https://github.com/CodingTimeDEV.png" width="40px" /></a>
-<a href="https://github.com/Terrormixer3000"><img src="https://github.com/Terrormixer3000.png" width="40px" /></a>
-<a href="https://github.com/voroskoi"><img src="https://github.com/voroskoi.png" width="40px" /></a>
-<a href="https://github.com/Nickwasused"><img src="https://github.com/Nickwasused.png" width="40px" /></a>
-<a href="https://github.com/bahur142"><img src="https://github.com/bahur142.png" width="40px" /></a>
-<a href="https://github.com/vinhdizzo"><img src="https://github.com/vinhdizzo.png" width="40px" /></a>
-<a href="https://github.com/Ge0rg3"><img src="https://github.com/Ge0rg3.png" width="40px" /></a>
-<a href="https://github.com/biopsin"><img src="https://github.com/biopsin.png" width="40px" /></a>
-<a href="https://github.com/thebino"><img src="https://github.com/thebino.png" width="40px" /></a>
-<a href="https://github.com/sky4055"><img src="https://github.com/sky4055.png" width="40px" /></a>
-<a href="https://github.com/julianlam"><img src="https://github.com/julianlam.png" width="40px" /></a>
-<a href="https://github.com/andreapx"><img src="https://github.com/andreapx.png" width="40px" /></a>
-<a href="https://github.com/billycao"><img src="https://github.com/billycao.png" width="40px" /></a>
-<a href="https://github.com/zoic21"><img src="https://github.com/zoic21.png" width="40px" /></a>
-<a href="https://github.com/IanKulin"><img src="https://github.com/IanKulin.png" width="40px" /></a>
-<a href="https://github.com/Joachim256"><img src="https://github.com/Joachim256.png" width="40px" /></a>
-<a href="https://github.com/overtone1000"><img src="https://github.com/overtone1000.png" width="40px" /></a>
-<a href="https://github.com/oakd"><img src="https://github.com/oakd.png" width="40px" /></a>
-<a href="https://github.com/KucharczykL"><img src="https://github.com/KucharczykL.png" width="40px" /></a>
-<a href="https://github.com/hansbickhofe"><img src="https://github.com/hansbickhofe.png" width="40px" /></a>
-<a href="https://github.com/caseodilla"><img src="https://github.com/caseodilla.png" width="40px" /></a>
-<a href="https://github.com/0xAF"><img src="https://github.com/0xAF.png" width="40px" /></a>
-<a href="https://github.com/soonoo"><img src="https://github.com/soonoo.png" width="40px" /></a>
-<a href="https://github.com/nichu42"><img src="https://github.com/nichu42.png" width="40px" /></a>
-<a href="https://github.com/samliebow"><img src="https://github.com/samliebow.png" width="40px" /></a>
-<a href="https://github.com/johman10"><img src="https://github.com/johman10.png" width="40px" /></a>
-<a href="https://github.com/R-Gld"><img src="https://github.com/R-Gld.png" width="40px" /></a>
-<a href="https://github.com/FingerlessGlov3s"><img src="https://github.com/FingerlessGlov3s.png" width="40px" /></a>
-<a href="https://github.com/Twisterado"><img src="https://github.com/Twisterado.png" width="40px" /></a>
-<a href="https://github.com/ScrumpyJack"><img src="https://github.com/ScrumpyJack.png" width="40px" /></a>
-<a href="https://github.com/andrejarrell"><img src="https://github.com/andrejarrell.png" width="40px" /></a>
-<a href="https://github.com/oaustegard"><img src="https://github.com/oaustegard.png" width="40px" /></a>
-<a href="https://github.com/CreativeWarlock"><img src="https://github.com/CreativeWarlock.png" width="40px" /></a>
-<a href="https://github.com/darkdragon-001"><img src="https://github.com/darkdragon-001.png" width="40px" /></a>
-<a href="https://github.com/jonathan-kosgei"><img src="https://github.com/jonathan-kosgei.png" width="40px" /></a>
-<a href="https://github.com/KevinWang15"><img src="https://github.com/KevinWang15.png" width="40px" /></a>
-<a href="https://github.com/darkmattercoder"><img src="https://github.com/darkmattercoder.png" width="40px" /></a>
-<a href="https://github.com/bmcgonag"><img src="https://github.com/bmcgonag.png" width="40px" /></a>
-<a href="https://github.com/skorokithakis"><img src="https://github.com/skorokithakis.png" width="40px" /></a>
-<a href="https://github.com/eenturk"><img src="https://github.com/eenturk.png" width="40px" /></a>
-<a href="https://github.com/spirossi"><img src="https://github.com/spirossi.png" width="40px" /></a>
-<a href="https://github.com/teomarcdhio"><img src="https://github.com/teomarcdhio.png" width="40px" /></a>
-<a href="https://github.com/MarcMichalsky"><img src="https://github.com/MarcMichalsky.png" width="40px" /></a>
-<a href="https://github.com/LuckVintage"><img src="https://github.com/LuckVintage.png" width="40px" /></a>
-<a href="https://github.com/spartan"><img src="https://github.com/spartan.png" width="40px" /></a>
-<a href="https://github.com/alexandzors"><img src="https://github.com/alexandzors.png" width="40px" /></a>
-<a href="https://github.com/dkramer95"><img src="https://github.com/dkramer95.png" width="40px" /></a>
-<a href="https://github.com/YezGotIt"><img src="https://github.com/YezGotIt.png" width="40px" /></a>
-<a href="https://github.com/thomasskou"><img src="https://github.com/thomasskou.png" width="40px" /></a>
-<a href="https://github.com/surfernv"><img src="https://github.com/surfernv.png" width="40px" /></a>
-<a href="https://github.com/richardleach"><img src="https://github.com/richardleach.png" width="40px" /></a>
-<a href="https://github.com/bear"><img src="https://github.com/bear.png" width="40px" /></a>
-<a href="https://github.com/cminter"><img src="https://github.com/cminter.png" width="40px" /></a>
-<a href="https://github.com/bahur142"><img src="https://github.com/bahur142.png" width="40px" /></a>
-<a href="https://github.com/pgwiebes"><img src="https://github.com/pgwiebes.png" width="40px" /></a>
-<a href="https://github.com/ralhei"><img src="https://github.com/ralhei.png" width="40px" /></a>
-<a href="https://github.com/TechMDW"><img src="https://github.com/TechMDW.png" width="40px" /></a>
-<a href="https://github.com/ubipo"><img src="https://github.com/ubipo.png" width="40px" /></a>
-<a href="https://github.com/tka85"><img src="https://github.com/tka85.png" width="40px" /></a>
-<a href="https://github.com/beekeeb"><img src="https://github.com/beekeeb.png" width="40px" /></a>
-<a href="https://github.com/Emiliaaah"><img src="https://github.com/Emiliaaah.png" width="40px" /></a>
-<a href="https://github.com/zark0s"><img src="https://github.com/zark0s.png" width="40px" /></a>
-<a href="https://github.com/tomershvueli"><img src="https://github.com/tomershvueli.png" width="40px" /></a>
-<a href="https://github.com/CataIana"><img src="https://github.com/CataIana.png" width="40px" /></a>
-<a href="https://github.com/ajay-actuary"><img src="https://github.com/ajay-actuary.png" width="40px" /></a>
-<a href="https://github.com/mursec"><img src="https://github.com/mursec.png" width="40px" /></a>
-<a href="https://github.com/FrameXX"><img src="https://github.com/FrameXX.png" width="40px" /></a>
-<a href="https://github.com/vovayartsev"><img src="https://github.com/vovayartsev.png" width="40px" /></a>
-<a href="https://github.com/dwain-lab"><img src="https://github.com/dwain-lab.png" width="40px" /></a>
-<a href="https://github.com/brookmg"><img src="https://github.com/brookmg.png" width="40px" /></a>
-<a href="https://github.com/siebej"><img src="https://github.com/siebej.png" width="40px" /></a>
-<a href="https://github.com/rxsantos"><img src="https://github.com/rxsantos.png" width="40px" /></a>
-<a href="https://github.com/hermannx5"><img src="https://github.com/hermannx5.png" width="40px" /></a>
-<a href="https://github.com/rwxd"><img src="https://github.com/rwxd.png" width="40px" /></a>
-<a href="https://github.com/Integral-Tech"><img src="https://github.com/Integral-Tech.png" width="40px" /></a>
-<a href="https://github.com/TheTomik1"><img src="https://github.com/TheTomik1.png" width="40px" /></a>
-<a href="https://github.com/dav23r"><img src="https://github.com/dav23r.png" width="40px" /></a>
-<a href="https://github.com/stannynuytkens"><img src="https://github.com/stannynuytkens.png" width="40px" /></a>
-<a href="https://github.com/danbartram"><img src="https://github.com/danbartram.png" width="40px" /></a>
-<a href="https://github.com/arthurgleckler"><img src="https://github.com/arthurgleckler.png" width="40px" /></a>
-<a href="https://github.com/tomroth04"><img src="https://github.com/tomroth04.png" width="40px" /></a>
-<a href="https://github.com/Circenn5130"><img src="https://github.com/Circenn5130.png" width="40px" /></a>
-<a href="https://github.com/jceloria"><img src="https://github.com/jceloria.png" width="40px" /></a>
-<a href="https://github.com/afunworm"><img src="https://github.com/afunworm.png" width="40px" /></a>
-<a href="https://github.com/PTR-inc"><img src="https://github.com/PTR-inc.png" width="40px" /></a>
-<a href="https://github.com/spudooli"><img src="https://github.com/spudooli.png" width="40px" /></a>
-<a href="https://github.com/IMarkoMC"><img src="https://github.com/IMarkoMC.png" width="40px" /></a>
-<a href="https://github.com/rubund"><img src="https://github.com/rubund.png" width="40px" /></a>
-<a href="https://github.com/Riolku"><img src="https://github.com/Riolku.png" width="40px" /></a>
-<a href="https://github.com/arnbrhm"><img src="https://github.com/arnbrhm.png" width="40px" /></a>
-<a href="https://github.com/herzkerl"><img src="https://github.com/herzkerl.png" width="40px" /></a>
-<a href="https://github.com/0x45796164"><img src="https://github.com/0x45796164.png" width="40px" /></a>
-<a href="https://github.com/madchr1st"><img src="https://github.com/madchr1st.png" width="40px" /></a>
-<a href="https://github.com/avalentic"><img src="https://github.com/avalentic.png" width="40px" /></a>
-<a href="https://github.com/TheCraiggers"><img src="https://github.com/TheCraiggers.png" width="40px" /></a>
-<a href="https://github.com/sheetd"><img src="https://github.com/sheetd.png" width="40px" /></a>
-<a href="https://github.com/dlt-green"><img src="https://github.com/dlt-green.png" width="40px" /></a>
-<a href="https://github.com/suhlig"><img src="https://github.com/suhlig.png" width="40px" /></a>
-<a href="https://github.com/Proximus888"><img src="https://github.com/Proximus888.png" width="40px" /></a>
-<a href="https://github.com/wielandp"><img src="https://github.com/wielandp.png" width="40px" /></a>
-<a href="https://github.com/chxseh"><img src="https://github.com/chxseh.png" width="40px" /></a>
-<a href="https://github.com/user8446"><img src="https://github.com/user8446.png" width="40px" /></a>
-<a href="https://github.com/cdf-eagles"><img src="https://github.com/cdf-eagles.png" width="40px" /></a>
-
 ## Contributing
-I welcome any contributions. Just create a PR or an issue. For larger features/ideas, please reach out
-on Discord/Matrix first to see if I'd accept them. To contribute code, check out the [build instructions](https://ntfy.sh/docs/develop/)
-for the server and the Android app. Or, if you'd like to help translate 🇩🇪 🇺🇸 🇧🇬, you can start immediately in
+I welcome any and all contributions. Just create a PR or an issue. To contribute code, check out 
+the [build instructions](https://ntfy.sh/docs/develop/) for the server and the Android app.
+Or, if you'd like to help translate 🇩🇪 🇺🇸 🇧🇬, you can start immediately in
 [Hosted Weblate](https://hosted.weblate.org/projects/ntfy/).
 
 <a href="https://hosted.weblate.org/engage/ntfy/">
 <img src="https://hosted.weblate.org/widgets/ntfy/-/multi-blue.svg" alt="Translation status" />
 </a>
 
-## Code of Conduct
-We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for
-everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity
-and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste,
-color, religion, or sexual identity and orientation.
+## Donations
+I have just very recently started accepting donations via [GitHub Sponsors](https://github.com/sponsors/binwiederhier). 
+I would be humbled if you helped me carry the server and developer account costs. Even small donations are very much 
+appreciated. A big fat Thank You to the folks already sponsoring ntfy:
 
-**We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.**
-
-_Please be sure to read the complete [Code of Conduct](CODE_OF_CONDUCT.md)._    
+<a href="https://github.com/aspyct"><img src="https://github.com/aspyct.png" width="40px" /></a>
+<a href="https://github.com/codinghipster"><img src="https://github.com/codinghipster.png" width="40px" /></a>
+<a href="https://github.com/HinFort"><img src="https://github.com/HinFort.png" width="40px" /></a>
+<a href="https://github.com/mckay115"><img src="https://github.com/mckay115.png" width="40px" /></a>
+<a href="https://github.com/neutralinsomniac"><img src="https://github.com/neutralinsomniac.png" width="40px" /></a>
+<a href="https://github.com/nickexyz"><img src="https://github.com/nickexyz.png" width="40px" /></a>
+<a href="https://github.com/qcasey"><img src="https://github.com/qcasey.png" width="40px" /></a>
+<a href="https://github.com/Salamafet"><img src="https://github.com/Salamafet.png" width="40px" /></a>
 
 ## License
 Made with ❤️ by [Philipp C. Heckel](https://heckel.io).   
 The project is dual licensed under the [Apache License 2.0](LICENSE) and the [GPLv2 License](LICENSE.GPLv2).
 
-Third-party libraries and resources:
+Third party libraries and resources:
 * [github.com/urfave/cli](https://github.com/urfave/cli) (MIT) is used to drive the CLI
 * [Mixkit sounds](https://mixkit.co/free-sound-effects/notification/) (Mixkit Free License) are used as notification sounds
 * [Sounds from notificationsounds.com](https://notificationsounds.com) (Creative Commons Attribution) are used as notification sounds
@@ -266,11 +94,8 @@ Third-party libraries and resources:
 * [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) (MIT) is used to provide the persistent message cache
 * [Firebase Admin SDK](https://github.com/firebase/firebase-admin-go) (Apache 2.0) is used to send FCM messages
 * [github/gemoji](https://github.com/github/gemoji) (MIT) is used for emoji support (specifically the [emoji.json](https://raw.githubusercontent.com/github/gemoji/master/db/emoji.json) file)
-* Go's [text/template](https://pkg.go.dev/text/template) (BSD-3-Clause) is vendored under [template/gotext/](template/gotext/) with a small patch adding an execution deadline (see [template/gotext/README.md](template/gotext/README.md))
 * [Lightbox with vanilla JS](https://yossiabramov.com/blog/vanilla-js-lightbox) as a lightbox on the landing page 
 * [HTTP middleware for gzip compression](https://gist.github.com/CJEnright/bc2d8b8dc0c1389a9feeddb110f822d7) (MIT) is used for serving static files
 * [Regex for auto-linking](https://github.com/bryanwoods/autolink-js) (MIT) is used to highlight links (the library is not used)
 * [Statically linking go-sqlite3](https://www.arp242.net/static-go.html)
 * [Linked tabs in mkdocs](https://facelessuser.github.io/pymdown-extensions/extensions/tabbed/#linked-tabs)
-* [webpush-go](https://github.com/SherClockHolmes/webpush-go) (MIT) is used to send web push notifications
-* [Sprig](https://github.com/Masterminds/sprig) (MIT) is used to add template parsing functions

SECURITY.md

@@ -1,12 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-As of today, I only support the latest version of ntfy. Please make sure you stay up-to-date.
-
-## Reporting a Vulnerability
-
-Please report security vulnerabilities privately via email to [security@mail.ntfy.sh](mailto:security@mail.ntfy.sh).
-
-You can also reach me on [Discord](https://discord.gg/cT7ECsZj9w) or [Matrix](https://matrix.to/#/#ntfy:matrix.org) 
-(my username is `binwiederhier`).

attachment/backend.go

@@ -1,23 +0,0 @@
-package attachment
-
-import (
-	"io"
-	"time"
-)
-
-// backendObject represents an object stored in a backend.
-type object struct {
-	ID           string
-	Size         int64
-	LastModified time.Time
-}
-
-// backend is a minimal I/O interface for storing and retrieving attachment files.
-// It has no knowledge of size tracking, limiting, or ID validation.
-type backend interface {
-	Put(id string, reader io.Reader, untrustedLength int64) error
-	Get(id string) (io.ReadCloser, int64, error)
-	List() ([]object, error)
-	Delete(ids ...string) error
-	DeleteIncomplete(cutoff time.Time) error
-}

attachment/backend_file.go

@@ -1,94 +0,0 @@
-package attachment
-
-import (
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"time"
-)
-
-type fileBackend struct {
-	dir string
-}
-
-var _ backend = (*fileBackend)(nil)
-
-func newFileBackend(dir string) (*fileBackend, error) {
-	if err := os.MkdirAll(dir, 0700); err != nil {
-		return nil, err
-	}
-	return &fileBackend{dir: dir}, nil
-}
-
-func (b *fileBackend) Put(id string, reader io.Reader, untrustedLength int64) error {
-	if untrustedLength > 0 {
-		reader = io.LimitReader(reader, untrustedLength)
-	}
-	file := filepath.Join(b.dir, id)
-	f, err := os.OpenFile(file, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	n, err := io.Copy(f, reader)
-	if err != nil {
-		os.Remove(file)
-		return err
-	} else if untrustedLength > 0 && n != untrustedLength {
-		os.Remove(file)
-		return fmt.Errorf("content length mismatch: claimed %d, got %d", untrustedLength, n)
-	}
-	if err := f.Close(); err != nil {
-		os.Remove(file)
-		return err
-	}
-	return nil
-}
-
-func (b *fileBackend) List() ([]object, error) {
-	entries, err := os.ReadDir(b.dir)
-	if err != nil {
-		return nil, err
-	}
-	objects := make([]object, 0, len(entries))
-	for _, e := range entries {
-		info, err := e.Info()
-		if err != nil {
-			return nil, err
-		}
-		objects = append(objects, object{
-			ID:           e.Name(),
-			Size:         info.Size(),
-			LastModified: info.ModTime(),
-		})
-	}
-	return objects, nil
-}
-
-func (b *fileBackend) Get(id string) (io.ReadCloser, int64, error) {
-	file := filepath.Join(b.dir, id)
-	stat, err := os.Stat(file)
-	if err != nil {
-		return nil, 0, err
-	}
-	f, err := os.Open(file)
-	if err != nil {
-		return nil, 0, err
-	}
-	return f, stat.Size(), nil
-}
-
-func (b *fileBackend) Delete(ids ...string) error {
-	for _, id := range ids {
-		file := filepath.Join(b.dir, id)
-		if err := os.Remove(file); err != nil && !os.IsNotExist(err) {
-			return err
-		}
-	}
-	return nil
-}
-
-func (b *fileBackend) DeleteIncomplete(_ time.Time) error {
-	return nil
-}

attachment/backend_s3.go

@@ -1,51 +0,0 @@
-package attachment
-
-import (
-	"context"
-	"io"
-	"time"
-
-	"heckel.io/ntfy/v2/s3"
-)
-
-type s3Backend struct {
-	client *s3.Client
-}
-
-var _ backend = (*s3Backend)(nil)
-
-func newS3Backend(client *s3.Client) *s3Backend {
-	return &s3Backend{client: client}
-}
-
-func (b *s3Backend) Put(id string, reader io.Reader, untrustedLength int64) error {
-	return b.client.PutObject(context.Background(), id, reader, untrustedLength)
-}
-
-func (b *s3Backend) Get(id string) (io.ReadCloser, int64, error) {
-	return b.client.GetObject(context.Background(), id)
-}
-
-func (b *s3Backend) List() ([]object, error) {
-	objects, err := b.client.ListObjectsV2(context.Background())
-	if err != nil {
-		return nil, err
-	}
-	result := make([]object, 0, len(objects))
-	for _, obj := range objects {
-		result = append(result, object{
-			ID:           obj.Key,
-			Size:         obj.Size,
-			LastModified: obj.LastModified,
-		})
-	}
-	return result, nil
-}
-
-func (b *s3Backend) Delete(ids ...string) error {
-	return b.client.DeleteObjects(context.Background(), ids)
-}
-
-func (b *s3Backend) DeleteIncomplete(cutoff time.Time) error {
-	return b.client.AbortIncompleteUploads(context.Background(), cutoff)
-}

attachment/store.go

@@ -1,246 +0,0 @@
-package attachment
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"sync"
-	"time"
-
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/model"
-	"heckel.io/ntfy/v2/s3"
-	"heckel.io/ntfy/v2/util"
-)
-
-const (
-	tagStore     = "attachment_store"
-	syncInterval = 15 * time.Minute // How often to run the background sync loop
-)
-
-var errInvalidFileID = errors.New("invalid file ID")
-
-// Store manages attachment storage with shared logic for size tracking, limiting,
-// ID validation, and background sync to reconcile storage with the database.
-type Store struct {
-	backend              backend
-	limit                int64                            // Defined limit of the store in bytes
-	size                 int64                            // Current size of the store in bytes
-	sizes                map[string]int64                 // File ID -> size, for subtracting on Remove
-	attachmentsWithSizes func() (map[string]int64, error) // Returns file ID -> size for active attachments
-	orphanGracePeriod    time.Duration                    // Don't delete orphaned objects younger than this
-	closeChan            chan struct{}
-	doneChan             chan struct{}
-	mu                   sync.RWMutex // Protects size and sizes
-}
-
-// NewFileStore creates a new file-system backed attachment cache
-func NewFileStore(dir string, totalSizeLimit int64, orphanGracePeriod time.Duration, attachmentsWithSizes func() (map[string]int64, error)) (*Store, error) {
-	b, err := newFileBackend(dir)
-	if err != nil {
-		return nil, err
-	}
-	return newStore(b, totalSizeLimit, orphanGracePeriod, attachmentsWithSizes)
-}
-
-// NewS3Store creates a new S3-backed attachment cache. The s3URL must be in the format:
-//
-//	s3://ACCESS_KEY:SECRET_KEY@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT][&disable_http2=true]
-func NewS3Store(s3URL string, totalSizeLimit int64, orphanGracePeriod time.Duration, attachmentsWithSizes func() (map[string]int64, error)) (*Store, error) {
-	config, err := s3.ParseURL(s3URL)
-	if err != nil {
-		return nil, err
-	}
-	return newStore(newS3Backend(s3.New(config)), totalSizeLimit, orphanGracePeriod, attachmentsWithSizes)
-}
-
-func newStore(backend backend, totalSizeLimit int64, orphanGracePeriod time.Duration, attachmentsWithSizes func() (map[string]int64, error)) (*Store, error) {
-	c := &Store{
-		backend:              backend,
-		limit:                totalSizeLimit,
-		sizes:                make(map[string]int64),
-		attachmentsWithSizes: attachmentsWithSizes,
-		orphanGracePeriod:    orphanGracePeriod,
-		closeChan:            make(chan struct{}),
-		doneChan:             make(chan struct{}),
-	}
-	// Hydrate sizes from the database immediately so that Size()/Remaining()/Remove()
-	// are accurate from the start, without waiting for the first sync() call.
-	if attachmentsWithSizes != nil {
-		attachments, err := attachmentsWithSizes()
-		if err != nil {
-			return nil, fmt.Errorf("attachment store: failed to load existing attachments: %w", err)
-		}
-		for id, size := range attachments {
-			c.sizes[id] = size
-			c.size += size
-		}
-		go c.syncLoop()
-	} else {
-		close(c.doneChan)
-	}
-	return c, nil
-}
-
-// Write stores an attachment file. The id is validated, and the write is subject to
-// the total size limit and any additional limiters. The untrustedLength is a hint
-// from the client's Content-Length header; backends may use it to optimize uploads (e.g.
-// streaming directly to S3 without buffering).
-func (c *Store) Write(id string, reader io.Reader, untrustedLength int64, limiters ...util.Limiter) (int64, error) {
-	if !model.ValidMessageID(id) {
-		return 0, errInvalidFileID
-	}
-	log.Tag(tagStore).Field("message_id", id).Debug("Writing attachment")
-	limiters = append(limiters, util.NewFixedLimiter(c.Remaining()))
-	countingReader := util.NewCountingReader(reader)
-	limitReader := util.NewLimitReader(countingReader, limiters...)
-	if err := c.backend.Put(id, limitReader, untrustedLength); err != nil {
-		c.backend.Delete(id) //nolint:errcheck
-		return 0, err
-	}
-	size := countingReader.Total()
-	c.mu.Lock()
-	c.size += size
-	c.sizes[id] = size
-	c.mu.Unlock()
-	return size, nil
-}
-
-// Read retrieves an attachment file by ID
-func (c *Store) Read(id string) (io.ReadCloser, int64, error) {
-	if !model.ValidMessageID(id) {
-		return nil, 0, errInvalidFileID
-	}
-	return c.backend.Get(id)
-}
-
-// Remove deletes attachment files by ID and subtracts their known sizes from
-// the total. Sizes for objects not tracked (e.g. written before this process
-// started and before the first sync) are corrected by the next sync() call.
-func (c *Store) Remove(ids ...string) error {
-	for _, id := range ids {
-		if !model.ValidMessageID(id) {
-			return errInvalidFileID
-		}
-	}
-	// Remove from backend
-	for _, id := range ids {
-		log.Tag(tagStore).Field("message_id", id).Debug("Removing attachment")
-	}
-	if err := c.backend.Delete(ids...); err != nil {
-		return err
-	}
-	// Update total cache size
-	c.mu.Lock()
-	for _, id := range ids {
-		if size, ok := c.sizes[id]; ok {
-			c.size -= size
-			delete(c.sizes, id)
-		}
-	}
-	if c.size < 0 {
-		c.size = 0
-	}
-	c.mu.Unlock()
-	return nil
-}
-
-// Sync triggers an immediate reconciliation of storage with the database.
-func (c *Store) Sync() error {
-	return c.sync()
-}
-
-// sync reconciles the backend storage with the database. It lists all objects,
-// deletes orphans (not in the valid ID set and older than the grace period), and
-// recomputes the total size from the existing attachments in the database.
-func (c *Store) sync() error {
-	if c.attachmentsWithSizes == nil {
-		return nil
-	}
-	attachmentsWithSizes, err := c.attachmentsWithSizes()
-	if err != nil {
-		return fmt.Errorf("attachment sync: failed to get existing attachments: %w", err)
-	}
-	remoteObjects, err := c.backend.List()
-	if err != nil {
-		return fmt.Errorf("attachment sync: failed to list objects: %w", err)
-	}
-	// Calculate total cache size and collect orphaned attachments, excluding objects younger
-	// than the grace period to account for races, and skipping objects with invalid IDs.
-	cutoff := time.Now().Add(-c.orphanGracePeriod)
-	var orphanIDs []string
-	var count, totalSize int64
-	sizes := make(map[string]int64, len(remoteObjects))
-	for _, obj := range remoteObjects {
-		if !model.ValidMessageID(obj.ID) {
-			continue
-		}
-		if _, ok := attachmentsWithSizes[obj.ID]; !ok && obj.LastModified.Before(cutoff) {
-			orphanIDs = append(orphanIDs, obj.ID)
-		} else {
-			count++
-			totalSize += attachmentsWithSizes[obj.ID]
-			sizes[obj.ID] = attachmentsWithSizes[obj.ID]
-		}
-	}
-	log.Tag(tagStore).Debug("Attachment store updated: %d attachment(s), %s", count, util.FormatSizeHuman(totalSize))
-	c.mu.Lock()
-	c.size = totalSize
-	c.sizes = sizes
-	c.mu.Unlock()
-	// Delete orphaned attachments
-	if len(orphanIDs) > 0 {
-		log.Tag(tagStore).Debug("Deleting %d orphaned attachment(s)", len(orphanIDs))
-		if err := c.backend.Delete(orphanIDs...); err != nil {
-			return fmt.Errorf("attachment sync: failed to delete orphaned objects: %w", err)
-		}
-	}
-	// Clean up incomplete uploads (S3 only)
-	if err := c.backend.DeleteIncomplete(cutoff); err != nil {
-		log.Tag(tagStore).Err(err).Warn("Failed to abort incomplete uploads from attachment cache")
-	}
-	return nil
-}
-
-// Size returns the current total size of all attachments
-func (c *Store) Size() int64 {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	return c.size
-}
-
-// Remaining returns the remaining capacity for attachments
-func (c *Store) Remaining() int64 {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	remaining := c.limit - c.size
-	if remaining < 0 {
-		return 0
-	}
-	return remaining
-}
-
-// Close stops the background sync goroutine and waits for it to finish
-func (c *Store) Close() {
-	close(c.closeChan)
-	<-c.doneChan
-}
-
-func (c *Store) syncLoop() {
-	defer close(c.doneChan)
-	if err := c.sync(); err != nil {
-		log.Tag(tagStore).Err(err).Warn("Attachment sync failed")
-	}
-	ticker := time.NewTicker(syncInterval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ticker.C:
-			if err := c.sync(); err != nil {
-				log.Tag(tagStore).Err(err).Warn("Attachment sync failed")
-			}
-		case <-c.closeChan:
-			return
-		}
-	}
-}

attachment/store_file_test.go

@@ -1,17 +0,0 @@
-package attachment
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-func newTestFileStore(t *testing.T, totalSizeLimit int64) (dir string, cache *Store) {
-	t.Helper()
-	dir = t.TempDir()
-	cache, err := NewFileStore(dir, totalSizeLimit, time.Hour, nil)
-	require.Nil(t, err)
-	t.Cleanup(func() { cache.Close() })
-	return dir, cache
-}

attachment/store_s3_test.go

@@ -1,120 +0,0 @@
-package attachment
-
-import (
-	"context"
-	"io"
-	"os"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/s3"
-)
-
-func TestS3Store_WriteWithPrefix(t *testing.T) {
-	s3URL := os.Getenv("NTFY_TEST_S3_URL")
-	if s3URL == "" {
-		t.Skip("NTFY_TEST_S3_URL not set")
-	}
-	cfg, err := s3.ParseURL(s3URL)
-	require.Nil(t, err)
-	cfg.Prefix = "test-prefix"
-	client := s3.New(cfg)
-	deleteAllObjects(t, client)
-	backend := newS3Backend(client)
-	cache, err := newStore(backend, 10*1024, time.Hour, nil)
-	require.Nil(t, err)
-	t.Cleanup(func() {
-		deleteAllObjects(t, client)
-		cache.Close()
-	})
-
-	size, err := cache.Write("abcdefghijkl", strings.NewReader("test"), 0)
-	require.Nil(t, err)
-	require.Equal(t, int64(4), size)
-
-	reader, _, err := cache.Read("abcdefghijkl")
-	require.Nil(t, err)
-	data, err := io.ReadAll(reader)
-	reader.Close()
-	require.Nil(t, err)
-	require.Equal(t, "test", string(data))
-}
-
-// --- Helpers ---
-
-func newTestRealS3Store(t *testing.T, totalSizeLimit int64) (*Store, *modTimeOverrideBackend) {
-	t.Helper()
-	s3URL := os.Getenv("NTFY_TEST_S3_URL")
-	if s3URL == "" {
-		t.Skip("NTFY_TEST_S3_URL not set")
-	}
-	cfg, err := s3.ParseURL(s3URL)
-	require.Nil(t, err)
-	if cfg.Prefix != "" {
-		cfg.Prefix = cfg.Prefix + "/testpkg-attachment"
-	} else {
-		cfg.Prefix = "testpkg-attachment"
-	}
-	client := s3.New(cfg)
-	inner := newS3Backend(client)
-	wrapper := &modTimeOverrideBackend{backend: inner, modTimes: make(map[string]time.Time)}
-	deleteAllObjects(t, client)
-	store, err := newStore(wrapper, totalSizeLimit, time.Hour, nil)
-	require.Nil(t, err)
-	t.Cleanup(func() {
-		deleteAllObjects(t, client)
-		store.Close()
-	})
-	return store, wrapper
-}
-
-func deleteAllObjects(t *testing.T, client *s3.Client) {
-	t.Helper()
-	for i := 0; i < 20; i++ {
-		objects, err := client.ListObjectsV2(context.Background())
-		require.Nil(t, err)
-		if len(objects) == 0 {
-			return
-		}
-		keys := make([]string, len(objects))
-		for j, obj := range objects {
-			keys[j] = obj.Key
-		}
-		require.Nil(t, client.DeleteObjects(context.Background(), keys))
-		time.Sleep(200 * time.Millisecond)
-	}
-	t.Fatal("timed out waiting for bucket to be empty")
-}
-
-// modTimeOverrideBackend wraps a backend and allows overriding LastModified times returned by List().
-// This is used in tests to simulate old objects on backends (like real S3) where
-// LastModified cannot be set directly.
-type modTimeOverrideBackend struct {
-	backend
-	mu       sync.Mutex
-	modTimes map[string]time.Time // object ID -> override time
-}
-
-func (b *modTimeOverrideBackend) List() ([]object, error) {
-	objects, err := b.backend.List()
-	if err != nil {
-		return nil, err
-	}
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	for i, obj := range objects {
-		if t, ok := b.modTimes[obj.ID]; ok {
-			objects[i].LastModified = t
-		}
-	}
-	return objects, nil
-}
-
-func (b *modTimeOverrideBackend) setModTime(id string, t time.Time) {
-	b.mu.Lock()
-	b.modTimes[id] = t
-	b.mu.Unlock()
-}

attachment/store_test.go

@@ -1,352 +0,0 @@
-package attachment
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/util"
-)
-
-const testSizeLimit = 10 * 1024
-
-func TestStore_WriteReadRemove(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		// Write
-		size, err := s.Write("abcdefghijkl", strings.NewReader("hello world"), 0)
-		require.Nil(t, err)
-		require.Equal(t, int64(11), size)
-		require.Equal(t, int64(11), s.Size())
-
-		// Read back
-		reader, readSize, err := s.Read("abcdefghijkl")
-		require.Nil(t, err)
-		require.Equal(t, int64(11), readSize)
-		data, err := io.ReadAll(reader)
-		reader.Close()
-		require.Nil(t, err)
-		require.Equal(t, "hello world", string(data))
-
-		// Remove
-		require.Nil(t, s.Remove("abcdefghijkl"))
-		require.Equal(t, int64(0), s.Size())
-
-		// Read after remove should fail
-		_, _, err = s.Read("abcdefghijkl")
-		require.Error(t, err)
-	})
-}
-
-func TestStore_WriteRemoveMultiple(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		for i := 0; i < 5; i++ {
-			_, err := s.Write(fmt.Sprintf("abcdefghijk%d", i), bytes.NewReader(make([]byte, 100)), 0)
-			require.Nil(t, err)
-		}
-		require.Equal(t, int64(500), s.Size())
-
-		require.Nil(t, s.Remove("abcdefghijk1", "abcdefghijk3"))
-		require.Equal(t, int64(300), s.Size())
-
-		// Removed files should not be readable
-		_, _, err := s.Read("abcdefghijk1")
-		require.Error(t, err)
-		_, _, err = s.Read("abcdefghijk3")
-		require.Error(t, err)
-
-		// Remaining files should still be readable
-		for _, id := range []string{"abcdefghijk0", "abcdefghijk2", "abcdefghijk4"} {
-			reader, _, err := s.Read(id)
-			require.Nil(t, err)
-			reader.Close()
-		}
-	})
-}
-
-func TestStore_WriteTotalSizeLimit(t *testing.T) {
-	forEachBackend(t, 100, func(t *testing.T, s *Store, _ func(string)) {
-		// First write fits
-		_, err := s.Write("abcdefghijk0", bytes.NewReader(make([]byte, 80)), 0)
-		require.Nil(t, err)
-		require.Equal(t, int64(80), s.Size())
-		require.Equal(t, int64(20), s.Remaining())
-
-		// Second write exceeds total limit
-		_, err = s.Write("abcdefghijk1", bytes.NewReader(make([]byte, 50)), 0)
-		require.ErrorIs(t, err, util.ErrLimitReached)
-	})
-}
-
-func TestStore_WriteAdditionalLimiter(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		_, err := s.Write("abcdefghijkl", bytes.NewReader(make([]byte, 200)), 0, util.NewFixedLimiter(100))
-		require.ErrorIs(t, err, util.ErrLimitReached)
-
-		// File should not be readable (was cleaned up)
-		_, _, err = s.Read("abcdefghijkl")
-		require.Error(t, err)
-	})
-}
-
-func TestStore_WriteWithLimiter(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		size, err := s.Write("abcdefghijkl", strings.NewReader("normal file"), 0, util.NewFixedLimiter(999))
-		require.Nil(t, err)
-		require.Equal(t, int64(11), size)
-		require.Equal(t, int64(11), s.Size())
-	})
-}
-
-func TestStore_WriteOverwriteSameID(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		// Write 100 bytes
-		_, err := s.Write("abcdefghijkl", bytes.NewReader(make([]byte, 100)), 0)
-		require.Nil(t, err)
-		require.Equal(t, int64(100), s.Size())
-
-		// Overwrite with 50 bytes
-		_, err = s.Write("abcdefghijkl", bytes.NewReader(make([]byte, 50)), 0)
-		require.Nil(t, err)
-		require.Equal(t, int64(150), s.Size()) // Store tracks both writes
-
-		// Read back should return the latest content
-		reader, readSize, err := s.Read("abcdefghijkl")
-		require.Nil(t, err)
-		require.Equal(t, int64(50), readSize)
-		reader.Close()
-	})
-}
-
-func TestStore_WriteAfterFailure(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		// Failed write: limiter rejects it
-		_, err := s.Write("abcdefghijkl", bytes.NewReader(make([]byte, 200)), 0, util.NewFixedLimiter(100))
-		require.ErrorIs(t, err, util.ErrLimitReached)
-		require.Equal(t, int64(0), s.Size())
-
-		// Subsequent write with a different ID should succeed
-		size, err := s.Write("abcdefghijk2", strings.NewReader("hello"), 0)
-		require.Nil(t, err)
-		require.Equal(t, int64(5), size)
-		require.Equal(t, int64(5), s.Size())
-
-		// The failed ID should not be readable
-		_, _, err = s.Read("abcdefghijkl")
-		require.Error(t, err)
-
-		// The successful ID should be readable
-		reader, _, err := s.Read("abcdefghijk2")
-		require.Nil(t, err)
-		reader.Close()
-	})
-}
-
-func TestStore_SyncRecomputesSize(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, makeOld func(string)) {
-		// Write two files
-		_, err := s.Write("abcdefghijk0", bytes.NewReader(make([]byte, 100)), 0)
-		require.Nil(t, err)
-		_, err = s.Write("abcdefghijk1", bytes.NewReader(make([]byte, 200)), 0)
-		require.Nil(t, err)
-		require.Equal(t, int64(300), s.Size())
-
-		// Corrupt the in-memory size tracking
-		s.mu.Lock()
-		s.size = 999
-		s.mu.Unlock()
-		require.Equal(t, int64(999), s.Size())
-
-		// Set attachmentsWithSizes to include both files so nothing gets deleted
-		s.attachmentsWithSizes = func() (map[string]int64, error) {
-			return map[string]int64{"abcdefghijk0": 100, "abcdefghijk1": 200}, nil
-		}
-
-		// Sync should recompute size from the backend
-		require.Nil(t, s.sync())
-		require.Equal(t, int64(300), s.Size())
-	})
-}
-
-func TestStore_ReadNotFound(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		_, _, err := s.Read("abcdefghijkl")
-		require.Error(t, err)
-	})
-}
-
-func TestStore_InvalidID(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		_, err := s.Write("bad", strings.NewReader("x"), 0)
-		require.Equal(t, errInvalidFileID, err)
-
-		_, _, err = s.Read("bad")
-		require.Equal(t, errInvalidFileID, err)
-
-		err = s.Remove("bad")
-		require.Equal(t, errInvalidFileID, err)
-	})
-}
-
-func TestStore_WriteLargeObjects(t *testing.T) {
-	sizes := map[string]int64{
-		"100B": 100,
-		"6MB":  6 * 1024 * 1024,
-		"12MB": 12 * 1024 * 1024,
-	}
-	for name, sz := range sizes {
-		t.Run(name, func(t *testing.T) {
-			forEachBackend(t, sz+1024, func(t *testing.T, s *Store, _ func(string)) {
-				data := make([]byte, sz)
-				for i := range data {
-					data[i] = byte(i % 251)
-				}
-
-				size, err := s.Write("abcdefghijkl", bytes.NewReader(data), 0)
-				require.Nil(t, err)
-				require.Equal(t, sz, size)
-				require.Equal(t, sz, s.Size())
-
-				reader, readSize, err := s.Read("abcdefghijkl")
-				require.Nil(t, err)
-				require.Equal(t, sz, readSize)
-				got, err := io.ReadAll(reader)
-				reader.Close()
-				require.Nil(t, err)
-				require.Equal(t, data, got)
-			})
-		})
-	}
-}
-
-func TestStore_WriteUntrustedLengthExact(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		size, err := s.Write("abcdefghijkl", strings.NewReader("hello world"), 11)
-		require.Nil(t, err)
-		require.Equal(t, int64(11), size)
-
-		reader, _, err := s.Read("abcdefghijkl")
-		require.Nil(t, err)
-		data, err := io.ReadAll(reader)
-		reader.Close()
-		require.Nil(t, err)
-		require.Equal(t, "hello world", string(data))
-	})
-}
-
-func TestStore_WriteUntrustedLengthBodyLonger(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		// Body has 11 bytes, but we claim 5 — only first 5 bytes should be stored
-		size, err := s.Write("abcdefghijkl", strings.NewReader("hello world"), 5)
-		require.Nil(t, err)
-		require.Equal(t, int64(5), size)
-
-		reader, _, err := s.Read("abcdefghijkl")
-		require.Nil(t, err)
-		data, err := io.ReadAll(reader)
-		reader.Close()
-		require.Nil(t, err)
-		require.Equal(t, "hello", string(data))
-	})
-}
-
-func TestStore_WriteUntrustedLengthBodyShorter(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		// Body has 5 bytes, but we claim 100 — should fail
-		_, err := s.Write("abcdefghijkl", strings.NewReader("hello"), 100)
-		require.Error(t, err)
-
-		// File should not be readable (was cleaned up)
-		_, _, err = s.Read("abcdefghijkl")
-		require.Error(t, err)
-	})
-}
-
-func TestStore_Sync(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, makeOld func(string)) {
-		// Write some files
-		_, err := s.Write("abcdefghijk0", strings.NewReader("file0"), 0)
-		require.Nil(t, err)
-		_, err = s.Write("abcdefghijk1", strings.NewReader("file1"), 0)
-		require.Nil(t, err)
-		_, err = s.Write("abcdefghijk2", strings.NewReader("file2"), 0)
-		require.Nil(t, err)
-
-		require.Equal(t, int64(15), s.Size())
-
-		// Set the ID provider to only know about file 0 and 2
-		s.attachmentsWithSizes = func() (map[string]int64, error) {
-			return map[string]int64{"abcdefghijk0": 5, "abcdefghijk2": 5}, nil
-		}
-
-		// Make file 1 old enough to be cleaned up
-		makeOld("abcdefghijk1")
-
-		// Run sync
-		require.Nil(t, s.sync())
-
-		// File 1 should be deleted (orphan, old enough)
-		_, _, err = s.Read("abcdefghijk1")
-		require.Error(t, err)
-
-		// Files 0 and 2 should still be readable
-		r, _, err := s.Read("abcdefghijk0")
-		require.Nil(t, err)
-		r.Close()
-		r, _, err = s.Read("abcdefghijk2")
-		require.Nil(t, err)
-		r.Close()
-
-		// Size should be updated
-		require.Equal(t, int64(10), s.Size())
-	})
-}
-
-func TestStore_Sync_SkipsRecentFiles(t *testing.T) {
-	forEachBackend(t, testSizeLimit, func(t *testing.T, s *Store, _ func(string)) {
-		// Write a file
-		_, err := s.Write("abcdefghijk0", strings.NewReader("file0"), 0)
-		require.Nil(t, err)
-
-		// Set the ID provider to return empty (no valid IDs)
-		s.attachmentsWithSizes = func() (map[string]int64, error) {
-			return map[string]int64{}, nil
-		}
-
-		// File was just created, so it should NOT be deleted (< 1 hour old)
-		require.Nil(t, s.sync())
-
-		// File should still exist
-		reader, _, err := s.Read("abcdefghijk0")
-		require.Nil(t, err)
-		reader.Close()
-	})
-}
-
-// forEachBackend runs f against both the file and S3 backends. It also provides a makeOld
-// callback that makes a specific object's timestamp old enough for orphan cleanup (> 1 hour).
-// For the file backend, this uses os.Chtimes; for the S3 backend, it overrides the object's
-// LastModified time via a modTimeOverrideBackend wrapper. Objects start with recent timestamps
-// by default. The S3 subtest is skipped if NTFY_TEST_S3_URL is not set.
-func forEachBackend(t *testing.T, totalSizeLimit int64, f func(t *testing.T, s *Store, makeOld func(string))) {
-	t.Run("file", func(t *testing.T) {
-		dir, s := newTestFileStore(t, totalSizeLimit)
-		makeOld := func(id string) {
-			oldTime := time.Unix(1, 0)
-			os.Chtimes(filepath.Join(dir, id), oldTime, oldTime)
-		}
-		f(t, s, makeOld)
-	})
-	t.Run("s3", func(t *testing.T) {
-		s, wrapper := newTestRealS3Store(t, totalSizeLimit)
-		makeOld := func(id string) {
-			wrapper.setModTime(id, time.Unix(1, 0))
-		}
-		f(t, s, makeOld)
-	})
-}

auth/auth.go

@@ -0,0 +1,122 @@
+// Package auth deals with authentication and authorization against topics
+package auth
+
+import (
+	"errors"
+	"regexp"
+)
+
+// Auther is a generic interface to implement password-based authentication and authorization
+type Auther interface {
+	// Authenticate checks username and password and returns a user if correct. The method
+	// returns in constant-ish time, regardless of whether the user exists or the password is
+	// correct or incorrect.
+	Authenticate(username, password string) (*User, error)
+
+	// Authorize returns nil if the given user has access to the given topic using the desired
+	// permission. The user param may be nil to signal an anonymous user.
+	Authorize(user *User, topic string, perm Permission) error
+}
+
+// Manager is an interface representing user and access management
+type Manager interface {
+	// AddUser adds a user with the given username, password and role. The password should be hashed
+	// before it is stored in a persistence layer.
+	AddUser(username, password string, role Role) error
+
+	// RemoveUser deletes the user with the given username. The function returns nil on success, even
+	// if the user did not exist in the first place.
+	RemoveUser(username string) error
+
+	// Users returns a list of users. It always also returns the Everyone user ("*").
+	Users() ([]*User, error)
+
+	// User returns the user with the given username if it exists, or ErrNotFound otherwise.
+	// You may also pass Everyone to retrieve the anonymous user and its Grant list.
+	User(username string) (*User, error)
+
+	// ChangePassword changes a user's password
+	ChangePassword(username, password string) error
+
+	// ChangeRole changes a user's role. When a role is changed from RoleUser to RoleAdmin,
+	// all existing access control entries (Grant) are removed, since they are no longer needed.
+	ChangeRole(username string, role Role) error
+
+	// AllowAccess adds or updates an entry in th access control list for a specific user. It controls
+	// read/write access to a topic. The parameter topicPattern may include wildcards (*).
+	AllowAccess(username string, topicPattern string, read bool, write bool) error
+
+	// ResetAccess removes an access control list entry for a specific username/topic, or (if topic is
+	// empty) for an entire user. The parameter topicPattern may include wildcards (*).
+	ResetAccess(username string, topicPattern string) error
+
+	// DefaultAccess returns the default read/write access if no access control entry matches
+	DefaultAccess() (read bool, write bool)
+}
+
+// User is a struct that represents a user
+type User struct {
+	Name   string
+	Hash   string // password hash (bcrypt)
+	Role   Role
+	Grants []Grant
+}
+
+// Grant is a struct that represents an access control entry to a topic
+type Grant struct {
+	TopicPattern string // May include wildcard (*)
+	AllowRead    bool
+	AllowWrite   bool
+}
+
+// Permission represents a read or write permission to a topic
+type Permission int
+
+// Permissions to a topic
+const (
+	PermissionRead  = Permission(1)
+	PermissionWrite = Permission(2)
+)
+
+// Role represents a user's role, either admin or regular user
+type Role string
+
+// User roles
+const (
+	RoleAdmin     = Role("admin")
+	RoleUser      = Role("user")
+	RoleAnonymous = Role("anonymous")
+)
+
+// Everyone is a special username representing anonymous users
+const (
+	Everyone = "*"
+)
+
+var (
+	allowedUsernameRegex     = regexp.MustCompile(`^[-_.@a-zA-Z0-9]+$`)     // Does not include Everyone (*)
+	allowedTopicPatternRegex = regexp.MustCompile(`^[-_*A-Za-z0-9]{1,64}$`) // Adds '*' for wildcards!
+)
+
+// AllowedRole returns true if the given role can be used for new users
+func AllowedRole(role Role) bool {
+	return role == RoleUser || role == RoleAdmin
+}
+
+// AllowedUsername returns true if the given username is valid
+func AllowedUsername(username string) bool {
+	return allowedUsernameRegex.MatchString(username)
+}
+
+// AllowedTopicPattern returns true if the given topic pattern is valid; this includes the wildcard character (*)
+func AllowedTopicPattern(username string) bool {
+	return allowedTopicPatternRegex.MatchString(username)
+}
+
+// Error constants used by the package
+var (
+	ErrUnauthenticated = errors.New("unauthenticated")
+	ErrUnauthorized    = errors.New("unauthorized")
+	ErrInvalidArgument = errors.New("invalid argument")
+	ErrNotFound        = errors.New("not found")
+)

auth/auth_sqlite.go

@@ -0,0 +1,399 @@
+package auth
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	_ "github.com/mattn/go-sqlite3" // SQLite driver
+	"golang.org/x/crypto/bcrypt"
+	"strings"
+)
+
+const (
+	bcryptCost              = 10
+	intentionalSlowDownHash = "$2a$10$YFCQvqQDwIIwnJM1xkAYOeih0dg17UVGanaTStnrSzC8NCWxcLDwy" // Cost should match bcryptCost
+)
+
+// Auther-related queries
+const (
+	createAuthTablesQueries = `
+		BEGIN;
+		CREATE TABLE IF NOT EXISTS user (
+			user TEXT NOT NULL PRIMARY KEY,
+			pass TEXT NOT NULL,
+			role TEXT NOT NULL
+		);
+		CREATE TABLE IF NOT EXISTS access (
+			user TEXT NOT NULL,		
+			topic TEXT NOT NULL,
+			read INT NOT NULL,
+			write INT NOT NULL,
+			PRIMARY KEY (topic, user)
+		);
+		CREATE TABLE IF NOT EXISTS schemaVersion (
+			id INT PRIMARY KEY,
+			version INT NOT NULL
+		);
+		COMMIT;
+	`
+	selectUserQuery       = `SELECT pass, role FROM user WHERE user = ?`
+	selectTopicPermsQuery = `
+		SELECT read, write 
+		FROM access 
+		WHERE user IN ('*', ?) AND ? LIKE topic
+		ORDER BY user DESC
+	`
+)
+
+// Manager-related queries
+const (
+	insertUserQuery      = `INSERT INTO user (user, pass, role) VALUES (?, ?, ?)`
+	selectUsernamesQuery = `SELECT user FROM user ORDER BY role, user`
+	updateUserPassQuery  = `UPDATE user SET pass = ? WHERE user = ?`
+	updateUserRoleQuery  = `UPDATE user SET role = ? WHERE user = ?`
+	deleteUserQuery      = `DELETE FROM user WHERE user = ?`
+
+	upsertUserAccessQuery = `
+		INSERT INTO access (user, topic, read, write) 
+		VALUES (?, ?, ?, ?)
+		ON CONFLICT (user, topic) DO UPDATE SET read=excluded.read, write=excluded.write
+	`
+	selectUserAccessQuery  = `SELECT topic, read, write FROM access WHERE user = ?`
+	deleteAllAccessQuery   = `DELETE FROM access`
+	deleteUserAccessQuery  = `DELETE FROM access WHERE user = ?`
+	deleteTopicAccessQuery = `DELETE FROM access WHERE user = ? AND topic = ?`
+)
+
+// Schema management queries
+const (
+	currentSchemaVersion     = 1
+	insertSchemaVersion      = `INSERT INTO schemaVersion VALUES (1, ?)`
+	selectSchemaVersionQuery = `SELECT version FROM schemaVersion WHERE id = 1`
+)
+
+// SQLiteAuth is an implementation of Auther and Manager. It stores users and access control list
+// in a SQLite database.
+type SQLiteAuth struct {
+	db           *sql.DB
+	defaultRead  bool
+	defaultWrite bool
+}
+
+var _ Auther = (*SQLiteAuth)(nil)
+var _ Manager = (*SQLiteAuth)(nil)
+
+// NewSQLiteAuth creates a new SQLiteAuth instance
+func NewSQLiteAuth(filename string, defaultRead, defaultWrite bool) (*SQLiteAuth, error) {
+	db, err := sql.Open("sqlite3", filename)
+	if err != nil {
+		return nil, err
+	}
+	if err := setupAuthDB(db); err != nil {
+		return nil, err
+	}
+	return &SQLiteAuth{
+		db:           db,
+		defaultRead:  defaultRead,
+		defaultWrite: defaultWrite,
+	}, nil
+}
+
+// Authenticate checks username and password and returns a user if correct. The method
+// returns in constant-ish time, regardless of whether the user exists or the password is
+// correct or incorrect.
+func (a *SQLiteAuth) Authenticate(username, password string) (*User, error) {
+	if username == Everyone {
+		return nil, ErrUnauthenticated
+	}
+	user, err := a.User(username)
+	if err != nil {
+		bcrypt.CompareHashAndPassword([]byte(intentionalSlowDownHash),
+			[]byte("intentional slow-down to avoid timing attacks"))
+		return nil, ErrUnauthenticated
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(user.Hash), []byte(password)); err != nil {
+		return nil, ErrUnauthenticated
+	}
+	return user, nil
+}
+
+// Authorize returns nil if the given user has access to the given topic using the desired
+// permission. The user param may be nil to signal an anonymous user.
+func (a *SQLiteAuth) Authorize(user *User, topic string, perm Permission) error {
+	if user != nil && user.Role == RoleAdmin {
+		return nil // Admin can do everything
+	}
+	username := Everyone
+	if user != nil {
+		username = user.Name
+	}
+	// Select the read/write permissions for this user/topic combo. The query may return two
+	// rows (one for everyone, and one for the user), but prioritizes the user. The value for
+	// user.Name may be empty (= everyone).
+	rows, err := a.db.Query(selectTopicPermsQuery, username, topic)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+	if !rows.Next() {
+		return a.resolvePerms(a.defaultRead, a.defaultWrite, perm)
+	}
+	var read, write bool
+	if err := rows.Scan(&read, &write); err != nil {
+		return err
+	} else if err := rows.Err(); err != nil {
+		return err
+	}
+	return a.resolvePerms(read, write, perm)
+}
+
+func (a *SQLiteAuth) resolvePerms(read, write bool, perm Permission) error {
+	if perm == PermissionRead && read {
+		return nil
+	} else if perm == PermissionWrite && write {
+		return nil
+	}
+	return ErrUnauthorized
+}
+
+// AddUser adds a user with the given username, password and role. The password should be hashed
+// before it is stored in a persistence layer.
+func (a *SQLiteAuth) AddUser(username, password string, role Role) error {
+	if !AllowedUsername(username) || !AllowedRole(role) {
+		return ErrInvalidArgument
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcryptCost)
+	if err != nil {
+		return err
+	}
+	if _, err = a.db.Exec(insertUserQuery, username, hash, role); err != nil {
+		return err
+	}
+	return nil
+}
+
+// RemoveUser deletes the user with the given username. The function returns nil on success, even
+// if the user did not exist in the first place.
+func (a *SQLiteAuth) RemoveUser(username string) error {
+	if !AllowedUsername(username) {
+		return ErrInvalidArgument
+	}
+	if _, err := a.db.Exec(deleteUserQuery, username); err != nil {
+		return err
+	}
+	if _, err := a.db.Exec(deleteUserAccessQuery, username); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Users returns a list of users. It always also returns the Everyone user ("*").
+func (a *SQLiteAuth) Users() ([]*User, error) {
+	rows, err := a.db.Query(selectUsernamesQuery)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	usernames := make([]string, 0)
+	for rows.Next() {
+		var username string
+		if err := rows.Scan(&username); err != nil {
+			return nil, err
+		} else if err := rows.Err(); err != nil {
+			return nil, err
+		}
+		usernames = append(usernames, username)
+	}
+	rows.Close()
+	users := make([]*User, 0)
+	for _, username := range usernames {
+		user, err := a.User(username)
+		if err != nil {
+			return nil, err
+		}
+		users = append(users, user)
+	}
+	everyone, err := a.everyoneUser()
+	if err != nil {
+		return nil, err
+	}
+	users = append(users, everyone)
+	return users, nil
+}
+
+// User returns the user with the given username if it exists, or ErrNotFound otherwise.
+// You may also pass Everyone to retrieve the anonymous user and its Grant list.
+func (a *SQLiteAuth) User(username string) (*User, error) {
+	if username == Everyone {
+		return a.everyoneUser()
+	}
+	rows, err := a.db.Query(selectUserQuery, username)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var hash, role string
+	if !rows.Next() {
+		return nil, ErrNotFound
+	}
+	if err := rows.Scan(&hash, &role); err != nil {
+		return nil, err
+	} else if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	grants, err := a.readGrants(username)
+	if err != nil {
+		return nil, err
+	}
+	return &User{
+		Name:   username,
+		Hash:   hash,
+		Role:   Role(role),
+		Grants: grants,
+	}, nil
+}
+
+func (a *SQLiteAuth) everyoneUser() (*User, error) {
+	grants, err := a.readGrants(Everyone)
+	if err != nil {
+		return nil, err
+	}
+	return &User{
+		Name:   Everyone,
+		Hash:   "",
+		Role:   RoleAnonymous,
+		Grants: grants,
+	}, nil
+}
+
+func (a *SQLiteAuth) readGrants(username string) ([]Grant, error) {
+	rows, err := a.db.Query(selectUserAccessQuery, username)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	grants := make([]Grant, 0)
+	for rows.Next() {
+		var topic string
+		var read, write bool
+		if err := rows.Scan(&topic, &read, &write); err != nil {
+			return nil, err
+		} else if err := rows.Err(); err != nil {
+			return nil, err
+		}
+		grants = append(grants, Grant{
+			TopicPattern: fromSQLWildcard(topic),
+			AllowRead:    read,
+			AllowWrite:   write,
+		})
+	}
+	return grants, nil
+}
+
+// ChangePassword changes a user's password
+func (a *SQLiteAuth) ChangePassword(username, password string) error {
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcryptCost)
+	if err != nil {
+		return err
+	}
+	if _, err := a.db.Exec(updateUserPassQuery, hash, username); err != nil {
+		return err
+	}
+	return nil
+}
+
+// ChangeRole changes a user's role. When a role is changed from RoleUser to RoleAdmin,
+// all existing access control entries (Grant) are removed, since they are no longer needed.
+func (a *SQLiteAuth) ChangeRole(username string, role Role) error {
+	if !AllowedUsername(username) || !AllowedRole(role) {
+		return ErrInvalidArgument
+	}
+	if _, err := a.db.Exec(updateUserRoleQuery, string(role), username); err != nil {
+		return err
+	}
+	if role == RoleAdmin {
+		if _, err := a.db.Exec(deleteUserAccessQuery, username); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// AllowAccess adds or updates an entry in th access control list for a specific user. It controls
+// read/write access to a topic. The parameter topicPattern may include wildcards (*).
+func (a *SQLiteAuth) AllowAccess(username string, topicPattern string, read bool, write bool) error {
+	if (!AllowedUsername(username) && username != Everyone) || !AllowedTopicPattern(topicPattern) {
+		return ErrInvalidArgument
+	}
+	if _, err := a.db.Exec(upsertUserAccessQuery, username, toSQLWildcard(topicPattern), read, write); err != nil {
+		return err
+	}
+	return nil
+}
+
+// ResetAccess removes an access control list entry for a specific username/topic, or (if topic is
+// empty) for an entire user. The parameter topicPattern may include wildcards (*).
+func (a *SQLiteAuth) ResetAccess(username string, topicPattern string) error {
+	if !AllowedUsername(username) && username != Everyone && username != "" {
+		return ErrInvalidArgument
+	} else if !AllowedTopicPattern(topicPattern) && topicPattern != "" {
+		return ErrInvalidArgument
+	}
+	if username == "" && topicPattern == "" {
+		_, err := a.db.Exec(deleteAllAccessQuery, username)
+		return err
+	} else if topicPattern == "" {
+		_, err := a.db.Exec(deleteUserAccessQuery, username)
+		return err
+	}
+	_, err := a.db.Exec(deleteTopicAccessQuery, username, toSQLWildcard(topicPattern))
+	return err
+}
+
+// DefaultAccess returns the default read/write access if no access control entry matches
+func (a *SQLiteAuth) DefaultAccess() (read bool, write bool) {
+	return a.defaultRead, a.defaultWrite
+}
+
+func toSQLWildcard(s string) string {
+	return strings.ReplaceAll(s, "*", "%")
+}
+
+func fromSQLWildcard(s string) string {
+	return strings.ReplaceAll(s, "%", "*")
+}
+
+func setupAuthDB(db *sql.DB) error {
+	// If 'schemaVersion' table does not exist, this must be a new database
+	rowsSV, err := db.Query(selectSchemaVersionQuery)
+	if err != nil {
+		return setupNewAuthDB(db)
+	}
+	defer rowsSV.Close()
+
+	// If 'schemaVersion' table exists, read version and potentially upgrade
+	schemaVersion := 0
+	if !rowsSV.Next() {
+		return errors.New("cannot determine schema version: database file may be corrupt")
+	}
+	if err := rowsSV.Scan(&schemaVersion); err != nil {
+		return err
+	}
+	rowsSV.Close()
+
+	// Do migrations
+	if schemaVersion == currentSchemaVersion {
+		return nil
+	}
+	return fmt.Errorf("unexpected schema version found: %d", schemaVersion)
+}
+
+func setupNewAuthDB(db *sql.DB) error {
+	if _, err := db.Exec(createAuthTablesQueries); err != nil {
+		return err
+	}
+	if _, err := db.Exec(insertSchemaVersion, currentSchemaVersion); err != nil {
+		return err
+	}
+	return nil
+}

auth/auth_sqlite_test.go

@@ -0,0 +1,243 @@
+package auth_test
+
+import (
+	"github.com/stretchr/testify/require"
+	"heckel.io/ntfy/auth"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+const minBcryptTimingMillis = int64(50) // Ideally should be >100ms, but this should also run on a Raspberry Pi without massive resources
+
+func TestSQLiteAuth_FullScenario_Default_DenyAll(t *testing.T) {
+	a := newTestAuth(t, false, false)
+	require.Nil(t, a.AddUser("phil", "phil", auth.RoleAdmin))
+	require.Nil(t, a.AddUser("ben", "ben", auth.RoleUser))
+	require.Nil(t, a.AllowAccess("ben", "mytopic", true, true))
+	require.Nil(t, a.AllowAccess("ben", "readme", true, false))
+	require.Nil(t, a.AllowAccess("ben", "writeme", false, true))
+	require.Nil(t, a.AllowAccess("ben", "everyonewrite", false, false)) // How unfair!
+	require.Nil(t, a.AllowAccess(auth.Everyone, "announcements", true, false))
+	require.Nil(t, a.AllowAccess(auth.Everyone, "everyonewrite", true, true))
+	require.Nil(t, a.AllowAccess(auth.Everyone, "up*", false, true)) // Everyone can write to /up*
+
+	phil, err := a.Authenticate("phil", "phil")
+	require.Nil(t, err)
+	require.Equal(t, "phil", phil.Name)
+	require.True(t, strings.HasPrefix(phil.Hash, "$2a$10$"))
+	require.Equal(t, auth.RoleAdmin, phil.Role)
+	require.Equal(t, []auth.Grant{}, phil.Grants)
+
+	ben, err := a.Authenticate("ben", "ben")
+	require.Nil(t, err)
+	require.Equal(t, "ben", ben.Name)
+	require.True(t, strings.HasPrefix(ben.Hash, "$2a$10$"))
+	require.Equal(t, auth.RoleUser, ben.Role)
+	require.Equal(t, []auth.Grant{
+		{"mytopic", true, true},
+		{"readme", true, false},
+		{"writeme", false, true},
+		{"everyonewrite", false, false},
+	}, ben.Grants)
+
+	notben, err := a.Authenticate("ben", "this is wrong")
+	require.Nil(t, notben)
+	require.Equal(t, auth.ErrUnauthenticated, err)
+
+	// Admin can do everything
+	require.Nil(t, a.Authorize(phil, "sometopic", auth.PermissionWrite))
+	require.Nil(t, a.Authorize(phil, "mytopic", auth.PermissionRead))
+	require.Nil(t, a.Authorize(phil, "readme", auth.PermissionWrite))
+	require.Nil(t, a.Authorize(phil, "writeme", auth.PermissionWrite))
+	require.Nil(t, a.Authorize(phil, "announcements", auth.PermissionWrite))
+	require.Nil(t, a.Authorize(phil, "everyonewrite", auth.PermissionWrite))
+
+	// User cannot do everything
+	require.Nil(t, a.Authorize(ben, "mytopic", auth.PermissionWrite))
+	require.Nil(t, a.Authorize(ben, "mytopic", auth.PermissionRead))
+	require.Nil(t, a.Authorize(ben, "readme", auth.PermissionRead))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(ben, "readme", auth.PermissionWrite))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(ben, "writeme", auth.PermissionRead))
+	require.Nil(t, a.Authorize(ben, "writeme", auth.PermissionWrite))
+	require.Nil(t, a.Authorize(ben, "writeme", auth.PermissionWrite))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(ben, "everyonewrite", auth.PermissionRead))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(ben, "everyonewrite", auth.PermissionWrite))
+	require.Nil(t, a.Authorize(ben, "announcements", auth.PermissionRead))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(ben, "announcements", auth.PermissionWrite))
+
+	// Everyone else can do barely anything
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(nil, "sometopicnotinthelist", auth.PermissionRead))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(nil, "sometopicnotinthelist", auth.PermissionWrite))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(nil, "mytopic", auth.PermissionRead))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(nil, "mytopic", auth.PermissionWrite))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(nil, "readme", auth.PermissionRead))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(nil, "readme", auth.PermissionWrite))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(nil, "writeme", auth.PermissionRead))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(nil, "writeme", auth.PermissionWrite))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(nil, "announcements", auth.PermissionWrite))
+	require.Nil(t, a.Authorize(nil, "announcements", auth.PermissionRead))
+	require.Nil(t, a.Authorize(nil, "everyonewrite", auth.PermissionRead))
+	require.Nil(t, a.Authorize(nil, "everyonewrite", auth.PermissionWrite))
+	require.Nil(t, a.Authorize(nil, "up1234", auth.PermissionWrite)) // Wildcard permission
+	require.Nil(t, a.Authorize(nil, "up5678", auth.PermissionWrite))
+}
+
+func TestSQLiteAuth_AddUser_Invalid(t *testing.T) {
+	a := newTestAuth(t, false, false)
+	require.Equal(t, auth.ErrInvalidArgument, a.AddUser("  invalid  ", "pass", auth.RoleAdmin))
+	require.Equal(t, auth.ErrInvalidArgument, a.AddUser("validuser", "pass", "invalid-role"))
+}
+
+func TestSQLiteAuth_AddUser_Timing(t *testing.T) {
+	a := newTestAuth(t, false, false)
+	start := time.Now().UnixMilli()
+	require.Nil(t, a.AddUser("user", "pass", auth.RoleAdmin))
+	require.GreaterOrEqual(t, time.Now().UnixMilli()-start, minBcryptTimingMillis)
+}
+
+func TestSQLiteAuth_Authenticate_Timing(t *testing.T) {
+	a := newTestAuth(t, false, false)
+	require.Nil(t, a.AddUser("user", "pass", auth.RoleAdmin))
+
+	// Timing a correct attempt
+	start := time.Now().UnixMilli()
+	_, err := a.Authenticate("user", "pass")
+	require.Nil(t, err)
+	require.GreaterOrEqual(t, time.Now().UnixMilli()-start, minBcryptTimingMillis)
+
+	// Timing an incorrect attempt
+	start = time.Now().UnixMilli()
+	_, err = a.Authenticate("user", "INCORRECT")
+	require.Equal(t, auth.ErrUnauthenticated, err)
+	require.GreaterOrEqual(t, time.Now().UnixMilli()-start, minBcryptTimingMillis)
+
+	// Timing a non-existing user attempt
+	start = time.Now().UnixMilli()
+	_, err = a.Authenticate("DOES-NOT-EXIST", "hithere")
+	require.Equal(t, auth.ErrUnauthenticated, err)
+	require.GreaterOrEqual(t, time.Now().UnixMilli()-start, minBcryptTimingMillis)
+}
+
+func TestSQLiteAuth_UserManagement(t *testing.T) {
+	a := newTestAuth(t, false, false)
+	require.Nil(t, a.AddUser("phil", "phil", auth.RoleAdmin))
+	require.Nil(t, a.AddUser("ben", "ben", auth.RoleUser))
+	require.Nil(t, a.AllowAccess("ben", "mytopic", true, true))
+	require.Nil(t, a.AllowAccess("ben", "readme", true, false))
+	require.Nil(t, a.AllowAccess("ben", "writeme", false, true))
+	require.Nil(t, a.AllowAccess("ben", "everyonewrite", false, false)) // How unfair!
+	require.Nil(t, a.AllowAccess(auth.Everyone, "announcements", true, false))
+	require.Nil(t, a.AllowAccess(auth.Everyone, "everyonewrite", true, true))
+
+	// Query user details
+	phil, err := a.User("phil")
+	require.Nil(t, err)
+	require.Equal(t, "phil", phil.Name)
+	require.True(t, strings.HasPrefix(phil.Hash, "$2a$10$"))
+	require.Equal(t, auth.RoleAdmin, phil.Role)
+	require.Equal(t, []auth.Grant{}, phil.Grants)
+
+	ben, err := a.User("ben")
+	require.Nil(t, err)
+	require.Equal(t, "ben", ben.Name)
+	require.True(t, strings.HasPrefix(ben.Hash, "$2a$10$"))
+	require.Equal(t, auth.RoleUser, ben.Role)
+	require.Equal(t, []auth.Grant{
+		{"mytopic", true, true},
+		{"readme", true, false},
+		{"writeme", false, true},
+		{"everyonewrite", false, false},
+	}, ben.Grants)
+
+	everyone, err := a.User(auth.Everyone)
+	require.Nil(t, err)
+	require.Equal(t, "*", everyone.Name)
+	require.Equal(t, "", everyone.Hash)
+	require.Equal(t, auth.RoleAnonymous, everyone.Role)
+	require.Equal(t, []auth.Grant{
+		{"announcements", true, false},
+		{"everyonewrite", true, true},
+	}, everyone.Grants)
+
+	// Ben: Before revoking
+	require.Nil(t, a.AllowAccess("ben", "mytopic", true, true))
+	require.Nil(t, a.AllowAccess("ben", "readme", true, false))
+	require.Nil(t, a.AllowAccess("ben", "writeme", false, true))
+	require.Nil(t, a.Authorize(ben, "mytopic", auth.PermissionRead))
+	require.Nil(t, a.Authorize(ben, "mytopic", auth.PermissionWrite))
+	require.Nil(t, a.Authorize(ben, "readme", auth.PermissionRead))
+	require.Nil(t, a.Authorize(ben, "writeme", auth.PermissionWrite))
+
+	// Revoke access for "ben" to "mytopic", then check again
+	require.Nil(t, a.ResetAccess("ben", "mytopic"))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(ben, "mytopic", auth.PermissionWrite)) // Revoked
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(ben, "mytopic", auth.PermissionRead))  // Revoked
+	require.Nil(t, a.Authorize(ben, "readme", auth.PermissionRead))                           // Unchanged
+	require.Nil(t, a.Authorize(ben, "writeme", auth.PermissionWrite))                         // Unchanged
+
+	// Revoke rest of the access
+	require.Nil(t, a.ResetAccess("ben", ""))
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(ben, "readme", auth.PermissionRead))    // Revoked
+	require.Equal(t, auth.ErrUnauthorized, a.Authorize(ben, "wrtiteme", auth.PermissionWrite)) // Revoked
+
+	// User list
+	users, err := a.Users()
+	require.Nil(t, err)
+	require.Equal(t, 3, len(users))
+	require.Equal(t, "phil", users[0].Name)
+	require.Equal(t, "ben", users[1].Name)
+	require.Equal(t, "*", users[2].Name)
+
+	// Remove user
+	require.Nil(t, a.RemoveUser("ben"))
+	_, err = a.User("ben")
+	require.Equal(t, auth.ErrNotFound, err)
+
+	users, err = a.Users()
+	require.Nil(t, err)
+	require.Equal(t, 2, len(users))
+	require.Equal(t, "phil", users[0].Name)
+	require.Equal(t, "*", users[1].Name)
+}
+
+func TestSQLiteAuth_ChangePassword(t *testing.T) {
+	a := newTestAuth(t, false, false)
+	require.Nil(t, a.AddUser("phil", "phil", auth.RoleAdmin))
+
+	_, err := a.Authenticate("phil", "phil")
+	require.Nil(t, err)
+
+	require.Nil(t, a.ChangePassword("phil", "newpass"))
+	_, err = a.Authenticate("phil", "phil")
+	require.Equal(t, auth.ErrUnauthenticated, err)
+	_, err = a.Authenticate("phil", "newpass")
+	require.Nil(t, err)
+}
+
+func TestSQLiteAuth_ChangeRole(t *testing.T) {
+	a := newTestAuth(t, false, false)
+	require.Nil(t, a.AddUser("ben", "ben", auth.RoleUser))
+	require.Nil(t, a.AllowAccess("ben", "mytopic", true, true))
+	require.Nil(t, a.AllowAccess("ben", "readme", true, false))
+
+	ben, err := a.User("ben")
+	require.Nil(t, err)
+	require.Equal(t, auth.RoleUser, ben.Role)
+	require.Equal(t, 2, len(ben.Grants))
+
+	require.Nil(t, a.ChangeRole("ben", auth.RoleAdmin))
+
+	ben, err = a.User("ben")
+	require.Nil(t, err)
+	require.Equal(t, auth.RoleAdmin, ben.Role)
+	require.Equal(t, 0, len(ben.Grants))
+}
+
+func newTestAuth(t *testing.T, defaultRead, defaultWrite bool) *auth.SQLiteAuth {
+	filename := filepath.Join(t.TempDir(), "user.db")
+	a, err := auth.NewSQLiteAuth(filename, defaultRead, defaultWrite)
+	require.Nil(t, err)
+	return a
+}

ban/service.go

@@ -1,185 +0,0 @@
-// Package ban implements the abuse ban-feed: it tracks per-prefix weighted "strikes" from rejected
-// requests and appends breaching prefixes to a ban file that fail2ban tails. Keying by prefix (not
-// by visitor) makes the accounting match the unit fail2ban bans, even for shared account visitors.
-package ban
-
-import (
-	"fmt"
-	"net/netip"
-	"os"
-	"sync"
-	"time"
-
-	"golang.org/x/time/rate"
-	"heckel.io/ntfy/v2/log"
-)
-
-const (
-	tag           = "ban"
-	pruneInterval = 10 * time.Minute
-	writeInterval = 3 * time.Second
-)
-
-// Config is the Service's config, kept separate from server.Config to avoid an import cycle.
-type Config struct {
-	File           string        // Ban file that fail2ban tails (must be non-empty; the caller decides whether the feature is enabled)
-	Window         time.Duration // Rolling window over which weighted strikes are counted
-	Threshold      int           // Weighted strikes per Window before a prefix is banned
-	Weights        Weights       // Code matcher -> strike weight (0 = exempt)
-	PrefixBitsIPv4 int           // Mask width for the ban unit, e.g. 32 (matches rate-limiting granularity)
-	PrefixBitsIPv6 int           // Mask width for the ban unit, e.g. 64
-}
-
-// tracker is the per-prefix strike state: a weighted breach detector plus timestamps for pruning and throttling.
-type tracker struct {
-	limiter *rate.Limiter
-	seen    time.Time // Last strike, for pruning idle prefixes
-	emitted time.Time // Last ban-line write for this prefix, throttles re-emits to once per Window
-}
-
-// Service owns the ban-feed: per-prefix strike accounting, buffered file writes, and idle-prefix
-// pruning. The caller owns the enable/disable decision -- only construct a Service when the feature
-// is on (see server.New, which builds one only when a ban file is configured).
-type Service struct {
-	conf      *Config
-	mu        sync.Mutex // Guards trackers and pending
-	trackers  map[netip.Prefix]*tracker
-	pending   []string      // Formatted ban lines buffered by Record, flushed to the ban file by runWriteLoop
-	writeDone chan struct{} // Closed when runWriteLoop exits after its final flush
-	closeChan chan struct{}
-	closeOnce sync.Once
-}
-
-// NewService builds a Service and starts its background loops. The caller must only call it when the
-// feature is enabled (conf non-nil, File non-empty); the Service does not model a disabled state.
-func NewService(conf *Config) *Service {
-	s := &Service{
-		conf:      conf,
-		trackers:  make(map[netip.Prefix]*tracker),
-		closeChan: make(chan struct{}),
-		writeDone: make(chan struct{}),
-	}
-	go s.runPruneLoop()
-	go s.runWriteLoop()
-	return s
-}
-
-// Record counts one rejection against the IP's prefix bucket and, on breach, buffers a ban line
-// (throttled to once per Window per prefix). No-ops for a non-4xx/5xx status or a zero-weight code.
-func (s *Service) Record(ip netip.Addr, httpCode, errorCode int) {
-	if httpCode < 400 {
-		return
-	}
-	weight := s.conf.Weights.WeightFor(errorCode)
-	if weight == 0 {
-		return // Weight 0: exempt, no strike
-	}
-	prefix := s.prefix(ip)
-	now := time.Now()
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	t := s.trackers[prefix]
-	if t == nil {
-		t = &tracker{limiter: rate.NewLimiter(rate.Limit(float64(s.conf.Threshold)/s.conf.Window.Seconds()), s.conf.Threshold)}
-		s.trackers[prefix] = t
-	}
-	t.seen = now
-	if t.limiter.AllowN(now, weight) {
-		return // Within the strike budget, no breach
-	}
-	if !t.emitted.IsZero() && now.Sub(t.emitted) < s.conf.Window {
-		return // Already emitted this prefix within the window (one ban line per prefix per window)
-	}
-	t.emitted = now
-	s.pending = append(s.pending, formatBanLine(now, ip, prefix, httpCode, errorCode))
-}
-
-// prefix masks ip to the ban unit (PrefixBitsIPv4/IPv6) -- what fail2ban bans, e.g. a whole /64.
-func (s *Service) prefix(ip netip.Addr) netip.Prefix {
-	if ip.Is4() {
-		return netip.PrefixFrom(ip, s.conf.PrefixBitsIPv4).Masked()
-	}
-	return netip.PrefixFrom(ip, s.conf.PrefixBitsIPv6).Masked()
-}
-
-// formatBanLine builds the "<RFC3339-UTC> <ip> <prefix> <http> <ntfy>" line the fail2ban filter
-// parses. The timestamp is captured at breach time, not flush time.
-func formatBanLine(t time.Time, ip netip.Addr, prefix netip.Prefix, httpCode, errorCode int) string {
-	return fmt.Sprintf("%s %s %s %d %d\n", t.UTC().Format(time.RFC3339), ip.String(), prefix.String(), httpCode, errorCode)
-}
-
-// runPruneLoop prunes idle prefixes until Close.
-func (s *Service) runPruneLoop() {
-	ticker := time.NewTicker(pruneInterval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ticker.C:
-			s.prune()
-		case <-s.closeChan:
-			return
-		}
-	}
-}
-
-// runWriteLoop flushes buffered ban lines every writeInterval, plus a final flush on Close.
-func (s *Service) runWriteLoop() {
-	defer close(s.writeDone)
-	ticker := time.NewTicker(writeInterval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ticker.C:
-			s.flush()
-		case <-s.closeChan:
-			s.flush()
-			return
-		}
-	}
-}
-
-// flush appends the buffered lines to the file in one open/write. Best-effort: a batch is dropped on
-// error. Concurrent calls are safe -- pending is drained under mu, so only one flush writes a batch.
-func (s *Service) flush() {
-	s.mu.Lock()
-	lines := s.pending
-	s.pending = nil
-	s.mu.Unlock()
-	if len(lines) == 0 {
-		return
-	}
-	f, err := os.OpenFile(s.conf.File, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
-	if err != nil {
-		log.Tag(tag).Err(err).Warn("Cannot open ban file %s, dropped %d ban(s)", s.conf.File, len(lines))
-		return
-	}
-	defer f.Close()
-	for i, line := range lines {
-		if _, err := f.WriteString(line); err != nil {
-			log.Tag(tag).Err(err).Warn("Cannot write to ban file %s, dropped %d ban(s)", s.conf.File, len(lines)-i)
-			return
-		}
-	}
-}
-
-// prune drops prefixes idle for a full Window -- their bucket has refilled, so forgetting them is a
-// no-op that bounds memory under a flood of distinct IPs.
-func (s *Service) prune() {
-	now := time.Now()
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	for prefix, t := range s.trackers {
-		if now.Sub(t.seen) >= s.conf.Window {
-			delete(s.trackers, prefix)
-		}
-	}
-}
-
-// Close stops the loops and blocks until the final flush completes. Idempotent.
-func (s *Service) Close() {
-	s.closeOnce.Do(func() {
-		close(s.closeChan)
-		<-s.writeDone
-	})
-}

ban/service_test.go

@@ -1,253 +0,0 @@
-package ban
-
-import (
-	"net/netip"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-var testIP = netip.MustParseAddr("1.2.3.4")
-
-// newTestService creates a Service wired for testing, with the given ban file, weighted-bucket
-// threshold, and weights, plus a 1-minute window (so the emit throttle only fires once per test).
-func newTestService(t *testing.T, banFile string, threshold int, weights map[string]int) *Service {
-	t.Helper()
-	s := NewService(&Config{
-		File:           banFile,
-		Window:         time.Minute,
-		Threshold:      threshold,
-		Weights:        weights,
-		PrefixBitsIPv4: 32,
-		PrefixBitsIPv6: 64,
-	})
-	t.Cleanup(s.Close)
-	return s
-}
-
-// flushAndRead forces a synchronous flush of the buffered bans (writes are otherwise async, on the
-// runWriteLoop ticker) and returns the ban file's lines.
-func flushAndRead(t *testing.T, s *Service, path string) []string {
-	t.Helper()
-	s.flush()
-	data, err := os.ReadFile(path)
-	require.NoError(t, err)
-	return strings.Split(strings.TrimRight(string(data), "\n"), "\n")
-}
-
-func TestService_Record_Weight2BansAtHalfThreshold(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	// Threshold 10, code weight 2 -> the budget covers exactly 5 hits, so the 6th breaches.
-	s := newTestService(t, banFile, 10, map[string]int{"*": 2})
-	for i := 0; i < 5; i++ {
-		s.Record(testIP, 400, 40001)
-	}
-	s.flush()
-	require.NoFileExists(t, banFile) // 5 hits * weight 2 = 10 == budget, exactly at the limit, not over
-	s.Record(testIP, 400, 40001)     // 6th hit cannot be covered -> breach
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-	require.True(t, strings.HasSuffix(lines[0], " 1.2.3.4 1.2.3.4/32 400 40001")) // <ip> <prefix> <http> <ntfy-code>
-}
-
-func TestService_Record_Weight10BansFast(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	// Threshold 10, code weight 10 -> a single hit drains the whole budget, so the 2nd breaches.
-	s := newTestService(t, banFile, 10, map[string]int{"42909": 10, "*": 1})
-	s.Record(testIP, 429, 42909)
-	s.flush()
-	require.NoFileExists(t, banFile)
-	s.Record(testIP, 429, 42909) // 2nd hit cannot be covered -> breach
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-	require.True(t, strings.HasSuffix(lines[0], " 1.2.3.4 1.2.3.4/32 429 42909"))
-}
-
-func TestService_Record_Weight0NeverBans(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	// The legit-quota code is exempt (weight 0), so no number of hits ever bans.
-	s := newTestService(t, banFile, 10, map[string]int{"42908": 0, "*": 1})
-	for i := 0; i < 100; i++ {
-		s.Record(testIP, 429, 42908)
-	}
-	s.flush()
-	require.NoFileExists(t, banFile)
-}
-
-func TestService_Record_SingleBucketNoRelaxation(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	// One shared bucket per prefix: different codes draw down the SAME budget, so mixing them creates
-	// no extra headroom (unlike per-code buckets, which would relax the effective limit for a mixed
-	// offender).
-	s := newTestService(t, banFile, 10, map[string]int{"403*": 2, "*": 1})
-	s.Record(testIP, 403, 40301) // weight 2 -> 8 left
-	s.Record(testIP, 403, 40301) // weight 2 -> 6 left
-	s.Record(testIP, 403, 40301) // weight 2 -> 4 left
-	s.flush()
-	require.NoFileExists(t, banFile)
-	for i := 0; i < 4; i++ {
-		s.Record(testIP, 400, 40001) // weight 1 each -> drains the remaining 4 -> 0 left
-	}
-	s.flush()
-	require.NoFileExists(t, banFile) // 6 + 4 = 10 == budget exactly, still not over
-	s.Record(testIP, 400, 40001)     // one more cannot be covered -> breach
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-}
-
-func TestService_Record_ExactLineFormat(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 1, map[string]int{"*": 1})
-	before := time.Now().UTC().Truncate(time.Second)
-	for i := 0; i < 3; i++ {
-		s.Record(testIP, 429, 42901)
-	}
-	after := time.Now().UTC()
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-	parts := strings.Split(lines[0], " ")
-	require.Len(t, parts, 5) // "<timestamp> <ip> <prefix> <http-code> <ntfy-code>"
-	ts, err := time.Parse(time.RFC3339, parts[0])
-	require.NoError(t, err)
-	require.Equal(t, time.UTC, ts.Location())
-	require.False(t, ts.Before(before))
-	require.False(t, ts.After(after.Add(time.Second)))
-	require.Equal(t, "1.2.3.4", parts[1])    // full IP
-	require.Equal(t, "1.2.3.4/32", parts[2]) // masked to the default IPv4 prefix (/32)
-	require.Equal(t, "429", parts[3])        // HTTP status
-	require.Equal(t, "42901", parts[4])      // ntfy code
-}
-
-func TestService_Record_IPv6MaskedToPrefix(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 1, map[string]int{"*": 1})
-	ip := netip.MustParseAddr("2001:db8::abcd")
-	for i := 0; i < 3; i++ {
-		s.Record(ip, 429, 42901)
-	}
-	parts := strings.Split(flushAndRead(t, s, banFile)[0], " ")
-	require.Len(t, parts, 5)
-	require.Equal(t, "2001:db8::abcd", parts[1]) // full IPv6 address
-	require.Equal(t, "2001:db8::/64", parts[2])  // masked to the default IPv6 prefix (/64)
-}
-
-func TestService_Record_PerPrefixIsolation(t *testing.T) {
-	// Each source prefix gets its own bucket: one IP hammering to a breach must not push a different,
-	// quiet IP over the edge. This is the whole point of keying by prefix instead of by visitor.
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 2, map[string]int{"*": 1})
-	noisy := netip.MustParseAddr("1.1.1.1")
-	quiet := netip.MustParseAddr("2.2.2.2")
-	for i := 0; i < 5; i++ {
-		s.Record(noisy, 429, 42901) // breaches its own bucket
-	}
-	s.Record(quiet, 429, 42901) // single hit, well under threshold
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1) // only the noisy prefix is written
-	require.True(t, strings.HasSuffix(lines[0], " 1.1.1.1 1.1.1.1/32 429 42901"))
-}
-
-func TestService_Record_OncePerWindowThrottle(t *testing.T) {
-	// Once a prefix has been written, further breaches within the window must not re-append it, so a
-	// persistent offender produces exactly one line per window (mirrors the old per-visitor banEmit).
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 1, map[string]int{"*": 1})
-	for i := 0; i < 50; i++ {
-		s.Record(testIP, 429, 42901)
-	}
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-}
-
-func TestService_Record_BansPassedIP(t *testing.T) {
-	// The Service bans the exact IP passed to Record -- the caller passes the offending request's IP,
-	// which for an account-keyed visitor is not the visitor's stored IP.
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 1, map[string]int{"*": 1})
-	offender := netip.MustParseAddr("5.6.7.8")
-	for i := 0; i < 3; i++ {
-		s.Record(offender, 429, 42901)
-	}
-	parts := strings.Split(flushAndRead(t, s, banFile)[0], " ")
-	require.Equal(t, "5.6.7.8", parts[1])    // the IP passed to Record
-	require.Equal(t, "5.6.7.8/32", parts[2]) // its prefix
-}
-
-func TestService_Record_Ignores2xx3xx(t *testing.T) {
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 3, map[string]int{"*": 1})
-	// Success and redirects must never count toward a ban, even over the threshold -- otherwise a
-	// legit high-volume publisher (lots of 200s) would get banned.
-	for i := 0; i < 20; i++ {
-		s.Record(testIP, 200, 20000)
-		s.Record(testIP, 302, 30000)
-	}
-	s.flush()
-	require.NoFileExists(t, banFile)
-	// A 4xx over the same budget still gets written.
-	for i := 0; i < 5; i++ {
-		s.Record(testIP, 400, 40001)
-	}
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-	require.True(t, strings.HasSuffix(lines[0], " 1.2.3.4 1.2.3.4/32 400 40001"))
-}
-
-func TestService_Record_BuffersUntilFlush(t *testing.T) {
-	// Writes are async: a breach buffers the ban line rather than writing it synchronously on the
-	// request path. The line only reaches the file when runWriteLoop (or an explicit flush) runs.
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 1, map[string]int{"*": 1})
-	for i := 0; i < 3; i++ {
-		s.Record(testIP, 429, 42901)
-	}
-	require.NoFileExists(t, banFile) // not written synchronously
-	s.mu.Lock()
-	require.Len(t, s.pending, 1) // one line buffered (throttled to once per window)
-	s.mu.Unlock()
-	lines := flushAndRead(t, s, banFile)
-	require.Len(t, lines, 1)
-	require.True(t, strings.HasSuffix(lines[0], " 1.2.3.4 1.2.3.4/32 429 42901"))
-}
-
-func TestService_Close_FlushesPending(t *testing.T) {
-	// Close must flush buffered bans so nothing is lost on shutdown, and must block until it has.
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := NewService(&Config{File: banFile, Window: time.Minute, Threshold: 1, Weights: Weights{"*": 1}, PrefixBitsIPv4: 32, PrefixBitsIPv6: 64})
-	for i := 0; i < 3; i++ {
-		s.Record(testIP, 429, 42901)
-	}
-	require.NoFileExists(t, banFile) // still buffered
-	s.Close()                        // blocks until the final flush completes
-	data, err := os.ReadFile(banFile)
-	require.NoError(t, err)
-	require.Len(t, strings.Split(strings.TrimRight(string(data), "\n"), "\n"), 1)
-}
-
-func TestService_Prune_DropsIdlePrefixes(t *testing.T) {
-	// A prefix idle for a full window has a refilled bucket, so prune drops it to bound memory. An
-	// active prefix (seen within the window) is kept.
-	banFile := filepath.Join(t.TempDir(), "ban.log")
-	s := newTestService(t, banFile, 10, map[string]int{"*": 1})
-	idle := netip.MustParseAddr("9.9.9.9")
-	s.Record(idle, 400, 40001)
-	s.Record(testIP, 400, 40001)
-	require.Len(t, s.trackers, 2)
-
-	// Backdate the idle prefix past the window, then prune.
-	idlePrefix := s.prefix(idle)
-	s.mu.Lock()
-	s.trackers[idlePrefix].seen = time.Now().Add(-2 * time.Minute)
-	s.mu.Unlock()
-	s.prune()
-
-	require.Len(t, s.trackers, 1)
-	_, ok := s.trackers[idlePrefix]
-	require.False(t, ok) // idle prefix dropped
-	_, ok = s.trackers[s.prefix(testIP)]
-	require.True(t, ok) // active prefix kept
-}

ban/weights.go

@@ -1,83 +0,0 @@
-package ban
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-)
-
-// Weights maps a matcher key to a strike weight for the abuse ban-feed (see ParseWeights, WeightFor).
-type Weights map[string]int
-
-// ParseWeights normalizes a list like ["42909:10","403:2","*:1"] into a Weights map. A key is an
-// exact ntfy code, a family ("429*"), a bare HTTP status ("403" -> "403*"), or "*"; weights are ints
-// >= 0 (0 = exempt). Malformed entries are rejected so misconfiguration fails at startup.
-func ParseWeights(entries []string) (Weights, error) {
-	out := make(Weights, len(entries))
-	for _, entry := range entries {
-		key, weightStr, ok := strings.Cut(entry, ":")
-		if !ok {
-			return nil, fmt.Errorf("invalid ban-weight %q, want KEY:WEIGHT", entry)
-		}
-		weight, err := strconv.Atoi(strings.TrimSpace(weightStr))
-		if err != nil || weight < 0 {
-			return nil, fmt.Errorf("invalid ban-weight value in %q, want a non-negative integer", entry)
-		}
-		key = strings.TrimSpace(key)
-		if !validWeightKey(key) {
-			return nil, fmt.Errorf("invalid ban-weight key in %q, want %q, an ntfy code, an HTTP status, or a PREFIX*", entry, "*")
-		}
-		// A bare 3-digit HTTP status is shorthand for the whole family (e.g. "403" -> "403*").
-		if len(key) == 3 && isAllDigits(key) {
-			key += "*"
-		}
-		out[key] = weight
-	}
-	return out, nil
-}
-
-// WeightFor returns the strike weight for an ntfy error code, longest-match-wins (exact > family > "*").
-// If nothing matches (no "*" catch-all) it returns the implied default 1, so a forgotten "*" still
-// bans; use "*:0" to exempt everything not explicitly weighted.
-func (w Weights) WeightFor(errorCode int) int {
-	code := strconv.Itoa(errorCode)
-	weight, bestLen, matched := 0, -1, false
-	for key, wt := range w {
-		matchLen := -1
-		switch {
-		case key == "*":
-			matchLen = 0
-		case strings.HasSuffix(key, "*"):
-			if prefix := strings.TrimSuffix(key, "*"); strings.HasPrefix(code, prefix) {
-				matchLen = len(prefix)
-			}
-		case key == code:
-			matchLen = len(code)
-		}
-		if matchLen > bestLen {
-			weight, bestLen, matched = wt, matchLen, true
-		}
-	}
-	if !matched {
-		return 1
-	}
-	return weight
-}
-
-// validWeightKey reports whether key is a legal matcher: "*", an all-digits code, or DIGITS*.
-func validWeightKey(key string) bool {
-	if key == "*" {
-		return true
-	}
-	digits := strings.TrimSuffix(key, "*")
-	return digits != "" && isAllDigits(digits)
-}
-
-func isAllDigits(s string) bool {
-	for _, r := range s {
-		if r < '0' || r > '9' {
-			return false
-		}
-	}
-	return s != ""
-}

ban/weights_test.go

@@ -1,73 +0,0 @@
-package ban
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestParseWeights(t *testing.T) {
-	// Exact codes, a bare 3-digit HTTP status (normalized to a family), an exempt code, and "*".
-	weights, err := ParseWeights([]string{"42909:10", "403:2", "42908:0", "*:1"})
-	require.NoError(t, err)
-	require.Equal(t, Weights{"42909": 10, "403*": 2, "42908": 0, "*": 1}, weights)
-
-	// A bare 3-digit HTTP status normalizes to its family.
-	weights, err = ParseWeights([]string{"429:5"})
-	require.NoError(t, err)
-	require.Equal(t, Weights{"429*": 5}, weights)
-
-	// An explicit family key stays as-is.
-	weights, err = ParseWeights([]string{"429*:5"})
-	require.NoError(t, err)
-	require.Equal(t, Weights{"429*": 5}, weights)
-
-	// Weight 0 is valid and means exempt.
-	weights, err = ParseWeights([]string{"42908:0"})
-	require.NoError(t, err)
-	require.Equal(t, Weights{"42908": 0}, weights)
-
-	_, err = ParseWeights([]string{"401"}) // Missing weight
-	require.Error(t, err)
-	_, err = ParseWeights([]string{"401:-1"}) // Negative weight
-	require.Error(t, err)
-	_, err = ParseWeights([]string{"401:abc"}) // Non-integer weight
-	require.Error(t, err)
-	_, err = ParseWeights([]string{"abc:10"}) // Non-numeric key
-	require.Error(t, err)
-	_, err = ParseWeights([]string{"4*3:10"}) // Star not at the end
-	require.Error(t, err)
-}
-
-func TestWeights_WeightFor(t *testing.T) {
-	weights, err := ParseWeights([]string{"42908:0", "42903:0", "42905:0", "42910:0", "42909:10", "429*:1", "403*:2", "4*:1", "5*:1"})
-	require.NoError(t, err)
-	// Longest-match-wins: exact 5-digit beats "429*" beats "4*" beats "*".
-	require.Equal(t, 0, weights.WeightFor(42908))
-	require.Equal(t, 10, weights.WeightFor(42909))
-	require.Equal(t, 1, weights.WeightFor(42901))
-	require.Equal(t, 2, weights.WeightFor(40311))
-	require.Equal(t, 1, weights.WeightFor(40011))
-	require.Equal(t, 1, weights.WeightFor(50312))
-	// No rule matches (this config has 4*/5* but no "*"), so the implied default weight 1 applies.
-	require.Equal(t, 1, weights.WeightFor(30012))
-}
-
-func TestWeights_WeightFor_NoStarRuleImpliesWeight1(t *testing.T) {
-	// With no "*" rule, a code that matches nothing defaults to weight 1 (can be banned), so the
-	// feature can't be silently turned into a no-op by forgetting "*". Explicit codes still win.
-	weights, err := ParseWeights([]string{"42908:0", "42909:10"})
-	require.NoError(t, err)
-	require.Equal(t, 0, weights.WeightFor(42908))  // explicitly exempt
-	require.Equal(t, 10, weights.WeightFor(42909)) // explicit
-	require.Equal(t, 1, weights.WeightFor(42901))  // unmatched -> implied 1
-	require.Equal(t, 1, weights.WeightFor(40001))  // unmatched -> implied 1
-}
-
-func TestWeights_WeightFor_ExplicitStarZeroExemptsAll(t *testing.T) {
-	// An explicit "*:0" is the opt-out: exempt everything not otherwise weighted.
-	weights, err := ParseWeights([]string{"42909:10", "*:0"})
-	require.NoError(t, err)
-	require.Equal(t, 10, weights.WeightFor(42909)) // explicit
-	require.Equal(t, 0, weights.WeightFor(42901))  // *:0 -> exempt everything else
-}

client/client.go

@@ -3,31 +3,35 @@ package client
 
 import (
 	"bufio"
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/util"
+	"github.com/stretchr/testify/require"
+	"heckel.io/ntfy/crypto"
+	"heckel.io/ntfy/log"
+	"heckel.io/ntfy/util"
 	"io"
+	"mime/multipart"
 	"net/http"
-	"regexp"
+	"net/http/httptest"
 	"strings"
 	"sync"
 	"time"
 )
 
+// Event type constants
 const (
-	// MessageEvent identifies a message event
-	MessageEvent = "message"
+	MessageEvent     = "message"
+	KeepaliveEvent   = "keepalive"
+	OpenEvent        = "open"
+	PollRequestEvent = "poll_request"
 )
 
 const (
-	maxResponseBytes = 4096
-)
-
-var (
-	topicRegex = regexp.MustCompile(`^[-_A-Za-z0-9]{1,64}$`) // Same as in server/server.go
+	maxResponseBytes           = 4096
+	encryptedMessageBytesLimit = 100 * 1024 * 1024 // 100 MB
 )
 
 // Client is the ntfy client that can be used to publish and subscribe to ntfy topics
@@ -98,14 +102,61 @@ func (c *Client) Publish(topic, message string, options ...PublishOption) (*Mess
 // To pass title, priority and tags, check out WithTitle, WithPriority, WithTagsList, WithDelay, WithNoCache,
 // WithNoFirebase, and the generic WithHeader.
 func (c *Client) PublishReader(topic string, body io.Reader, options ...PublishOption) (*Message, error) {
-	topicURL, err := c.expandTopicURL(topic)
+	topicURL := util.ExpandTopicURL(topic, c.config.DefaultHost)
+	req, _ := http.NewRequest("POST", topicURL, body)
+	for _, option := range options {
+		if err := option(req); err != nil {
+			return nil, err
+		}
+	}
+	log.Debug("%s Publishing message with headers %s", util.ShortTopicURL(topicURL), req.Header)
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return nil, err
 	}
-	req, err := http.NewRequest("POST", topicURL, body)
+	defer resp.Body.Close()
+	b, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBytes))
 	if err != nil {
 		return nil, err
 	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, errors.New(strings.TrimSpace(string(b)))
+	}
+	m, err := toMessage(string(b), topicURL, "")
+	if err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (c *Client) PublishEncryptedReader(topic string, body io.Reader, password string, options ...PublishOption) (*Message, error) {
+	topicURL := util.ExpandTopicURL(topic, c.config.DefaultHost)
+	key := crypto.DeriveKey(password, topicURL)
+	peaked, err := util.PeekLimit(io.NopCloser(body), encryptedMessageBytesLimit)
+	if err != nil {
+		return nil, err
+	}
+	ciphertext, err := crypto.Encrypt(peaked.PeekedBytes, key)
+	if err != nil {
+		return nil, err
+	}
+	var b bytes.Buffer
+
+	body = strings.NewReader(ciphertext)
+	w := multipart.NewWriter(&b)
+	for _, part := range parts {
+		mw, _ := w.CreateFormField(part.key)
+		_, err := io.Copy(mw, strings.NewReader(part.value))
+		require.Nil(t, err)
+	}
+	require.Nil(t, w.Close())
+	rr := httptest.NewRecorder()
+	req, err := http.NewRequest(method, url, &b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req, _ := http.NewRequest("POST", topicURL, body)
+	req.Header.Set("X-Encoding", "jwe")
 	for _, option := range options {
 		if err := option(req); err != nil {
 			return nil, err
@@ -141,14 +192,11 @@ func (c *Client) PublishReader(topic string, body io.Reader, options ...PublishO
 // By default, all messages will be returned, but you can change this behavior using a SubscribeOption.
 // See WithSince, WithSinceAll, WithSinceUnixTime, WithScheduled, and the generic WithQueryParam.
 func (c *Client) Poll(topic string, options ...SubscribeOption) ([]*Message, error) {
-	topicURL, err := c.expandTopicURL(topic)
-	if err != nil {
-		return nil, err
-	}
 	ctx := context.Background()
 	messages := make([]*Message, 0)
 	msgChan := make(chan *Message)
 	errChan := make(chan error)
+	topicURL := util.ExpandTopicURL(topic, c.config.DefaultHost)
 	log.Debug("%s Polling from topic", util.ShortTopicURL(topicURL))
 	options = append(options, WithPoll())
 	go func() {
@@ -177,18 +225,15 @@ func (c *Client) Poll(topic string, options ...SubscribeOption) ([]*Message, err
 // Example:
 //
 //	c := client.New(client.NewConfig())
-//	subscriptionID, _ := c.Subscribe("mytopic")
+//	subscriptionID := c.Subscribe("mytopic")
 //	for m := range c.Messages {
 //	  fmt.Printf("New message: %s", m.Message)
 //	}
-func (c *Client) Subscribe(topic string, options ...SubscribeOption) (string, error) {
-	topicURL, err := c.expandTopicURL(topic)
-	if err != nil {
-		return "", err
-	}
+func (c *Client) Subscribe(topic string, options ...SubscribeOption) string {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	subscriptionID := util.RandomString(10)
+	topicURL := util.ExpandTopicURL(topic, c.config.DefaultHost)
 	log.Debug("%s Subscribing to topic", util.ShortTopicURL(topicURL))
 	ctx, cancel := context.WithCancel(context.Background())
 	c.subscriptions[subscriptionID] = &subscription{
@@ -197,7 +242,7 @@ func (c *Client) Subscribe(topic string, options ...SubscribeOption) (string, er
 		cancel:   cancel,
 	}
 	go handleSubscribeConnLoop(ctx, c.Messages, topicURL, subscriptionID, options...)
-	return subscriptionID, nil
+	return subscriptionID
 }
 
 // Unsubscribe unsubscribes from a topic that has been previously subscribed to using the unique
@@ -213,16 +258,22 @@ func (c *Client) Unsubscribe(subscriptionID string) {
 	sub.cancel()
 }
 
-func (c *Client) expandTopicURL(topic string) (string, error) {
-	if strings.HasPrefix(topic, "http://") || strings.HasPrefix(topic, "https://") {
-		return topic, nil
-	} else if strings.Contains(topic, "/") {
-		return fmt.Sprintf("https://%s", topic), nil
+// UnsubscribeAll unsubscribes from a topic that has been previously subscribed with Subscribe.
+// If there are multiple subscriptions matching the topic, all of them are unsubscribed from.
+//
+// A topic can be either a full URL (e.g. https://myhost.lan/mytopic), a short URL which is then prepended https://
+// (e.g. myhost.lan -> https://myhost.lan), or a short name which is expanded using the default host in the
+// config (e.g. mytopic -> https://ntfy.sh/mytopic).
+func (c *Client) UnsubscribeAll(topic string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	topicURL := util.ExpandTopicURL(topic, c.config.DefaultHost)
+	for _, sub := range c.subscriptions {
+		if sub.topicURL == topicURL {
+			delete(c.subscriptions, sub.ID)
+			sub.cancel()
+		}
 	}
-	if !topicRegex.MatchString(topic) {
-		return "", fmt.Errorf("invalid topic name: %s", topic)
-	}
-	return fmt.Sprintf("%s/%s", c.config.DefaultHost, topic), nil
 }
 
 func handleSubscribeConnLoop(ctx context.Context, msgChan chan *Message, topicURL, subcriptionID string, options ...SubscribeOption) {

client/client.yml

@@ -5,23 +5,14 @@
 #
 # default-host: https://ntfy.sh
 
-# Default credentials will be used with "ntfy publish" and "ntfy subscribe" if no other credentials are provided.
-# You can set a default token to use or a default user:password combination, but not both. For an empty password,
-# use empty double-quotes ("").
+# Defaults below will be used when a topic does not have its own settings
 #
-# To override the default user:password combination or default token for a particular subscription (e.g., to send
-# no Authorization header), set the user:pass/token for the subscription to empty double-quotes ("").
-
-# default-token:
-
 # default-user:
 # default-password:
-
-# Default command will execute after "ntfy subscribe" receives a message if no command is provided in subscription below
 # default-command:
 
 # Subscriptions to topics and their actions. This option is primarily used by the systemd service,
-# or if you can "ntfy subscribe --from-config" directly.
+# or if you cann "ntfy subscribe --from-config" directly.
 #
 # Example:
 #     subscribe:
@@ -35,8 +26,6 @@
 #         command: 'notify-send "$m"'
 #         user: phill
 #         password: mypass
-#       - topic: token_topic
-#         token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
 #
 # Variables:
 #     Variable        Aliases               Description

client/client_test.go

@@ -3,25 +3,18 @@ package client_test
 import (
 	"fmt"
 	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/client"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/test"
-	"os"
+	"heckel.io/ntfy/client"
+	"heckel.io/ntfy/test"
 	"testing"
 	"time"
 )
 
-func TestMain(m *testing.M) {
-	log.SetLevel(log.ErrorLevel)
-	os.Exit(m.Run())
-}
-
 func TestClient_Publish_Subscribe(t *testing.T) {
 	s, port := test.StartServer(t)
 	defer test.StopServer(t, s, port)
 	c := client.New(newTestConfig(port))
 
-	subscriptionID, _ := c.Subscribe("mytopic")
+	subscriptionID := c.Subscribe("mytopic")
 	time.Sleep(time.Second)
 
 	msg, err := c.Publish("mytopic", "some message")

client/config.go

@@ -2,7 +2,6 @@ package client
 
 import (
 	"gopkg.in/yaml.v2"
-	"heckel.io/ntfy/v2/log"
 	"os"
 )
 
@@ -11,27 +10,19 @@ const (
 	DefaultBaseURL = "https://ntfy.sh"
 )
 
-// DefaultConfigFile is the default path to the client config file (set in config_*.go)
-var DefaultConfigFile string
-
 // Config is the config struct for a Client
 type Config struct {
-	DefaultHost     string      `yaml:"default-host"`
-	DefaultUser     string      `yaml:"default-user"`
-	DefaultPassword *string     `yaml:"default-password"`
-	DefaultToken    string      `yaml:"default-token"`
-	DefaultCommand  string      `yaml:"default-command"`
-	Subscribe       []Subscribe `yaml:"subscribe"`
-}
-
-// Subscribe is the struct for a Subscription within Config
-type Subscribe struct {
-	Topic    string            `yaml:"topic"`
-	User     *string           `yaml:"user"`
-	Password *string           `yaml:"password"`
-	Token    *string           `yaml:"token"`
-	Command  string            `yaml:"command"`
-	If       map[string]string `yaml:"if"`
+	DefaultHost     string `yaml:"default-host"`
+	DefaultUser     string `yaml:"default-user"`
+	DefaultPassword string `yaml:"default-password"`
+	DefaultCommand  string `yaml:"default-command"`
+	Subscribe       []struct {
+		Topic    string            `yaml:"topic"`
+		User     string            `yaml:"user"`
+		Password string            `yaml:"password"`
+		Command  string            `yaml:"command"`
+		If       map[string]string `yaml:"if"`
+	} `yaml:"subscribe"`
 }
 
 // NewConfig creates a new Config struct for a Client
@@ -39,8 +30,7 @@ func NewConfig() *Config {
 	return &Config{
 		DefaultHost:     DefaultBaseURL,
 		DefaultUser:     "",
-		DefaultPassword: nil,
-		DefaultToken:    "",
+		DefaultPassword: "",
 		DefaultCommand:  "",
 		Subscribe:       nil,
 	}
@@ -48,7 +38,6 @@ func NewConfig() *Config {
 
 // LoadConfig loads the Client config from a yaml file
 func LoadConfig(filename string) (*Config, error) {
-	log.Debug("Loading client config from %s", filename)
 	b, err := os.ReadFile(filename)
 	if err != nil {
 		return nil, err

client/config_darwin.go

@@ -1,18 +0,0 @@
-//go:build darwin
-
-package client
-
-import (
-	"os"
-	"os/user"
-	"path/filepath"
-)
-
-func init() {
-	u, err := user.Current()
-	if err == nil && u.Uid == "0" {
-		DefaultConfigFile = "/etc/ntfy/client.yml"
-	} else if configDir, err := os.UserConfigDir(); err == nil {
-		DefaultConfigFile = filepath.Join(configDir, "ntfy", "client.yml")
-	}
-}

client/config_test.go

@@ -2,7 +2,7 @@ package client_test
 
 import (
 	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/client"
+	"heckel.io/ntfy/client"
 	"os"
 	"path/filepath"
 	"testing"
@@ -12,7 +12,7 @@ func TestConfig_Load(t *testing.T) {
 	filename := filepath.Join(t.TempDir(), "client.yml")
 	require.Nil(t, os.WriteFile(filename, []byte(`
 default-host: http://localhost
-default-user: philipp
+default-user: phil
 default-password: mypass
 default-command: 'echo "Got the message: $message"'
 subscribe:
@@ -31,14 +31,14 @@ subscribe:
 	conf, err := client.LoadConfig(filename)
 	require.Nil(t, err)
 	require.Equal(t, "http://localhost", conf.DefaultHost)
-	require.Equal(t, "philipp", conf.DefaultUser)
-	require.Equal(t, "mypass", *conf.DefaultPassword)
+	require.Equal(t, "phil", conf.DefaultUser)
+	require.Equal(t, "mypass", conf.DefaultPassword)
 	require.Equal(t, `echo "Got the message: $message"`, conf.DefaultCommand)
 	require.Equal(t, 4, len(conf.Subscribe))
 	require.Equal(t, "no-command-with-auth", conf.Subscribe[0].Topic)
 	require.Equal(t, "", conf.Subscribe[0].Command)
-	require.Equal(t, "phil", *conf.Subscribe[0].User)
-	require.Equal(t, "mypass", *conf.Subscribe[0].Password)
+	require.Equal(t, "phil", conf.Subscribe[0].User)
+	require.Equal(t, "mypass", conf.Subscribe[0].Password)
 	require.Equal(t, "echo-this", conf.Subscribe[1].Topic)
 	require.Equal(t, `echo "Message received: $message"`, conf.Subscribe[1].Command)
 	require.Equal(t, "alerts", conf.Subscribe[2].Topic)
@@ -46,95 +46,3 @@ subscribe:
 	require.Equal(t, "high,urgent", conf.Subscribe[2].If["priority"])
 	require.Equal(t, "defaults", conf.Subscribe[3].Topic)
 }
-
-func TestConfig_EmptyPassword(t *testing.T) {
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(`
-default-host: http://localhost
-default-user: philipp
-default-password: ""
-subscribe:
-  - topic: no-command-with-auth
-    user: phil
-    password: ""
-`), 0600))
-
-	conf, err := client.LoadConfig(filename)
-	require.Nil(t, err)
-	require.Equal(t, "http://localhost", conf.DefaultHost)
-	require.Equal(t, "philipp", conf.DefaultUser)
-	require.Equal(t, "", *conf.DefaultPassword)
-	require.Equal(t, 1, len(conf.Subscribe))
-	require.Equal(t, "no-command-with-auth", conf.Subscribe[0].Topic)
-	require.Equal(t, "", conf.Subscribe[0].Command)
-	require.Equal(t, "phil", *conf.Subscribe[0].User)
-	require.Equal(t, "", *conf.Subscribe[0].Password)
-}
-
-func TestConfig_NullPassword(t *testing.T) {
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(`
-default-host: http://localhost
-default-user: philipp
-default-password: ~
-subscribe:
-  - topic: no-command-with-auth
-    user: phil
-    password: ~
-`), 0600))
-
-	conf, err := client.LoadConfig(filename)
-	require.Nil(t, err)
-	require.Equal(t, "http://localhost", conf.DefaultHost)
-	require.Equal(t, "philipp", conf.DefaultUser)
-	require.Nil(t, conf.DefaultPassword)
-	require.Equal(t, 1, len(conf.Subscribe))
-	require.Equal(t, "no-command-with-auth", conf.Subscribe[0].Topic)
-	require.Equal(t, "", conf.Subscribe[0].Command)
-	require.Equal(t, "phil", *conf.Subscribe[0].User)
-	require.Nil(t, conf.Subscribe[0].Password)
-}
-
-func TestConfig_NoPassword(t *testing.T) {
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(`
-default-host: http://localhost
-default-user: philipp
-subscribe:
-  - topic: no-command-with-auth
-    user: phil
-`), 0600))
-
-	conf, err := client.LoadConfig(filename)
-	require.Nil(t, err)
-	require.Equal(t, "http://localhost", conf.DefaultHost)
-	require.Equal(t, "philipp", conf.DefaultUser)
-	require.Nil(t, conf.DefaultPassword)
-	require.Equal(t, 1, len(conf.Subscribe))
-	require.Equal(t, "no-command-with-auth", conf.Subscribe[0].Topic)
-	require.Equal(t, "", conf.Subscribe[0].Command)
-	require.Equal(t, "phil", *conf.Subscribe[0].User)
-	require.Nil(t, conf.Subscribe[0].Password)
-}
-
-func TestConfig_DefaultToken(t *testing.T) {
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(`
-default-host: http://localhost
-default-token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
-subscribe:
-  - topic: mytopic
-`), 0600))
-
-	conf, err := client.LoadConfig(filename)
-	require.Nil(t, err)
-	require.Equal(t, "http://localhost", conf.DefaultHost)
-	require.Equal(t, "", conf.DefaultUser)
-	require.Nil(t, conf.DefaultPassword)
-	require.Equal(t, "tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", conf.DefaultToken)
-	require.Equal(t, 1, len(conf.Subscribe))
-	require.Equal(t, "mytopic", conf.Subscribe[0].Topic)
-	require.Nil(t, conf.Subscribe[0].User)
-	require.Nil(t, conf.Subscribe[0].Password)
-	require.Nil(t, conf.Subscribe[0].Token)
-}

client/config_unix.go

@@ -1,18 +0,0 @@
-//go:build linux || dragonfly || freebsd || netbsd || openbsd
-
-package client
-
-import (
-	"os"
-	"os/user"
-	"path/filepath"
-)
-
-func init() {
-	u, err := user.Current()
-	if err == nil && u.Uid == "0" {
-		DefaultConfigFile = "/etc/ntfy/client.yml"
-	} else if configDir, err := os.UserConfigDir(); err == nil {
-		DefaultConfigFile = filepath.Join(configDir, "ntfy", "client.yml")
-	}
-}

client/config_windows.go

@@ -1,14 +0,0 @@
-//go:build windows
-
-package client
-
-import (
-	"os"
-	"path/filepath"
-)
-
-func init() {
-	if configDir, err := os.UserConfigDir(); err == nil {
-		DefaultConfigFile = filepath.Join(configDir, "ntfy", "client.yml")
-	}
-}

client/options.go

@@ -2,7 +2,7 @@ package client
 
 import (
 	"fmt"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/util"
 	"net/http"
 	"strings"
 	"time"
@@ -72,27 +72,11 @@ func WithAttach(attach string) PublishOption {
 	return WithHeader("X-Attach", attach)
 }
 
-// WithMarkdown instructs the server to interpret the message body as Markdown
-func WithMarkdown() PublishOption {
-	return WithHeader("X-Markdown", "yes")
-}
-
-// WithTemplate instructs the server to use a specific template for the message. If templateName is is "yes" or "1",
-// the server will interpret the message and title as a template.
-func WithTemplate(templateName string) PublishOption {
-	return WithHeader("X-Template", templateName)
-}
-
 // WithFilename sets a filename for the attachment, and/or forces the HTTP body to interpreted as an attachment
 func WithFilename(filename string) PublishOption {
 	return WithHeader("X-Filename", filename)
 }
 
-// WithSequenceID sets a sequence ID for the message, allowing updates to existing notifications
-func WithSequenceID(sequenceID string) PublishOption {
-	return WithHeader("X-Sequence-ID", sequenceID)
-}
-
 // WithEmail instructs the server to also send the message to the given e-mail address
 func WithEmail(email string) PublishOption {
 	return WithHeader("X-Email", email)
@@ -103,16 +87,6 @@ func WithBasicAuth(user, pass string) PublishOption {
 	return WithHeader("Authorization", util.BasicAuth(user, pass))
 }
 
-// WithBearerAuth adds the Authorization header for Bearer auth to the request
-func WithBearerAuth(token string) PublishOption {
-	return WithHeader("Authorization", fmt.Sprintf("Bearer %s", token))
-}
-
-// WithEmptyAuth clears the Authorization header
-func WithEmptyAuth() PublishOption {
-	return RemoveHeader("Authorization")
-}
-
 // WithNoCache instructs the server not to cache the message server-side
 func WithNoCache() PublishOption {
 	return WithHeader("X-Cache", "no")
@@ -123,6 +97,11 @@ func WithNoFirebase() PublishOption {
 	return WithHeader("X-Firebase", "no")
 }
 
+// WithEncrypted sets the encoding header to "jwe"
+func WithEncrypted() PublishOption {
+	return WithHeader("X-Encoding", "jwe")
+}
+
 // WithSince limits the number of messages returned from the server. The parameter since can be a Unix
 // timestamp (see WithSinceUnixTime), a duration (WithSinceDuration) the word "all" (see WithSinceAll).
 func WithSince(since string) SubscribeOption {
@@ -203,13 +182,3 @@ func WithQueryParam(param, value string) RequestOption {
 		return nil
 	}
 }
-
-// RemoveHeader is a generic option to remove a header from a request
-func RemoveHeader(header string) RequestOption {
-	return func(r *http.Request) error {
-		if header != "" {
-			delete(r.Header, header)
-		}
-		return nil
-	}
-}

client/user/ntfy-client.service

@@ -1,10 +0,0 @@
-[Unit]
-Description=ntfy client
-After=network.target
-
-[Service]
-ExecStart=/usr/bin/ntfy subscribe --config "%h/.config/ntfy/client.yml" --from-config
-Restart=on-failure
-
-[Install]
-WantedBy=default.target

cluster/cluster.go

@@ -1,113 +0,0 @@
-// Package cluster implements cross-node message delivery for a multi-node ntfy cluster. Nodes
-// register themselves in a PostgreSQL node registry (control plane) and fan published messages
-// out to each other directly over HTTP (data plane); PostgreSQL is never on the message path.
-// The single-node default is the nop cluster, which does nothing.
-package cluster
-
-import (
-	"errors"
-	"net/http"
-	"time"
-
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/model"
-)
-
-// The internal peer API: every kind of node-to-node communication is a path under
-// /v1/internal/, served only on the dedicated cluster listener. Future concerns (rate limit
-// counters, stats) become new paths or new sections of the state envelope.
-const (
-	// MessagePath receives batches of published messages (NDJSON, one apiMessage per line).
-	MessagePath = "/v1/internal/message"
-	// StatePath receives peer state (JSON apiState): full subscription snapshots and
-	// incremental updates.
-	StatePath = "/v1/internal/state"
-)
-
-// NodeID identifies a cluster node; it keys the registry, the per-peer queues, and the peer
-// state table.
-//
-// Naming convention: a "node" is any cluster member in the absolute sense (identity, registry,
-// config); a "peer" is another node as seen from this one (Peers, peerQueue, peerState). A peer
-// IS a node, which is why peer values carry a NodeID.
-type NodeID string
-
-const (
-	// secretHeader carries the shared secret authenticating node-to-node fan-out requests.
-	secretHeader = "X-Cluster-Secret"
-
-	// originHeader carries the sending node's ID on fan-out requests, so a node can skip
-	// requests that carry its own broadcasts (loop prevention).
-	originHeader = "X-Cluster-Origin"
-)
-
-// Content types of the peer API: message bodies are NDJSON (one JSON message per line, matching
-// the framing of ntfy's own /topic/json subscribe stream), state bodies are plain JSON. Future
-// node-to-node request types get their own paths on the cluster listener; an old node answering
-// 404 on an unknown path keeps mixed-version clusters working during rolling deploys.
-const (
-	contentTypeNDJSON = "application/x-ndjson"
-	contentTypeJSON   = "application/json"
-)
-
-const (
-	defaultHeartbeatInterval = 3 * time.Second  // How often a node refreshes its registry heartbeat
-	defaultNodeTTL           = 30 * time.Second // A node counts as live if its heartbeat is newer than this; generous to avoid false-dead flapping (see plans)
-	defaultStateInterval     = 15 * time.Second // How often the full subscription state is pushed to peers
-
-	// DefaultBatchLinger is how long a fan-out message may wait in a peer's queue for more
-	// messages to arrive, so they are delivered as one batch. It trades up to this much
-	// cross-node latency for a bounded request rate per peer.
-	DefaultBatchLinger = 500 * time.Millisecond
-)
-
-// Cluster fans published messages out to peer cluster nodes and receives their fan-out requests.
-// Local delivery to a node's own subscribers still happens inline in the server; the cluster
-// only covers the cross-node hop.
-type Cluster interface {
-	http.Handler
-	// ForwardMessage sends a locally published message on to the peer nodes that may have subscribers
-	// for its topic (all of them, when subscription knowledge is missing or stale). It is
-	// fire-and-forget and must not block the caller's request path.
-	ForwardMessage(m *model.Message) error
-	// BroadcastState pushes a subscription-state delta to ALL peers (unlike ForwardMessage,
-	// which routes), closing the routing-knowledge window to ~one round trip. Nop single-node.
-	BroadcastState(state *State)
-	// IsLeader reports whether this node holds the cluster leader lock. Singleton background
-	// jobs (e.g. the Firebase keepaliver) are gated on the leader.
-	IsLeader() bool
-	// Healthy reports whether this node is fit to serve: its registry heartbeat is fresh
-	// enough (within NodeTTL) that peers still forward messages to it. Health checkers must
-	// fail open (never pull ALL nodes): during a full database outage every node reports
-	// unhealthy while the mesh keeps delivering on stale peer caches.
-	Healthy() bool
-	// Close stops the cluster and releases its resources.
-	Close() error
-}
-
-// New creates the cluster for the given config: the nop cluster when clustering is disabled (the
-// single-node default), or the peer-mesh cluster otherwise.
-func New(conf *Config, pool *db.DB, deliver DeliverFunc, topics TopicsFunc) (Cluster, error) {
-	if !conf.Enabled {
-		return &nopCluster{}, nil
-	}
-	if pool == nil {
-		return nil, errors.New("cluster mode requires a PostgreSQL database (set database-url)")
-	}
-	if conf.AdvertiseURL == "" {
-		return nil, errors.New("cluster mode requires an advertise URL (set cluster-advertise-url)")
-	}
-	if conf.NodeID == "" {
-		return nil, errors.New("cluster mode requires a stable node ID (set cluster-node-id)")
-	}
-	if conf.HeartbeatInterval == 0 {
-		conf.HeartbeatInterval = defaultHeartbeatInterval
-	}
-	if conf.NodeTTL == 0 {
-		conf.NodeTTL = defaultNodeTTL
-	}
-	if conf.StateInterval == 0 {
-		conf.StateInterval = defaultStateInterval
-	}
-	return newMeshCluster(conf, pool, deliver, topics)
-}

cluster/cluster_load_test.go

@@ -1,133 +0,0 @@
-package cluster
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	dbtest "heckel.io/ntfy/v2/db/test"
-	"heckel.io/ntfy/v2/model"
-)
-
-// TestMesh_Soak floods the mesh with concurrent publishers and asserts exact delivery: every
-// message reaches the peer exactly once, nothing is dropped, and batching keeps the request
-// count far below the message count. Skipped unless NTFY_TEST_SOAK is set (it takes a few
-// seconds and is meant for pre-deploy verification, not the regular suite).
-func TestMesh_Soak(t *testing.T) {
-	if os.Getenv("NTFY_TEST_SOAK") == "" {
-		t.Skip("NTFY_TEST_SOAK not set")
-	}
-	// ~1000 msg/s aggregate (10x the ntfy.sh peak of ~88 msg/s): each publisher paces itself to
-	// 100 msg/s. Unthrottled publishing intentionally overruns the bounded per-peer queue (load
-	// shedding by design), so a zero-drop assertion only holds below the drain ceiling.
-	const (
-		publishers           = 10
-		messagesPerPublisher = 300
-		publishInterval      = 10 * time.Millisecond
-		total                = publishers * messagesPerPublisher
-	)
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	received := make(map[string]int, total) // message body -> count, to catch duplicates
-	requests := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		require.Nil(t, err)
-		messages, err := unmarshalMessageBody(body, 1<<20)
-		require.Nil(t, err)
-		mu.Lock()
-		requests++
-		for _, m := range messages {
-			received[m.Message]++
-		}
-		mu.Unlock()
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-	conf := newTestMeshConfig("node-a", "http://127.0.0.1:1")
-	conf.BatchLinger = 50 * time.Millisecond
-	conf.NodeTTL = time.Minute // The fake peer never heartbeats; liveness is not under test here
-	registerFakePeer(t, pool, "node-peer", srv.URL)
-	mesh, err := newMeshCluster(conf, pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	start := time.Now()
-	var wg sync.WaitGroup
-	for p := 0; p < publishers; p++ {
-		wg.Add(1)
-		go func(p int) {
-			defer wg.Done()
-			ticker := time.NewTicker(publishInterval)
-			defer ticker.Stop()
-			for i := 0; i < messagesPerPublisher; i++ {
-				require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", fmt.Sprintf("p%d-m%d", p, i))))
-				<-ticker.C
-			}
-		}(p)
-	}
-	wg.Wait()
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return len(received) == total
-	})
-	elapsed := time.Since(start)
-	mu.Lock()
-	defer mu.Unlock()
-	for body, count := range received {
-		require.Equalf(t, 1, count, "message %s delivered %d times", body, count)
-	}
-	require.Less(t, requests, total/10, "expected strong batching under load")
-	t.Logf("soak: %d messages, %d requests (%.1f msgs/request), %.0f msgs/s",
-		total, requests, float64(total)/float64(requests), float64(total)/elapsed.Seconds())
-}
-
-// BenchmarkForwardMessage measures the publish-path cost of ForwardMessage: marshal + peer lookup (cached)
-// + enqueue. The peer never drains, so enqueued fragments are dropped once the queue fills;
-// the benchmark measures the hot path, not HTTP delivery.
-func BenchmarkForwardMessage(b *testing.B) {
-	if os.Getenv("NTFY_TEST_DATABASE_URL") == "" {
-		b.Skip("NTFY_TEST_DATABASE_URL not set")
-	}
-	schemaDSN := dbtest.CreateTestPostgresSchema(b)
-	pool := openTestPool(b, schemaDSN)
-	conf := newTestMeshConfig("node-a", "http://127.0.0.1:1")
-	conf.BatchLinger = time.Minute // Never flush; we measure enqueue only
-	mesh, err := newMeshCluster(conf, pool, nil, nil)
-	require.Nil(b, err)
-	defer mesh.Close()
-	registerFakePeer(b, pool, "node-peer", "http://127.0.0.1:1")
-	m := model.NewDefaultMessage("mytopic", "benchmark message body of typical size for a push")
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if err := mesh.ForwardMessage(m); err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-// BenchmarkDecodeFanout measures the receive-path cost of decoding a 100-message NDJSON body.
-func BenchmarkDecodeFanout(b *testing.B) {
-	frags := make([][]byte, 100)
-	for i := range frags {
-		frag, err := marshalMessage(model.NewDefaultMessage("mytopic", fmt.Sprintf("benchmark message %d", i)))
-		require.Nil(b, err)
-		frags[i] = frag
-	}
-	body := assembleMessageBody(frags)
-	b.SetBytes(int64(len(body)))
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		messages, err := unmarshalMessageBody(body, 1<<20)
-		if err != nil || len(messages) != 100 {
-			b.Fatal("decode failed")
-		}
-	}
-}

cluster/cluster_mesh.go

@@ -1,498 +0,0 @@
-package cluster
-
-import (
-	"bytes"
-	"context"
-	"crypto/subtle"
-	"encoding/json"
-	"io"
-	"net/http"
-	"sync"
-	"time"
-
-	"heckel.io/ntfy/v2/cluster/registry"
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/db/pg"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/metrics"
-	"heckel.io/ntfy/v2/model"
-	"heckel.io/ntfy/v2/util"
-)
-
-const (
-	meshHTTPTimeout   = 5 * time.Second
-	peerQueueSize     = 1024            // Bounded per-peer fan-out queue (drop on overflow)
-	batchMaxMessages  = 100             // Flush a batch early when it reaches this many messages
-	batchMaxBytes     = 256 * 1024      // Flush a batch early when it reaches this size
-	stateMaxBytes     = 4 * 1024 * 1024 // Upper bound for inbound state bodies (filter over ~1M topics)
-	stateFilterFPRate = 0.01            // Bloom false-positive rate; a false positive is one wasted send
-	tag               = "cluster"
-)
-
-// meshCluster fans messages out directly to peer nodes over HTTP (the data plane), using
-// PostgreSQL only as a control plane: the node_registry table for membership/discovery, and a
-// Postgres advisory lock for singleton-job leader election. Fan-out never touches the database on
-// the message path (only the cached peer list does). See plans/260715-scale-out-mesh.md.
-//
-// Each peer has its own bounded send queue and delivery worker, so a slow or wedged peer only
-// backs up (and eventually drops) its own queue and never delays delivery to healthy peers.
-type meshCluster struct {
-	conf           *Config
-	deliver        DeliverFunc
-	topics         TopicsFunc
-	registry       *registry.Registry
-	leader         *pg.Leader
-	httpClient     *http.Client
-	mux            *http.ServeMux        // The internal peer API; Cluster is an http.Handler
-	queues         map[NodeID]*peerQueue // per-peer send queues; reconciled against the registry
-	closed         bool                  // Guards against ForwardMessage spawning new workers after Close
-	states         map[NodeID]*peerState // what each peer last told us (subscription knowledge)
-	lastStatePush  time.Time             // Only touched by the heartbeat goroutine
-	knownPeers     map[NodeID]string     // Peers seen in the last reconcile, for join/leave logging
-	lastRegistered time.Time             // Last successful registry heartbeat, for Healthy
-	ctx            context.Context
-	cancel         context.CancelFunc
-	wg             sync.WaitGroup
-	mu             sync.Mutex // Protects queues, closed, knownPeers and lastRegistered
-	statesMu       sync.Mutex // Protects states
-}
-
-// newMeshCluster creates the mesh cluster: it sets up the registry schema, registers this node
-// (synchronously, so it is discoverable before New returns), and starts the heartbeat loop.
-// Peer delivery workers are started lazily as peers appear in the registry.
-func newMeshCluster(conf *Config, pool *db.DB, deliver DeliverFunc, topics TopicsFunc) (*meshCluster, error) {
-	if topics == nil {
-		topics = func() []string { return nil } // No known topics; peers will broadcast to us
-	}
-	reg, err := registry.New(pool, string(conf.NodeID), conf.AdvertiseURL, conf.NodeTTL)
-	if err != nil {
-		return nil, err
-	}
-	// Register synchronously so the node is discoverable before the constructor returns; the
-	// heartbeat loop refreshes the registration from here on
-	if err := reg.Register(); err != nil {
-		return nil, err
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	c := &meshCluster{
-		conf:     conf,
-		deliver:  deliver,
-		topics:   topics,
-		registry: reg,
-		// Renews its lease on its own fixed cadence; see pg.Leader for the semantics
-		leader:         pg.NewLeader(pool.Primary(), pg.LeaderLockKey, conf.LeaderRenewInterval),
-		httpClient:     &http.Client{Timeout: meshHTTPTimeout},
-		queues:         make(map[NodeID]*peerQueue),
-		lastRegistered: time.Now(), // The synchronous Register above just succeeded
-		states:         make(map[NodeID]*peerState),
-		knownPeers:     make(map[NodeID]string),
-		ctx:            ctx,
-		cancel:         cancel,
-	}
-	c.mux = http.NewServeMux()
-	c.mux.HandleFunc("POST "+MessagePath, c.authenticated(c.handleMessage))
-	c.mux.HandleFunc("POST "+StatePath, c.authenticated(c.handleState))
-	c.wg.Add(1)
-	go c.heartbeatLoop()
-	return c, nil
-}
-
-// ServeHTTP serves the internal peer API. Auth lives in the authenticated middleware, so every
-// endpoint gets the same shared-secret and origin handling.
-func (c *meshCluster) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	c.mux.ServeHTTP(w, r)
-}
-
-// authenticated wraps a peer API handler with the checks every endpoint needs: the shared
-// secret (constant-time compare, rejected before any body is read), a present origin, and the
-// origin self-skip (a request carrying this node's own traffic is acknowledged but ignored).
-func (c *meshCluster) authenticated(h func(origin NodeID, w http.ResponseWriter, r *http.Request)) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		if c.conf.Secret == "" || subtle.ConstantTimeCompare([]byte(r.Header.Get(secretHeader)), []byte(c.conf.Secret)) != 1 {
-			w.WriteHeader(http.StatusUnauthorized)
-			return
-		}
-		origin := NodeID(r.Header.Get(originHeader))
-		if origin == "" {
-			w.WriteHeader(http.StatusBadRequest)
-			return
-		}
-		if origin == c.conf.NodeID {
-			w.WriteHeader(http.StatusOK) // Our own traffic; nothing to do
-			return
-		}
-		h(origin, w, r)
-	}
-}
-
-// heartbeatLoop runs one heartbeat immediately (the ticker first fires a full interval after
-// startup, and a fresh node should be leader-capable and state-visible right away), then one per
-// interval until shutdown.
-func (c *meshCluster) heartbeatLoop() {
-	defer c.wg.Done()
-	ticker := time.NewTicker(c.conf.HeartbeatInterval)
-	defer ticker.Stop()
-	if err := c.heartbeat(); err != nil {
-		log.Tag(tag).Err(err).Warn("Cluster heartbeat failed")
-	}
-	for {
-		select {
-		case <-c.ctx.Done():
-			return
-		case <-ticker.C:
-			if err := c.heartbeat(); err != nil {
-				log.Tag(tag).Err(err).Warn("Cluster heartbeat failed")
-			}
-		}
-	}
-}
-
-// heartbeat is one control-plane tick: refresh this node's registry row, retry/confirm the
-// leader lock, prune long-dead registry rows (as leader), reconcile the per-peer queues, and
-// periodically push our subscription state to peers.
-//
-// A node that cannot even register itself aborts the tick: the remaining database work would
-// fail against the same database, and everything downstream degrades safely without it -- ForwardMessage
-// serves the stale peer cache on its own, and peers fall back to broadcasting to us once our
-// last pushed state expires.
-func (c *meshCluster) heartbeat() error {
-	if err := c.registry.Register(); err != nil {
-		return err
-	}
-	c.mu.Lock()
-	c.lastRegistered = time.Now()
-	c.mu.Unlock()
-	// Effective leadership: pg.Leader's lease semantics guarantee a no-leader gap on
-	// failover, never two leaders
-	if c.leader.IsLeader() {
-		metrics.ClusterLeader.Set(1)
-		if err := c.registry.Prune(); err != nil {
-			log.Tag(tag).Err(err).Warn("Failed to prune stale nodes") // Housekeeping only; not fatal for the tick
-		}
-	} else {
-		metrics.ClusterLeader.Set(0)
-	}
-	peers, err := c.registry.Peers()
-	if err != nil {
-		return err
-	}
-	c.reconcilePeers(peers)
-	if time.Since(c.lastStatePush) >= c.conf.StateInterval {
-		c.pushState(peers)
-		c.lastStatePush = time.Now()
-	}
-	return nil
-}
-
-// reconcilePeers aligns this node's per-peer attachments with the live peer set: it retires the
-// queues (and workers) of peers that have left the registry or re-registered under a new
-// advertise URL (the retired queue's remainder was headed for a dead address anyway), and prunes
-// the stale state of departed peers. New and replacement queues are created lazily by ForwardMessage, not
-// here, so a freshly joined peer is reachable immediately.
-func (c *meshCluster) reconcilePeers(peers []*registry.Peer) {
-	metrics.ClusterPeers.Set(float64(len(peers)))
-	alive := make(map[NodeID]string, len(peers)) // node ID -> advertise URL
-	for _, p := range peers {
-		alive[NodeID(p.NodeID)] = p.AdvertiseURL
-	}
-	c.mu.Lock()
-	// Log joins and leaves (as seen through the up-to-NodeTTL-stale registry view)
-	for nodeID, url := range alive {
-		if _, ok := c.knownPeers[nodeID]; !ok {
-			log.Tag(tag).Info("Peer %s (%s) joined the cluster", nodeID, url)
-		}
-	}
-	for nodeID := range c.knownPeers {
-		if _, ok := alive[nodeID]; !ok {
-			log.Tag(tag).Info("Peer %s left the cluster", nodeID)
-		}
-	}
-	c.knownPeers = alive
-	for nodeID, q := range c.queues {
-		if url, ok := alive[nodeID]; !ok || q.advertiseURL != url {
-			q.queue.Close() // Flushes the remainder; the worker exits when the queue is drained
-			delete(c.queues, nodeID)
-		}
-	}
-	c.mu.Unlock()
-	// Prune the state of departed peers, but only once stale: state is push-driven and can
-	// arrive before a new peer is visible in the (up to NodeTTL stale) registry view, so fresh
-	// state must survive even when its peer is not in the live set. Without this, the states of
-	// long-gone nodes would accumulate forever.
-	c.statesMu.Lock()
-	for nodeID, state := range c.states {
-		if _, ok := alive[nodeID]; !ok && time.Since(state.updatedAt) > 3*c.conf.StateInterval {
-			delete(c.states, nodeID)
-		}
-	}
-	c.statesMu.Unlock()
-}
-
-// queueFor returns the send queue for the given peer, creating it (and its delivery worker) if it
-// does not exist yet. The caller must hold c.mu.
-func (c *meshCluster) queueFor(p *registry.Peer) *peerQueue {
-	nodeID := NodeID(p.NodeID)
-	q, ok := c.queues[nodeID]
-	if ok {
-		return q
-	}
-	q = &peerQueue{
-		advertiseURL: p.AdvertiseURL,
-		queue: util.NewLingerQueue(peerQueueSize, batchMaxMessages, batchMaxBytes,
-			func(frag []byte) int { return len(frag) }, c.conf.BatchLinger),
-	}
-	c.queues[nodeID] = q
-	c.wg.Add(1)
-	go c.peerWorker(nodeID, q)
-	return q
-}
-
-// ForwardMessage enqueues the message for delivery to every live peer node that may have subscribers for
-// its topic (all of them, absent fresh knowledge). Delivery is fire-and-forget via each peer's
-// bounded batching queue; if a peer's queue is full the message is dropped for that peer
-// (subscribers reconnect and re-poll history from the database).
-func (c *meshCluster) ForwardMessage(msg *model.Message) error {
-	peers, err := c.registry.Peers()
-	if err != nil {
-		return err
-	}
-	if len(peers) == 0 {
-		return nil // Cluster of one; skip the marshal
-	}
-	frag, err := marshalMessage(msg)
-	if err != nil {
-		return err
-	}
-	metrics.ClusterMessagesForwarded.Inc()
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	if c.closed {
-		return nil // Shutting down; the message is dropped like any other in-flight fan-out
-	}
-	for _, p := range peers {
-		// Route around peers whose fresh state provably excludes this topic; anything less
-		// certain (no state, stale state) falls back to broadcasting
-		if !c.mayNeed(NodeID(p.NodeID), msg.Topic) {
-			metrics.ClusterRouteSkipped.Inc()
-			if ev := log.Tag(tag); ev.IsTrace() {
-				ev.Trace("Skipping peer %s for message %s: no subscribers for topic %s", p.NodeID, msg.ID, msg.Topic)
-			}
-			continue
-		}
-		if !c.queueFor(p).queue.TryEnqueue(frag) {
-			metrics.ClusterQueueDropped.Inc()
-			log.Tag(tag).Warn("Fan-out queue for peer %s full, dropping message %s", p.NodeID, msg.ID)
-		} else if ev := log.Tag(tag); ev.IsTrace() {
-			ev.Trace("Enqueued message %s (topic %s) for peer %s", msg.ID, msg.Topic, p.NodeID)
-		}
-	}
-	return nil
-}
-
-// mayNeed reports whether the peer may have a subscriber for the topic. Conservative by
-// construction: it returns false only when a fresh state snapshot provably excludes the topic.
-// A false positive costs one wasted send; a false negative would lose a message and cannot
-// happen for topics a peer has reported (Bloom filters have no false negatives).
-func (c *meshCluster) mayNeed(peer NodeID, topic string) bool {
-	c.statesMu.Lock()
-	defer c.statesMu.Unlock()
-	state, ok := c.states[peer]
-	if !ok || time.Since(state.updatedAt) > 3*c.conf.StateInterval {
-		return true // No knowledge, or too old to trust for skipping
-	}
-	return state.topics.Contains(topic)
-}
-
-// peerWorker delivers batches of queued fan-out messages to a single peer. Batches form in the
-// peer's LingerQueue (up to BatchLinger delay, flushed early on size/count caps); the worker
-// exits when the queue is closed (peer left the registry, or mesh shutdown) and drained.
-func (c *meshCluster) peerWorker(nodeID NodeID, q *peerQueue) {
-	defer c.wg.Done()
-	for frags := range q.queue.Dequeue() {
-		body := assembleMessageBody(frags)
-		log.Tag(tag).Debug("Sending batch of %d message(s) (%d bytes) to peer %s", len(frags), len(body), nodeID)
-		c.postToPeer(nodeID, messageURL(q.advertiseURL), contentTypeNDJSON, body)
-		metrics.ClusterBatchesSent.Inc()
-	}
-}
-
-// postToPeer POSTs a peer API payload, authenticated with the shared cluster secret. Failures
-// are logged and counted, never retried: peer traffic is best-effort by design (messages are
-// recovered via since= replay, state via the next periodic push).
-func (c *meshCluster) postToPeer(nodeID NodeID, url, contentType string, payload []byte) {
-	req, err := http.NewRequestWithContext(c.ctx, http.MethodPost, url, bytes.NewReader(payload))
-	if err != nil {
-		metrics.ClusterSendErrors.Inc()
-		log.Tag(tag).Err(err).Warn("Failed to build request for peer %s", nodeID)
-		return
-	}
-	req.Header.Set("Content-Type", contentType)
-	req.Header.Set(secretHeader, c.conf.Secret)
-	req.Header.Set(originHeader, string(c.conf.NodeID))
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		if c.ctx.Err() == nil {
-			metrics.ClusterSendErrors.Inc()
-			log.Tag(tag).Err(err).Warn("Failed to send to peer %s (%s)", nodeID, url)
-		}
-		return
-	}
-	resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		metrics.ClusterSendErrors.Inc()
-		log.Tag(tag).Warn("Peer %s (%s) rejected request with HTTP %d", nodeID, url, resp.StatusCode)
-	}
-}
-
-// handleMessage receives a batch of peer messages (NDJSON) and streams them to local
-// subscribers line by line, delivering each message as it is decoded.
-func (c *meshCluster) handleMessage(origin NodeID, w http.ResponseWriter, r *http.Request) {
-	// A batch can exceed its byte cap by one message, plus framing overhead
-	maxBodyBytes := int64(batchMaxBytes) + c.conf.MaxMessageBytes + 1024
-	received := 0
-	deliver := func(m *model.Message) {
-		received++
-		if ev := log.Tag(tag); ev.IsTrace() {
-			ev.Trace("Delivering message %s (topic %s) from peer %s", m.ID, m.Topic, origin)
-		}
-		c.deliver(m)
-	}
-	if err := decodeMessageBody(io.LimitReader(r.Body, maxBodyBytes), int(c.conf.MaxMessageBytes), deliver); err != nil {
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-	log.Tag(tag).Debug("Received batch of %d message(s) from peer %s", received, origin)
-	w.WriteHeader(http.StatusOK)
-}
-
-// handleState receives a peer's state envelope and applies each section it carries.
-func (c *meshCluster) handleState(origin NodeID, w http.ResponseWriter, r *http.Request) {
-	body, err := io.ReadAll(io.LimitReader(r.Body, stateMaxBytes))
-	if err != nil {
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-	var state apiState
-	if err := json.Unmarshal(body, &state); err != nil {
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-	if state.Topics != nil {
-		if err := c.applyTopicState(origin, state.Topics); err != nil {
-			w.WriteHeader(http.StatusBadRequest)
-			return
-		}
-	}
-	w.WriteHeader(http.StatusOK)
-}
-
-// applyTopicState updates what we know about a peer's subscriptions: a full snapshot replaces
-// all prior knowledge, an incremental add merges into it. Increments without a baseline are
-// ignored on purpose -- without a snapshot the peer is broadcast to anyway.
-func (c *meshCluster) applyTopicState(origin NodeID, topics *apiStateTopics) error {
-	c.statesMu.Lock()
-	defer c.statesMu.Unlock()
-	if len(topics.Filter) > 0 {
-		filter, err := util.UnmarshalBloomFilter(topics.Filter)
-		if err != nil {
-			return err
-		}
-		c.states[origin] = &peerState{topics: filter, updatedAt: time.Now()}
-		log.Tag(tag).Debug("Received subscription state from peer %s (%d filter bytes)", origin, len(topics.Filter))
-		return nil
-	}
-	if state, ok := c.states[origin]; ok {
-		for _, topic := range topics.Added {
-			state.topics.Add(topic)
-		}
-		state.updatedAt = time.Now()
-		log.Tag(tag).Debug("Received %d announced topic(s) from peer %s", len(topics.Added), origin)
-	}
-	return nil
-}
-
-// pushState sends a full state snapshot to every live peer: a Bloom filter over the topics that
-// currently have local subscribers. Sent directly (not via the linger queues -- state must not
-// wait behind message batches); a lost push self-heals at the next interval. Topics without
-// subscribers disappear simply by not being in the next snapshot.
-func (c *meshCluster) pushState(peers []*registry.Peer) {
-	if len(peers) == 0 {
-		return
-	}
-	topics := c.topics()
-	filter := util.NewBloomFilter(len(topics), stateFilterFPRate)
-	for _, topic := range topics {
-		filter.Add(topic)
-	}
-	data, err := filter.MarshalBinary()
-	if err != nil {
-		return
-	}
-	body, err := json.Marshal(&apiState{Topics: &apiStateTopics{Filter: data}})
-	if err != nil {
-		return
-	}
-	log.Tag(tag).Debug("Pushing subscription state (%d topics, %d bytes) to %d peer(s)", len(topics), len(body), len(peers))
-	for _, p := range peers {
-		go c.postToPeer(NodeID(p.NodeID), stateURL(p.AdvertiseURL), contentTypeJSON, body)
-	}
-	metrics.ClusterStatePushes.Inc()
-}
-
-// BroadcastState immediately tells all live peers that these topics gained their first local
-// subscriber, shrinking the window in which a publisher could wrongly skip this node from a
-// full state interval down to about one round trip.
-func (c *meshCluster) BroadcastState(state *State) {
-	if len(state.AddedTopics) == 0 {
-		return
-	}
-	peers, err := c.registry.Peers()
-	if err != nil || len(peers) == 0 {
-		return
-	}
-	body, err := json.Marshal(&apiState{Topics: &apiStateTopics{Added: state.AddedTopics}})
-	if err != nil {
-		return
-	}
-	log.Tag(tag).Debug("Broadcasting state (%d new topics) to %d peer(s)", len(state.AddedTopics), len(peers))
-	for _, p := range peers {
-		go c.postToPeer(NodeID(p.NodeID), stateURL(p.AdvertiseURL), contentTypeJSON, body)
-	}
-}
-
-// IsLeader reports whether this node currently holds singleton-job leadership.
-func (c *meshCluster) IsLeader() bool {
-	return c.leader.IsLeader()
-}
-
-// Healthy reports whether this node's registry heartbeat is fresh enough that peers still
-// forward messages to it (see the Cluster interface for the checker's fail-open duty).
-func (c *meshCluster) Healthy() bool {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return time.Since(c.lastRegistered) < c.conf.NodeTTL
-}
-
-// Close stops the mesh: it deregisters this node, releases leadership, stops all peer workers,
-// and waits for them to exit.
-func (c *meshCluster) Close() error {
-	c.cancel() // Stops the heartbeat loop and aborts in-flight peer deliveries
-	// Close the peer queues so their workers flush and exit; final sends are best-effort since
-	// the context is already canceled (parity with fire-and-forget delivery)
-	c.mu.Lock()
-	c.closed = true
-	for nodeID, q := range c.queues {
-		q.queue.Close()
-		delete(c.queues, nodeID)
-	}
-	c.mu.Unlock()
-	// Wait for the loops BEFORE deregistering: an in-flight heartbeat's Register would otherwise
-	// re-insert our row right after Deregister deleted it
-	c.wg.Wait()
-	if err := c.registry.Deregister(); err != nil {
-		log.Tag(tag).Err(err).Warn("Failed to deregister node")
-	}
-	c.leader.Close()
-	metrics.ClusterLeader.Set(0)
-	return nil
-}

cluster/cluster_mesh_test.go

@@ -1,590 +0,0 @@
-package cluster
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/cluster/registry"
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/db/pg"
-	dbtest "heckel.io/ntfy/v2/db/test"
-	"heckel.io/ntfy/v2/model"
-	"heckel.io/ntfy/v2/util"
-)
-
-const (
-	testSecret = "s3cret"
-)
-
-// openTestPool opens a dedicated connection pool to the given test schema, so that each simulated
-// node has its own pool like real nodes would.
-func openTestPool(t testing.TB, dsn string) *db.DB {
-	host, err := pg.Open(dsn)
-	require.Nil(t, err)
-	d := db.New(host, nil)
-	t.Cleanup(func() { d.Close() })
-	return d
-}
-
-func newTestMeshConfig(nodeID, advertiseURL string) *Config {
-	return &Config{
-		Enabled:             true,
-		NodeID:              NodeID(nodeID),
-		AdvertiseURL:        advertiseURL,
-		Secret:              testSecret,
-		HeartbeatInterval:   100 * time.Millisecond,
-		LeaderRenewInterval: 20 * time.Millisecond, // Lease duration 60ms, hold-off 120ms; keeps leadership tests fast
-		NodeTTL:             time.Second,           // Also the peer cache bound; short so fake peers registered mid-test are seen quickly
-		MaxMessageBytes:     1 << 20,
-		StateInterval:       time.Minute, // Individual tests lower this to exercise state pushes
-	}
-}
-
-// registerFakePeer registers a fake peer via the registry (creating the table if the mesh has
-// not been constructed yet): tests register fakes before the mesh boots, since its first
-// heartbeat caches the peer list. The fake never refreshes its heartbeat.
-func registerFakePeer(t testing.TB, pool *db.DB, nodeID NodeID, url string) {
-	t.Helper()
-	reg, err := registry.New(pool, string(nodeID), url, time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, reg.Register())
-}
-
-func waitFor(t *testing.T, f func() bool) {
-	t.Helper()
-	for i := 0; i < 100; i++ {
-		if f() {
-			return
-		}
-		time.Sleep(50 * time.Millisecond)
-	}
-	t.Fatal("timed out waiting for condition")
-}
-
-func TestMesh_CrossNodeDelivery(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	poolA, poolB := openTestPool(t, schemaDSN), openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	var received []*model.Message
-	var meshB *meshCluster
-	srvB := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		meshB.ServeHTTP(w, r)
-	}))
-	defer srvB.Close()
-	meshB, err := newMeshCluster(newTestMeshConfig("node-b", srvB.URL), poolB, func(m *model.Message) {
-		mu.Lock()
-		defer mu.Unlock()
-		received = append(received, m)
-	}, nil)
-	require.Nil(t, err)
-	defer meshB.Close()
-	meshA, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), poolA, func(m *model.Message) {
-		t.Error("node A must not receive its own relayed message")
-	}, nil)
-	require.Nil(t, err)
-	defer meshA.Close()
-	msg := model.NewDefaultMessage("mytopic", "hello cross-node")
-	require.Nil(t, meshA.ForwardMessage(msg))
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return len(received) == 1
-	})
-	mu.Lock()
-	defer mu.Unlock()
-	require.Equal(t, "mytopic", received[0].Topic)
-	require.Equal(t, "hello cross-node", received[0].Message)
-}
-
-func TestMesh_PeerAPI_Auth(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var delivered int
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, func(m *model.Message) {
-		delivered++
-	}, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	frag, err := marshalMessage(model.NewDefaultMessage("mytopic", "hi"))
-	require.Nil(t, err)
-	payload := assembleMessageBody([][]byte{frag})
-
-	// Wrong secret -> 401, not delivered
-	rr := httptest.NewRecorder()
-	req := httptest.NewRequest("POST", MessagePath, strings.NewReader(string(payload)))
-	req.Header.Set(secretHeader, "wrong")
-	req.Header.Set(originHeader, "node-b")
-	mesh.ServeHTTP(rr, req)
-	require.Equal(t, 401, rr.Code)
-
-	// Missing secret -> 401, not delivered
-	rr = httptest.NewRecorder()
-	mesh.ServeHTTP(rr, httptest.NewRequest("POST", MessagePath, strings.NewReader(string(payload))))
-	require.Equal(t, 401, rr.Code)
-	require.Equal(t, 0, delivered)
-
-	// Missing origin -> 400, not delivered
-	rr = httptest.NewRecorder()
-	req = httptest.NewRequest("POST", MessagePath, strings.NewReader(string(payload)))
-	req.Header.Set(secretHeader, testSecret)
-	mesh.ServeHTTP(rr, req)
-	require.Equal(t, 400, rr.Code)
-	require.Equal(t, 0, delivered)
-
-	// Correct secret and origin -> 200, delivered
-	rr = httptest.NewRecorder()
-	req = httptest.NewRequest("POST", MessagePath, strings.NewReader(string(payload)))
-	req.Header.Set(secretHeader, testSecret)
-	req.Header.Set(originHeader, "node-b")
-	mesh.ServeHTTP(rr, req)
-	require.Equal(t, 200, rr.Code)
-	require.Equal(t, 1, delivered)
-}
-
-func TestMesh_PeerAPI_SelfOrigin(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var delivered int
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, func(m *model.Message) {
-		delivered++
-	}, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-
-	// A request that carries this node's own broadcasts must not be re-delivered (loop prevention)
-	frag, err := marshalMessage(model.NewDefaultMessage("mytopic", "loop"))
-	require.Nil(t, err)
-	payload := assembleMessageBody([][]byte{frag})
-	rr := httptest.NewRecorder()
-	req := httptest.NewRequest("POST", MessagePath, strings.NewReader(string(payload)))
-	req.Header.Set(secretHeader, testSecret)
-	req.Header.Set(originHeader, "node-a") // Same as the receiving node's ID
-	mesh.ServeHTTP(rr, req)
-	require.Equal(t, 200, rr.Code)
-	require.Equal(t, 0, delivered)
-}
-
-func TestMesh_SlowPeerIsolation(t *testing.T) {
-	// A wedged peer must not delay delivery to healthy peers: each peer has its own queue and
-	// delivery worker. With a shared send queue (the design this replaces), the slow peer's
-	// requests would occupy all delivery workers and starve the fast peer.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	fastReceived := 0 // Messages, not requests: with batching, one request can carry many
-	srvFast := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		require.Nil(t, err)
-		messages, err := unmarshalMessageBody(body, 1<<20)
-		require.Nil(t, err)
-		mu.Lock()
-		fastReceived += len(messages)
-		mu.Unlock()
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srvFast.Close()
-	release := make(chan struct{})
-	srvSlow := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		<-release // Wedged until the end of the test
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srvSlow.Close()
-	defer close(release)
-	// Register the fake peers before the mesh boots; its first heartbeat caches the peer list
-	for i, url := range []string{srvFast.URL, srvSlow.URL} {
-		registerFakePeer(t, pool, NodeID(fmt.Sprintf("node-fake-%d", i)), url)
-	}
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	const n = 20
-	for i := 0; i < n; i++ {
-		require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", fmt.Sprintf("message %d", i))))
-	}
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return fastReceived == n
-	})
-}
-
-func TestMesh_BatchCoalescing(t *testing.T) {
-	// Messages published within the linger window arrive as batches: fewer HTTP requests than
-	// messages, with nothing lost. Fails against a one-request-per-message sender.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	requests, messages := 0, 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		require.Nil(t, err)
-		decoded, err := unmarshalMessageBody(body, 1<<20)
-		require.Nil(t, err)
-		mu.Lock()
-		requests++
-		messages += len(decoded)
-		mu.Unlock()
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-	registerFakePeer(t, pool, "node-fake", srv.URL)
-	conf := newTestMeshConfig("node-a", "http://127.0.0.1:1")
-	conf.BatchLinger = 150 * time.Millisecond
-	mesh, err := newMeshCluster(conf, pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	const n = 20
-	for i := 0; i < n; i++ {
-		require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", fmt.Sprintf("message %d", i))))
-	}
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return messages == n
-	})
-	mu.Lock()
-	defer mu.Unlock()
-	require.Less(t, requests, 5, "expected %d messages coalesced into few requests, got %d", n, requests)
-}
-
-func TestMesh_DeadPeerRemovedAndRejoin(t *testing.T) {
-	// A peer that dies ungracefully (no Deregister) stops refreshing its heartbeat: after the
-	// TTL it no longer counts as live (no more sends), its queue/worker are reconciled away, the
-	// leader prunes its registry row, and a re-registered peer starts receiving again.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	received := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		require.Nil(t, err)
-		messages, err := unmarshalMessageBody(body, 1<<20)
-		require.Nil(t, err)
-		mu.Lock()
-		received += len(messages)
-		mu.Unlock()
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-	conf := newTestMeshConfig("node-a", "http://127.0.0.1:1")
-	conf.NodeTTL = 300 * time.Millisecond // Fast expiry so the test observes TTL-based removal
-	mesh, err := newMeshCluster(conf, pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	// The fake peer registers once and then "dies": its heartbeat is never refreshed
-	registerFakePeer(t, pool, "node-dead", srv.URL)
-	require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", "while alive")))
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return received == 1
-	})
-	// After the TTL, the peer is no longer live: its queue is reconciled away and its registry
-	// row is pruned by the leader (this mesh is the only real node, so it holds the lock)
-	waitFor(t, func() bool {
-		mesh.mu.Lock()
-		defer mesh.mu.Unlock()
-		return len(mesh.queues) == 0
-	})
-	waitFor(t, func() bool {
-		var count int
-		require.Nil(t, pool.QueryRow(`SELECT COUNT(*) FROM node_registry WHERE node_id = 'node-dead'`).Scan(&count))
-		return count == 0
-	})
-	require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", "while dead")))
-	time.Sleep(250 * time.Millisecond) // Give a wrong implementation time to deliver anyway
-	mu.Lock()
-	require.Equal(t, 1, received) // Only the first message arrived
-	mu.Unlock()
-	// The peer comes back (same node ID, fresh heartbeat) and receives messages again; the
-	// relay retries because the peer list is cached for up to the node TTL
-	registerFakePeer(t, pool, "node-dead", srv.URL)
-	waitFor(t, func() bool {
-		require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", "after rejoin")))
-		mu.Lock()
-		defer mu.Unlock()
-		return received > 1
-	})
-}
-
-func TestMesh_ForwardAfterClose(t *testing.T) {
-	// A ForwardMessage racing shutdown (e.g. an in-flight publish during server Stop) must not spawn
-	// a new peer queue and worker after Close: the worker would never exit (its queue is never
-	// closed) and nothing waits for it.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	registerFakePeer(t, pool, "node-peer", "http://127.0.0.1:1")
-	require.Nil(t, mesh.Close())
-	require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("mytopic", "too late"))) // Dropped silently
-	mesh.mu.Lock()
-	defer mesh.mu.Unlock()
-	require.Empty(t, mesh.queues)
-}
-
-func TestMesh_LeaderFailover(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	poolA, poolB := openTestPool(t, schemaDSN), openTestPool(t, schemaDSN)
-	meshA, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), poolA, nil, nil)
-	require.Nil(t, err)
-	defer meshA.Close()
-	meshB, err := newMeshCluster(newTestMeshConfig("node-b", "http://127.0.0.1:1"), poolB, nil, nil)
-	require.Nil(t, err)
-	defer meshB.Close()
-	// Exactly one node becomes leader
-	waitFor(t, func() bool {
-		return meshA.IsLeader() != meshB.IsLeader() // Exactly one
-	})
-	// The leader steps down; the follower takes over
-	leader, follower := meshA, meshB
-	if meshB.IsLeader() {
-		leader, follower = meshB, meshA
-	}
-	require.Nil(t, leader.Close())
-	waitFor(t, follower.IsLeader)
-}
-
-func TestMesh_CloseDeregisters(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	var count int
-	require.Nil(t, pool.QueryRow(`SELECT COUNT(*) FROM node_registry WHERE node_id = 'node-a'`).Scan(&count))
-	require.Equal(t, 1, count)
-	require.Nil(t, mesh.Close())
-	require.Nil(t, pool.QueryRow(`SELECT COUNT(*) FROM node_registry WHERE node_id = 'node-a'`).Scan(&count))
-	require.Equal(t, 0, count)
-}
-
-// postState delivers a state envelope to a mesh's peer API, as a peer would.
-func postState(c *meshCluster, origin NodeID, state *apiState) *httptest.ResponseRecorder {
-	body, err := json.Marshal(state)
-	if err != nil {
-		panic(err)
-	}
-	rr := httptest.NewRecorder()
-	req := httptest.NewRequest("POST", StatePath, bytes.NewReader(body))
-	req.Header.Set(secretHeader, testSecret)
-	req.Header.Set(originHeader, string(origin))
-	c.ServeHTTP(rr, req)
-	return rr
-}
-
-// topicFilter builds a marshaled Bloom filter over the given topics.
-func topicFilter(t *testing.T, topics ...string) []byte {
-	t.Helper()
-	filter := util.NewBloomFilter(len(topics), 0.01)
-	for _, topic := range topics {
-		filter.Add(topic)
-	}
-	data, err := filter.MarshalBinary()
-	require.Nil(t, err)
-	return data
-}
-
-func TestMesh_RouteSkipsUnsubscribedPeer(t *testing.T) {
-	// A peer whose fresh state provably excludes a topic is not contacted for it; a topic in its
-	// state is delivered as usual.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	received := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		require.Nil(t, err)
-		messages, err := unmarshalMessageBody(body, 1<<20)
-		require.Nil(t, err)
-		mu.Lock()
-		received += len(messages)
-		mu.Unlock()
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-	registerFakePeer(t, pool, "node-b", srv.URL)
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	// node-b reports subscribers only for "subscribed-topic"
-	rr := postState(mesh, "node-b", &apiState{Topics: &apiStateTopics{Filter: topicFilter(t, "subscribed-topic")}})
-	require.Equal(t, 200, rr.Code)
-	// A topic outside the peer's state is skipped
-	require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("other-topic", "skipped")))
-	time.Sleep(300 * time.Millisecond) // Give a wrong implementation time to deliver anyway
-	mu.Lock()
-	require.Equal(t, 0, received)
-	mu.Unlock()
-	// A topic inside the peer's state is delivered
-	require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("subscribed-topic", "delivered")))
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return received == 1
-	})
-}
-
-func TestMesh_RouteBroadcastsOnStaleState(t *testing.T) {
-	// State too old to trust cannot justify skipping: the peer is broadcast to as if unknown.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	var mu sync.Mutex
-	received := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == MessagePath { // The mesh also pushes state here; count only messages
-			mu.Lock()
-			received++
-			mu.Unlock()
-		}
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-	registerFakePeer(t, pool, "node-b", srv.URL)
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	rr := postState(mesh, "node-b", &apiState{Topics: &apiStateTopics{Filter: topicFilter(t, "subscribed-topic")}})
-	require.Equal(t, 200, rr.Code)
-	// Age the state beyond the trust window
-	mesh.statesMu.Lock()
-	mesh.states["node-b"].updatedAt = time.Now().Add(-time.Hour)
-	mesh.statesMu.Unlock()
-	require.Nil(t, mesh.ForwardMessage(model.NewDefaultMessage("other-topic", "broadcast anyway")))
-	waitFor(t, func() bool {
-		mu.Lock()
-		defer mu.Unlock()
-		return received == 1
-	})
-}
-
-func TestMesh_StatePushReplacesAndRemoves(t *testing.T) {
-	// Node A periodically pushes a full snapshot of its live topics to node B; each snapshot
-	// REPLACES B's knowledge, so topics that lost their subscribers disappear without any
-	// explicit removal protocol.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	poolA, poolB := openTestPool(t, schemaDSN), openTestPool(t, schemaDSN)
-	var topicsMu sync.Mutex
-	topicsA := []string{"topic-1"}
-	source := func() []string {
-		topicsMu.Lock()
-		defer topicsMu.Unlock()
-		return append([]string{}, topicsA...)
-	}
-	var meshB *meshCluster
-	srvB := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		meshB.ServeHTTP(w, r)
-	}))
-	defer srvB.Close()
-	meshB, err := newMeshCluster(newTestMeshConfig("node-b", srvB.URL), poolB, nil, nil)
-	require.Nil(t, err)
-	defer meshB.Close()
-	confA := newTestMeshConfig("node-a", "http://127.0.0.1:1")
-	confA.StateInterval = 200 * time.Millisecond
-	meshA, err := newMeshCluster(confA, poolA, nil, source)
-	require.Nil(t, err)
-	defer meshA.Close()
-	// B learns A's topics via the periodic push
-	knows := func(topic string) func() bool {
-		return func() bool {
-			meshB.statesMu.Lock()
-			defer meshB.statesMu.Unlock()
-			state, ok := meshB.states["node-a"]
-			return ok && state.topics.Contains(topic)
-		}
-	}
-	waitFor(t, knows("topic-1"))
-	// A's subscribers change; the next snapshot replaces the old knowledge entirely
-	topicsMu.Lock()
-	topicsA = []string{"topic-2"}
-	topicsMu.Unlock()
-	waitFor(t, knows("topic-2"))
-	waitFor(t, func() bool { return !knows("topic-1")() })
-}
-
-func TestMesh_AnnounceClosesWindow(t *testing.T) {
-	// A topic gaining its first subscriber is announced immediately, so peers learn about it
-	// without waiting for the next full state push.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	poolA, poolB := openTestPool(t, schemaDSN), openTestPool(t, schemaDSN)
-	var meshB *meshCluster
-	srvB := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		meshB.ServeHTTP(w, r)
-	}))
-	defer srvB.Close()
-	meshB, err := newMeshCluster(newTestMeshConfig("node-b", srvB.URL), poolB, nil, nil)
-	require.Nil(t, err)
-	defer meshB.Close()
-	confA := newTestMeshConfig("node-a", "http://127.0.0.1:1")
-	confA.StateInterval = 200 * time.Millisecond // One full push establishes the baseline
-	meshA, err := newMeshCluster(confA, poolA, nil, func() []string { return []string{"existing"} })
-	require.Nil(t, err)
-	defer meshA.Close()
-	waitFor(t, func() bool {
-		meshB.statesMu.Lock()
-		defer meshB.statesMu.Unlock()
-		_, ok := meshB.states["node-a"]
-		return ok
-	})
-	// Announcements merge into the baseline right away
-	meshA.BroadcastState(&State{AddedTopics: []string{"fresh-topic"}})
-	waitFor(t, func() bool {
-		meshB.statesMu.Lock()
-		defer meshB.statesMu.Unlock()
-		state, ok := meshB.states["node-a"]
-		return ok && state.topics.Contains("fresh-topic")
-	})
-}
-
-func TestMesh_StateOfDepartedPeerPruned(t *testing.T) {
-	// peerState is push-driven and can arrive before the peer is visible in the registry, so it
-	// must survive reconcile while fresh -- but a departed peer's state must not leak forever:
-	// once it is both absent from the registry and stale past the trust window, it is pruned.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	rr := postState(mesh, "node-gone", &apiState{Topics: &apiStateTopics{Filter: topicFilter(t, "some-topic")}})
-	require.Equal(t, 200, rr.Code)
-	// Fresh state of an unknown peer survives reconcile (the new-node visibility window)
-	mesh.reconcilePeers(nil)
-	mesh.statesMu.Lock()
-	_, ok := mesh.states["node-gone"]
-	mesh.statesMu.Unlock()
-	require.True(t, ok)
-	// Stale state of an absent peer is pruned
-	mesh.statesMu.Lock()
-	mesh.states["node-gone"].updatedAt = time.Now().Add(-time.Hour)
-	mesh.statesMu.Unlock()
-	mesh.reconcilePeers(nil)
-	mesh.statesMu.Lock()
-	_, ok = mesh.states["node-gone"]
-	mesh.statesMu.Unlock()
-	require.False(t, ok)
-}
-
-func TestMesh_HealthyReflectsRegistration(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	mesh, err := newMeshCluster(newTestMeshConfig("node-a", "http://127.0.0.1:1"), pool, nil, nil)
-	require.Nil(t, err)
-	defer mesh.Close()
-	require.True(t, mesh.Healthy()) // Registered synchronously at construction
-	// Stale heartbeat: peers stop forwarding to this node, so it must report unhealthy
-	mesh.mu.Lock()
-	mesh.lastRegistered = time.Now().Add(-2 * mesh.conf.NodeTTL)
-	mesh.mu.Unlock()
-	require.False(t, mesh.Healthy())
-	// A successful heartbeat restores health
-	require.Nil(t, mesh.heartbeat())
-	require.True(t, mesh.Healthy())
-}

cluster/cluster_nop.go

@@ -1,26 +0,0 @@
-package cluster
-
-import (
-	"net/http"
-
-	"heckel.io/ntfy/v2/model"
-)
-
-// nopCluster is the single-node default: it drops all relayed messages, rejects peer API requests, and
-// reports this node as leader (a single node is trivially the leader, so leader-gated jobs need
-// no special-casing in single-node mode).
-type nopCluster struct{}
-
-func (c *nopCluster) ForwardMessage(_ *model.Message) error { return nil }
-
-func (c *nopCluster) ServeHTTP(w http.ResponseWriter, _ *http.Request) {
-	w.WriteHeader(http.StatusNotFound)
-}
-
-func (c *nopCluster) BroadcastState(_ *State) {}
-
-func (c *nopCluster) IsLeader() bool { return true }
-
-func (c *nopCluster) Healthy() bool { return true }
-
-func (c *nopCluster) Close() error { return nil }

cluster/cluster_test.go

@@ -1,84 +0,0 @@
-package cluster
-
-import (
-	"bytes"
-	"net/http/httptest"
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/model"
-)
-
-func TestDeliver_RoundTrip(t *testing.T) {
-	// The fan-out body is NDJSON: one apiDeliverMessage per line, joined from pre-marshaled
-	// fragments; the origin travels in a header, not the body
-	m1 := model.NewDefaultMessage("mytopic", "my message")
-	m1.Sender = netip.MustParseAddr("1.2.3.4")
-	m1.User = "u_abc"
-	m2 := model.NewDefaultMessage("othertopic", "other message")
-	frag1, err := marshalMessage(m1)
-	require.Nil(t, err)
-	frag2, err := marshalMessage(m2)
-	require.Nil(t, err)
-	messages, err := unmarshalMessageBody(assembleMessageBody([][]byte{frag1, frag2}), 1<<20)
-	require.Nil(t, err)
-	require.Len(t, messages, 2)
-	require.Equal(t, "mytopic", messages[0].Topic)
-	require.Equal(t, "my message", messages[0].Message)
-	// Sender and User are json:"-" on model.Message; the lines must carry and reattach them
-	require.Equal(t, netip.MustParseAddr("1.2.3.4"), messages[0].Sender)
-	require.Equal(t, "u_abc", messages[0].User)
-	require.Equal(t, "othertopic", messages[1].Topic)
-	require.False(t, messages[1].Sender.IsValid())
-}
-
-func TestDeliver_SingleMessage(t *testing.T) {
-	// A single message is just a one-line body; there is no separate single-message format
-	frag, err := marshalMessage(model.NewDefaultMessage("mytopic", "hi"))
-	require.Nil(t, err)
-	messages, err := unmarshalMessageBody(assembleMessageBody([][]byte{frag}), 1<<20)
-	require.Nil(t, err)
-	require.Len(t, messages, 1)
-}
-
-func TestDeliver_MalformedLinesSkipped(t *testing.T) {
-	// Fan-out is fire-and-forget: a malformed or message-less line is skipped (and logged), the
-	// remaining lines are still delivered
-	frag, err := marshalMessage(model.NewDefaultMessage("mytopic", "good"))
-	require.Nil(t, err)
-	body := []byte("this is not json\n{\"sender\":\"1.2.3.4\"}\n" + string(frag) + "\n\n")
-	messages, err := unmarshalMessageBody(body, 1<<20)
-	require.Nil(t, err)
-	require.Len(t, messages, 1)
-	require.Equal(t, "good", messages[0].Message)
-}
-
-// unmarshalMessageBody is a test helper collecting the messages of an NDJSON message body.
-func unmarshalMessageBody(body []byte, maxLineBytes int) ([]*model.Message, error) {
-	var messages []*model.Message
-	err := decodeMessageBody(bytes.NewReader(body), maxLineBytes, func(m *model.Message) {
-		messages = append(messages, m)
-	})
-	return messages, err
-}
-
-func TestNop(t *testing.T) {
-	b, err := New(&Config{}, nil, nil, nil) // not enabled -> nop cluster, no database required
-	require.Nil(t, err)
-	require.IsType(t, &nopCluster{}, b)
-	require.Nil(t, b.ForwardMessage(model.NewDefaultMessage("mytopic", "hi")))
-	// A single node is trivially the leader, so leader-gated jobs run without special-casing
-	require.True(t, b.IsLeader())
-	require.True(t, b.Healthy())
-	rr := httptest.NewRecorder()
-	b.ServeHTTP(rr, httptest.NewRequest("POST", MessagePath, nil))
-	require.Equal(t, 404, rr.Code)
-	require.Nil(t, b.Close())
-}
-
-func TestNew_EnabledRequiresDatabase(t *testing.T) {
-	_, err := New(&Config{Enabled: true, Secret: "secret"}, nil, nil, nil)
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "database")
-}

cluster/registry/registry.go

@@ -1,149 +0,0 @@
-// Package registry implements cluster membership: each node upserts its own row into the
-// node_registry table with a fresh heartbeat, and discovers its peers by reading the other
-// fresh rows. Node IDs are plain strings here; the cluster package layers its NodeID type on
-// top.
-package registry
-
-import (
-	"sync"
-	"time"
-
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/db/schema"
-)
-
-// Registry queries
-const (
-	upsertNodeQuery = `
-		INSERT INTO node_registry (node_id, advertise_url, last_heartbeat)
-		VALUES ($1, $2, $3)
-		ON CONFLICT (node_id) DO UPDATE SET advertise_url = EXCLUDED.advertise_url, last_heartbeat = EXCLUDED.last_heartbeat
-	`
-	selectPeersQuery     = `SELECT node_id, advertise_url FROM node_registry WHERE last_heartbeat >= $1 AND node_id != $2`
-	pruneStaleNodesQuery = `DELETE FROM node_registry WHERE last_heartbeat < $1`
-	deleteNodeQuery      = `DELETE FROM node_registry WHERE node_id = $1`
-)
-
-// Schema version and queries
-
-const (
-	schemaVersion  = 1
-	schemaStoreKey = "node_registry"
-)
-
-var (
-	createTable = schema.AsMigrateFunc(`
-		CREATE TABLE IF NOT EXISTS node_registry (
-			node_id        TEXT PRIMARY KEY,
-			advertise_url  TEXT NOT NULL,
-			last_heartbeat BIGINT NOT NULL
-		)
-	`)
-)
-
-// Peer is a live remote node as read from the registry.
-type Peer struct {
-	NodeID       string
-	AdvertiseURL string
-}
-
-// Registry is the node membership table (control plane): each node upserts its own row with a
-// fresh heartbeat every few seconds, and peers are the other rows with a heartbeat newer than
-// the TTL. Stale rows are pruned by the leader. The TTL bounds membership staleness in BOTH
-// directions: how long a silent node still counts as live, and how long the cached peer list is
-// served before a re-read -- so a new node may take up to a TTL to become visible.
-type Registry struct {
-	pool         *db.DB
-	nodeID       string
-	advertiseURL string
-	ttl          time.Duration
-	peers        []*Peer // cached peer list
-	peersFetched time.Time
-	mu           sync.Mutex // Protects peers and peersFetched
-}
-
-// New creates or migrates the registry schema and returns this node's membership handle. It
-// does NOT register the node: joining the cluster is an explicit Register call, owned by the
-// caller, so read-only uses of the registry stay side-effect free.
-func New(pool *db.DB, nodeID, advertiseURL string, ttl time.Duration) (*Registry, error) {
-	if err := schema.Migrate(pool.Primary(), schema.Postgres, schemaStoreKey, schemaVersion, createTable, nil); err != nil {
-		return nil, err
-	}
-	return &Registry{
-		pool:         pool,
-		nodeID:       nodeID,
-		advertiseURL: advertiseURL,
-		ttl:          ttl,
-	}, nil
-}
-
-// Register upserts this node into the registry with a fresh heartbeat. It is a pure write: it
-// does not touch the peer cache, because our own row is excluded from Peers() anyway.
-func (r *Registry) Register() error {
-	_, err := r.pool.Exec(upsertNodeQuery, r.nodeID, r.advertiseURL, time.Now().Unix())
-	return err
-}
-
-// Peers returns the current set of live peer nodes (all registry rows with a fresh heartbeat,
-// excluding this node), cached for the TTL.
-func (r *Registry) Peers() ([]*Peer, error) {
-	r.mu.Lock()
-	if r.peers != nil && time.Since(r.peersFetched) < r.ttl {
-		peers := r.peers
-		r.mu.Unlock()
-		return peers, nil
-	}
-	r.mu.Unlock()
-	peers, err := r.queryPeers()
-	if err != nil {
-		// Serve the last-known peer list during database hiccups: fan-out keeps flowing to
-		// known peers instead of erroring (and logging) once per published message for the
-		// duration of the outage. Dead peers in the stale list only cost failed sends.
-		r.mu.Lock()
-		defer r.mu.Unlock()
-		if r.peers != nil {
-			return r.peers, nil
-		}
-		return nil, err
-	}
-	r.mu.Lock()
-	r.peers = peers
-	r.peersFetched = time.Now()
-	r.mu.Unlock()
-	return peers, nil
-}
-
-// Prune deletes registry rows whose heartbeat is long expired. Only the leader calls this; the
-// grace period of 3x the TTL avoids deleting rows of nodes that are merely slow to heartbeat.
-func (r *Registry) Prune() error {
-	_, err := r.pool.Exec(pruneStaleNodesQuery, time.Now().Add(-3*r.ttl).Unix())
-	return err
-}
-
-// Deregister deletes this node's registry row; called on shutdown.
-func (r *Registry) Deregister() error {
-	_, err := r.pool.Exec(deleteNodeQuery, r.nodeID)
-	return err
-}
-
-// queryPeers reads the current live peer set from the registry table.
-func (r *Registry) queryPeers() ([]*Peer, error) {
-	cutoff := time.Now().Add(-r.ttl).Unix()
-	rows, err := r.pool.Query(selectPeersQuery, cutoff, r.nodeID)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	peers := make([]*Peer, 0)
-	for rows.Next() {
-		p := &Peer{}
-		if err := rows.Scan(&p.NodeID, &p.AdvertiseURL); err != nil {
-			return nil, err
-		}
-		peers = append(peers, p)
-	}
-	if err := rows.Err(); err != nil {
-		return nil, err
-	}
-	return peers, nil
-}

cluster/registry/registry_test.go

@@ -1,222 +0,0 @@
-package registry
-
-import (
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/db/pg"
-	dbtest "heckel.io/ntfy/v2/db/test"
-)
-
-func openTestPool(t *testing.T, dsn string) *db.DB {
-	t.Helper()
-	host, err := pg.Open(dsn)
-	require.Nil(t, err)
-	d := db.New(host, nil)
-	t.Cleanup(func() { d.Close() })
-	return d
-}
-
-func TestRegistry_NewDoesNotRegister(t *testing.T) {
-	// New only sets up the schema and the identity handle; joining the cluster is an explicit
-	// Register call, owned by the caller (the mesh registers synchronously at construction).
-	// This keeps read-only uses (ops tooling, future admin endpoints) side-effect free.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	require.Equal(t, 0, countRows(t, pool, "node-1"))
-	require.Nil(t, r1.Register())
-	require.Equal(t, 1, countRows(t, pool, "node-1"))
-}
-
-func TestRegistry_RegisterAndPeers(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, r1.Register())
-	r2, err := New(pool, "node-2", "http://10.0.0.2:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, r2.Register())
-	// Each node sees the other, never itself
-	peers, err := r1.Peers()
-	require.Nil(t, err)
-	require.Len(t, peers, 1)
-	require.Equal(t, "node-2", peers[0].NodeID)
-	require.Equal(t, "http://10.0.0.2:2587", peers[0].AdvertiseURL)
-	peers, err = r2.Peers()
-	require.Nil(t, err)
-	require.Len(t, peers, 1)
-	require.Equal(t, "node-1", peers[0].NodeID)
-}
-
-func TestRegistry_ReRegisterUpdatesAdvertiseURL(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	// The same node comes back under a new address; the upsert replaces the row
-	old, err := New(pool, "node-2", "http://old:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, old.Register())
-	renewed, err := New(pool, "node-2", "http://new:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, renewed.Register())
-	expireCache(r1)
-	peers, err := r1.Peers()
-	require.Nil(t, err)
-	require.Len(t, peers, 1)
-	require.Equal(t, "http://new:2587", peers[0].AdvertiseURL)
-}
-
-func TestRegistry_PeersCachedForTTL(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	peers, err := r1.Peers()
-	require.Nil(t, err)
-	require.Empty(t, peers)
-	// A node joining after the cache was populated is invisible until the cache expires
-	r2, err := New(pool, "node-2", "http://10.0.0.2:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, r2.Register())
-	peers, err = r1.Peers()
-	require.Nil(t, err)
-	require.Empty(t, peers)
-	expireCache(r1)
-	peers, err = r1.Peers()
-	require.Nil(t, err)
-	require.Len(t, peers, 1)
-}
-
-func TestRegistry_TTLExcludesSilentNodes(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	// A node whose heartbeat is older than the TTL does not count as live
-	_, err = pool.Exec(upsertNodeQuery, "node-silent", "http://10.0.0.9:2587", time.Now().Add(-2*time.Minute).Unix())
-	require.Nil(t, err)
-	peers, err := r1.Peers()
-	require.Nil(t, err)
-	require.Empty(t, peers)
-}
-
-func TestRegistry_PruneDeletesLongDeadOnly(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	// One node beyond the 3x TTL grace period, one merely stale
-	_, err = pool.Exec(upsertNodeQuery, "node-long-dead", "http://10.0.0.8:2587", time.Now().Add(-4*time.Minute).Unix())
-	require.Nil(t, err)
-	_, err = pool.Exec(upsertNodeQuery, "node-slow", "http://10.0.0.9:2587", time.Now().Add(-2*time.Minute).Unix())
-	require.Nil(t, err)
-	require.Nil(t, r1.Prune())
-	require.Equal(t, 0, countRows(t, pool, "node-long-dead"))
-	require.Equal(t, 1, countRows(t, pool, "node-slow")) // Slow, not dead: kept
-}
-
-func TestRegistry_Deregister(t *testing.T) {
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, r1.Register())
-	require.Equal(t, 1, countRows(t, pool, "node-1"))
-	require.Nil(t, r1.Deregister())
-	require.Equal(t, 0, countRows(t, pool, "node-1"))
-}
-
-func TestRegistry_PeersStaleCacheOnError(t *testing.T) {
-	// During a database hiccup, Peers serves the last-known peer list instead of erroring:
-	// fan-out keeps flowing to known peers, and the publish path does not log a warning per
-	// message for the duration of the outage.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	r1, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	r2, err := New(pool, "node-2", "http://10.0.0.2:2587", time.Minute)
-	require.Nil(t, err)
-	require.Nil(t, r2.Register())
-	peers, err := r1.Peers()
-	require.Nil(t, err)
-	require.Len(t, peers, 1)
-	// Expire the cache and break the database; the stale list must still be served
-	expireCache(r1)
-	require.Nil(t, pool.Close())
-	peers, err = r1.Peers()
-	require.Nil(t, err)
-	require.Len(t, peers, 1)
-	require.Equal(t, "node-2", peers[0].NodeID)
-}
-
-func TestRegistry_ConcurrentCreate(t *testing.T) {
-	// Multiple nodes cold-booting on a fresh database must not race on table creation: CREATE
-	// TABLE IF NOT EXISTS is not atomic in PostgreSQL, so creation is serialized via an advisory
-	// lock. Without it, this test fails sporadically with a duplicate-key error on pg_class.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	const n = 8
-	errs := make(chan error, n)
-	for i := 0; i < n; i++ {
-		go func(i int) {
-			pool, err := pg.Open(schemaDSN)
-			if err != nil {
-				errs <- err
-				return
-			}
-			defer pool.DB.Close()
-			_, err = New(db.New(pool, nil), fmt.Sprintf("node-%d", i), "http://127.0.0.1:1", time.Second)
-			errs <- err
-		}(i)
-	}
-	for i := 0; i < n; i++ {
-		require.Nil(t, <-errs)
-	}
-}
-
-func TestRegistry_SchemaVersionWritten(t *testing.T) {
-	// The registry participates in the shared schema_version framework like every other store,
-	// so future table changes can be applied as migrations.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	_, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	var version int
-	require.Nil(t, pool.QueryRow(`SELECT version FROM schema_version WHERE store = $1`, schemaStoreKey).Scan(&version))
-	require.Equal(t, schemaVersion, version)
-	// Setup is idempotent: a second node boots against the migrated schema
-	_, err = New(pool, "node-2", "http://10.0.0.2:2587", time.Minute)
-	require.Nil(t, err)
-}
-
-func TestRegistry_SchemaVersionFromTheFuture(t *testing.T) {
-	// A node running older code must refuse to touch a schema migrated by newer code
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	pool := openTestPool(t, schemaDSN)
-	_, err := New(pool, "node-1", "http://10.0.0.1:2587", time.Minute)
-	require.Nil(t, err)
-	_, err = pool.Exec(`UPDATE schema_version SET version = 99 WHERE store = $1`, schemaStoreKey)
-	require.Nil(t, err)
-	_, err = New(pool, "node-2", "http://10.0.0.2:2587", time.Minute)
-	require.Error(t, err)
-}
-
-// expireCache forces the next Peers() call to re-read the registry table.
-func expireCache(r *Registry) {
-	r.mu.Lock()
-	r.peersFetched = time.Time{}
-	r.mu.Unlock()
-}
-
-func countRows(t *testing.T, pool *db.DB, nodeID string) int {
-	t.Helper()
-	var count int
-	require.Nil(t, pool.QueryRow(`SELECT COUNT(*) FROM node_registry WHERE node_id = $1`, nodeID).Scan(&count))
-	return count
-}

cluster/types.go

@@ -1,76 +0,0 @@
-package cluster
-
-import (
-	"time"
-
-	"heckel.io/ntfy/v2/model"
-	"heckel.io/ntfy/v2/util"
-)
-
-// Config configures the cluster. It is assembled by the server from its own config, which keeps
-// this package free of server types.
-type Config struct {
-	Enabled             bool          // Master switch; when false, New returns the nop cluster
-	NodeID              NodeID        // Stable per-node identifier; required
-	AdvertiseURL        string        // Base URL peers use to reach this node's fan-out endpoint
-	Secret              string        // Shared secret authenticating node-to-node fan-out requests
-	HeartbeatInterval   time.Duration // How often the node registry heartbeat is refreshed
-	NodeTTL             time.Duration // Registry rows older than this do not count as live peers
-	BatchLinger         time.Duration // How long messages wait in a peer queue to form a batch; 0 = send immediately
-	StateInterval       time.Duration // How often the full subscription state is pushed to peers
-	MaxMessageBytes     int64         // Upper bound for a single message on the wire (batch limits derive from this)
-	LeaderRenewInterval time.Duration // Overrides the leader lease renewal cadence; tests only, 0 = default
-}
-
-// DeliverFunc hands a message received from a peer node to this node's local subscribers. The
-// server supplies it, which inverts the dependency: this package never imports the server.
-type DeliverFunc func(m *model.Message)
-
-// State is a subscription-state delta for Cluster.BroadcastState.
-type State struct {
-	AddedTopics []string // Topics that just gained their first local subscriber on this node
-}
-
-// TopicsFunc returns the topics that currently have at least one live subscriber, computed
-// fresh on every call: membership is never tracked as a list, so topics "leave" simply by not
-// appearing in the next snapshot. The server supplies it (same inversion as DeliverFunc).
-type TopicsFunc func() []string
-
-// apiMessage is one line of a message request body (NDJSON: one message per line; a single
-// message is just a one-line body). It carries the two fields that model.Message does not
-// serialize to JSON (Sender and User), which are needed to reconstruct the visitor on the
-// receiving node. The origin node travels in a request header, not in the body.
-type apiMessage struct {
-	Sender  string         `json:"sender,omitempty"`
-	User    string         `json:"user,omitempty"`
-	Message *model.Message `json:"message"`
-}
-
-// apiState is the peer state-exchange envelope. Each concern is an optional section; future
-// concerns (rate limit counters, stats) become siblings of Topics.
-type apiState struct {
-	Topics *apiStateTopics `json:"topics,omitempty"`
-}
-
-// apiStateTopics carries a peer's subscription knowledge: either a full snapshot (Filter, a
-// marshaled Bloom filter over the topics with live subscribers) replacing all prior knowledge,
-// or an incremental update (Added) merged into it.
-type apiStateTopics struct {
-	Filter []byte   `json:"filter,omitempty"`
-	Added  []string `json:"added,omitempty"`
-}
-
-// peerState is what a peer last told us about itself; ForwardMessage routes around peers whose
-// fresh state provably excludes a topic.
-type peerState struct {
-	topics    *util.BloomFilter
-	updatedAt time.Time
-}
-
-// peerQueue is the bounded, batching send queue for a single peer, pinned to the advertise URL
-// the peer was created with: a peer re-registering under a different advertise URL is treated
-// as a replacement (reconcile retires the old queue; ForwardMessage creates a fresh one on demand).
-type peerQueue struct {
-	advertiseURL string
-	queue        *util.LingerQueue[[]byte] // pre-marshaled apiMessage fragments
-}

cluster/util.go

@@ -1,69 +0,0 @@
-package cluster
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/json"
-	"io"
-	"net/netip"
-	"strings"
-
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/model"
-)
-
-// messageURL derives the peer's message endpoint URL from its advertise URL.
-func messageURL(advertiseURL string) string {
-	return strings.TrimRight(advertiseURL, "/") + MessagePath
-}
-
-// stateURL derives the peer's state endpoint URL from its advertise URL.
-func stateURL(advertiseURL string) string {
-	return strings.TrimRight(advertiseURL, "/") + StatePath
-}
-
-// marshalMessage serializes one message and its non-JSON fields (Sender, User) as an
-// apiMessage line. Lines are marshaled once per publish and shared across all per-peer
-// queues; assembleMessageBody joins them without re-marshaling.
-func marshalMessage(m *model.Message) ([]byte, error) {
-	apiMsg := &apiMessage{User: m.User, Message: m}
-	if m.Sender.IsValid() {
-		apiMsg.Sender = m.Sender.String()
-	}
-	return json.Marshal(apiMsg)
-}
-
-// assembleMessageBody builds an NDJSON fan-out request body from pre-marshaled apiMessage
-// lines, avoiding a second JSON marshal of the messages.
-func assembleMessageBody(frags [][]byte) []byte {
-	return append(bytes.Join(frags, []byte("\n")), '\n')
-}
-
-// decodeMessageBody reads NDJSON apiMessage lines from r, reattaches the non-JSON fields
-// (Sender, User) onto each message, and hands them to deliver. Malformed or message-less lines
-// are skipped and logged, not fatal: fan-out is fire-and-forget, so the valid remainder of a
-// request is still delivered. It returns an error only for stream-level failures (e.g. a line
-// exceeding maxLineBytes).
-func decodeMessageBody(r io.Reader, maxLineBytes int, deliver DeliverFunc) error {
-	scanner := bufio.NewScanner(r)
-	scanner.Buffer(make([]byte, 64*1024), maxLineBytes)
-	for scanner.Scan() {
-		line := bytes.TrimSpace(scanner.Bytes())
-		if len(line) == 0 {
-			continue
-		}
-		var apiMsg apiMessage
-		if err := json.Unmarshal(line, &apiMsg); err != nil || apiMsg.Message == nil {
-			log.Tag(tag).Warn("Skipping malformed fan-out line")
-			continue
-		}
-		apiMsg.Message.User = apiMsg.User
-		if apiMsg.Sender != "" {
-			if addr, err := netip.ParseAddr(apiMsg.Sender); err == nil {
-				apiMsg.Message.Sender = addr
-			}
-		}
-		deliver(apiMsg.Message)
-	}
-	return scanner.Err()
-}

cmd/access.go

@@ -6,8 +6,8 @@ import (
 	"errors"
 	"fmt"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/auth"
+	"heckel.io/ntfy/util"
 )
 
 func init() {
@@ -19,7 +19,7 @@ const (
 )
 
 var flagsAccess = append(
-	append([]cli.Flag{}, flagsUser...),
+	flagsUser,
 	&cli.BoolFlag{Name: "reset", Aliases: []string{"r"}, Usage: "reset access for user (and topic)"},
 )
 
@@ -71,13 +71,13 @@ func execUserAccess(c *cli.Context) error {
 	if c.NArg() > 3 {
 		return errors.New("too many arguments, please check 'ntfy access --help' for usage details")
 	}
-	manager, err := createUserManager(c)
+	manager, err := createAuthManager(c)
 	if err != nil {
 		return err
 	}
 	username := c.Args().Get(0)
 	if username == userEveryone {
-		username = user.Everyone
+		username = auth.Everyone
 	}
 	topic := c.Args().Get(1)
 	perms := c.Args().Get(2)
@@ -96,38 +96,34 @@ func execUserAccess(c *cli.Context) error {
 	return changeAccess(c, manager, username, topic, perms)
 }
 
-func changeAccess(c *cli.Context, manager *user.Manager, username string, topic string, perms string) error {
+func changeAccess(c *cli.Context, manager auth.Manager, username string, topic string, perms string) error {
 	if !util.Contains([]string{"", "read-write", "rw", "read-only", "read", "ro", "write-only", "write", "wo", "none", "deny"}, perms) {
 		return errors.New("permission must be one of: read-write, read-only, write-only, or deny (or the aliases: read, ro, write, wo, none)")
 	}
-	permission, err := user.ParsePermission(perms)
-	if err != nil {
-		return err
-	}
-	u, err := manager.User(username)
-	if errors.Is(err, user.ErrUserNotFound) {
+	read := util.Contains([]string{"read-write", "rw", "read-only", "read", "ro"}, perms)
+	write := util.Contains([]string{"read-write", "rw", "write-only", "write", "wo"}, perms)
+	user, err := manager.User(username)
+	if err == auth.ErrNotFound {
 		return fmt.Errorf("user %s does not exist", username)
-	} else if err != nil {
-		return err
-	} else if u.Role == user.RoleAdmin {
+	} else if user.Role == auth.RoleAdmin {
 		return fmt.Errorf("user %s is an admin user, access control entries have no effect", username)
 	}
-	if err := manager.AllowAccess(username, topic, permission); err != nil {
+	if err := manager.AllowAccess(username, topic, read, write); err != nil {
 		return err
 	}
-	if permission.IsReadWrite() {
-		fmt.Fprintf(c.App.Writer, "granted read-write access to topic %s\n\n", topic)
-	} else if permission.IsRead() {
-		fmt.Fprintf(c.App.Writer, "granted read-only access to topic %s\n\n", topic)
-	} else if permission.IsWrite() {
-		fmt.Fprintf(c.App.Writer, "granted write-only access to topic %s\n\n", topic)
+	if read && write {
+		fmt.Fprintf(c.App.ErrWriter, "granted read-write access to topic %s\n\n", topic)
+	} else if read {
+		fmt.Fprintf(c.App.ErrWriter, "granted read-only access to topic %s\n\n", topic)
+	} else if write {
+		fmt.Fprintf(c.App.ErrWriter, "granted write-only access to topic %s\n\n", topic)
 	} else {
-		fmt.Fprintf(c.App.Writer, "revoked all access to topic %s\n\n", topic)
+		fmt.Fprintf(c.App.ErrWriter, "revoked all access to topic %s\n\n", topic)
 	}
 	return showUserAccess(c, manager, username)
 }
 
-func resetAccess(c *cli.Context, manager *user.Manager, username, topic string) error {
+func resetAccess(c *cli.Context, manager auth.Manager, username, topic string) error {
 	if username == "" {
 		return resetAllAccess(c, manager)
 	} else if topic == "" {
@@ -136,38 +132,38 @@ func resetAccess(c *cli.Context, manager *user.Manager, username, topic string)
 	return resetUserTopicAccess(c, manager, username, topic)
 }
 
-func resetAllAccess(c *cli.Context, manager *user.Manager) error {
+func resetAllAccess(c *cli.Context, manager auth.Manager) error {
 	if err := manager.ResetAccess("", ""); err != nil {
 		return err
 	}
-	fmt.Fprintln(c.App.Writer, "reset access for all users")
+	fmt.Fprintln(c.App.ErrWriter, "reset access for all users")
 	return nil
 }
 
-func resetUserAccess(c *cli.Context, manager *user.Manager, username string) error {
+func resetUserAccess(c *cli.Context, manager auth.Manager, username string) error {
 	if err := manager.ResetAccess(username, ""); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "reset access for user %s\n\n", username)
+	fmt.Fprintf(c.App.ErrWriter, "reset access for user %s\n\n", username)
 	return showUserAccess(c, manager, username)
 }
 
-func resetUserTopicAccess(c *cli.Context, manager *user.Manager, username string, topic string) error {
+func resetUserTopicAccess(c *cli.Context, manager auth.Manager, username string, topic string) error {
 	if err := manager.ResetAccess(username, topic); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "reset access for user %s and topic %s\n\n", username, topic)
+	fmt.Fprintf(c.App.ErrWriter, "reset access for user %s and topic %s\n\n", username, topic)
 	return showUserAccess(c, manager, username)
 }
 
-func showAccess(c *cli.Context, manager *user.Manager, username string) error {
+func showAccess(c *cli.Context, manager auth.Manager, username string) error {
 	if username == "" {
 		return showAllAccess(c, manager)
 	}
 	return showUserAccess(c, manager, username)
 }
 
-func showAllAccess(c *cli.Context, manager *user.Manager) error {
+func showAllAccess(c *cli.Context, manager auth.Manager) error {
 	users, err := manager.Users()
 	if err != nil {
 		return err
@@ -175,62 +171,46 @@ func showAllAccess(c *cli.Context, manager *user.Manager) error {
 	return showUsers(c, manager, users)
 }
 
-func showUserAccess(c *cli.Context, manager *user.Manager, username string) error {
+func showUserAccess(c *cli.Context, manager auth.Manager, username string) error {
 	users, err := manager.User(username)
-	if errors.Is(err, user.ErrUserNotFound) {
+	if err == auth.ErrNotFound {
 		return fmt.Errorf("user %s does not exist", username)
 	} else if err != nil {
 		return err
 	}
-	return showUsers(c, manager, []*user.User{users})
+	return showUsers(c, manager, []*auth.User{users})
 }
 
-func showUsers(c *cli.Context, manager *user.Manager, users []*user.User) error {
-	for _, u := range users {
-		grants, err := manager.Grants(u.Name)
-		if err != nil {
-			return err
-		}
-		tier := "none"
-		if u.Tier != nil {
-			tier = u.Tier.Name
-		}
-		provisioned := ""
-		if u.Provisioned {
-			provisioned = ", server config"
-		}
-		fmt.Fprintf(c.App.Writer, "user %s (role: %s, tier: %s%s)\n", u.Name, u.Role, tier, provisioned)
-		if u.Role == user.RoleAdmin {
-			fmt.Fprintf(c.App.Writer, "- read-write access to all topics (admin role)\n")
-		} else if len(grants) > 0 {
-			for _, grant := range grants {
-				grantProvisioned := ""
-				if grant.Provisioned {
-					grantProvisioned = " (server config)"
-				}
-				if grant.Permission.IsReadWrite() {
-					fmt.Fprintf(c.App.Writer, "- read-write access to topic %s%s\n", grant.TopicPattern, grantProvisioned)
-				} else if grant.Permission.IsRead() {
-					fmt.Fprintf(c.App.Writer, "- read-only access to topic %s%s\n", grant.TopicPattern, grantProvisioned)
-				} else if grant.Permission.IsWrite() {
-					fmt.Fprintf(c.App.Writer, "- write-only access to topic %s%s\n", grant.TopicPattern, grantProvisioned)
+func showUsers(c *cli.Context, manager auth.Manager, users []*auth.User) error {
+	for _, user := range users {
+		fmt.Fprintf(c.App.ErrWriter, "user %s (%s)\n", user.Name, user.Role)
+		if user.Role == auth.RoleAdmin {
+			fmt.Fprintf(c.App.ErrWriter, "- read-write access to all topics (admin role)\n")
+		} else if len(user.Grants) > 0 {
+			for _, grant := range user.Grants {
+				if grant.AllowRead && grant.AllowWrite {
+					fmt.Fprintf(c.App.ErrWriter, "- read-write access to topic %s\n", grant.TopicPattern)
+				} else if grant.AllowRead {
+					fmt.Fprintf(c.App.ErrWriter, "- read-only access to topic %s\n", grant.TopicPattern)
+				} else if grant.AllowWrite {
+					fmt.Fprintf(c.App.ErrWriter, "- write-only access to topic %s\n", grant.TopicPattern)
 				} else {
-					fmt.Fprintf(c.App.Writer, "- no access to topic %s%s\n", grant.TopicPattern, grantProvisioned)
+					fmt.Fprintf(c.App.ErrWriter, "- no access to topic %s\n", grant.TopicPattern)
 				}
 			}
 		} else {
-			fmt.Fprintf(c.App.Writer, "- no topic-specific permissions\n")
+			fmt.Fprintf(c.App.ErrWriter, "- no topic-specific permissions\n")
 		}
-		if u.Name == user.Everyone {
-			access := manager.DefaultAccess()
-			if access.IsReadWrite() {
-				fmt.Fprintln(c.App.Writer, "- read-write access to all (other) topics (server config)")
-			} else if access.IsRead() {
-				fmt.Fprintln(c.App.Writer, "- read-only access to all (other) topics (server config)")
-			} else if access.IsWrite() {
-				fmt.Fprintln(c.App.Writer, "- write-only access to all (other) topics (server config)")
+		if user.Name == auth.Everyone {
+			defaultRead, defaultWrite := manager.DefaultAccess()
+			if defaultRead && defaultWrite {
+				fmt.Fprintln(c.App.ErrWriter, "- read-write access to all (other) topics (server config)")
+			} else if defaultRead {
+				fmt.Fprintln(c.App.ErrWriter, "- read-only access to all (other) topics (server config)")
+			} else if defaultWrite {
+				fmt.Fprintln(c.App.ErrWriter, "- write-only access to all (other) topics (server config)")
 			} else {
-				fmt.Fprintln(c.App.Writer, "- no access to any (other) topics (server config)")
+				fmt.Fprintln(c.App.ErrWriter, "- no access to any (other) topics (server config)")
 			}
 		}
 	}

cmd/access_test.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"github.com/stretchr/testify/require"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/server"
-	"heckel.io/ntfy/v2/test"
+	"heckel.io/ntfy/server"
+	"heckel.io/ntfy/test"
 	"testing"
 )
 
@@ -13,9 +13,9 @@ func TestCLI_Access_Show(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
 	defer test.StopServer(t, s, port)
 
-	app, _, stdout, _ := newTestApp()
+	app, _, _, stderr := newTestApp()
 	require.Nil(t, runAccessCommand(app, conf))
-	require.Contains(t, stdout.String(), "user * (role: anonymous, tier: none)\n- no topic-specific permissions\n- no access to any (other) topics (server config)")
+	require.Contains(t, stderr.String(), "user * (anonymous)\n- no topic-specific permissions\n- no access to any (other) topics (server config)")
 }
 
 func TestCLI_Access_Grant_And_Publish(t *testing.T) {
@@ -30,18 +30,18 @@ func TestCLI_Access_Grant_And_Publish(t *testing.T) {
 	require.Nil(t, runAccessCommand(app, conf, "ben", "sometopic", "read"))
 	require.Nil(t, runAccessCommand(app, conf, "everyone", "announcements", "read"))
 
-	app, _, stdout, _ := newTestApp()
+	app, _, _, stderr := newTestApp()
 	require.Nil(t, runAccessCommand(app, conf))
-	expected := `user phil (role: admin, tier: none)
+	expected := `user phil (admin)
 - read-write access to all topics (admin role)
-user ben (role: user, tier: none)
+user ben (user)
 - read-write access to topic announcements
 - read-only access to topic sometopic
-user * (role: anonymous, tier: none)
+user * (anonymous)
 - read-only access to topic announcements
 - no access to any (other) topics (server config)
 `
-	require.Equal(t, expected, stdout.String())
+	require.Equal(t, expected, stderr.String())
 
 	// See if access permissions match
 	app, _, _, _ = newTestApp()
@@ -79,11 +79,9 @@ user * (role: anonymous, tier: none)
 func runAccessCommand(app *cli.App, conf *server.Config, args ...string) error {
 	userArgs := []string{
 		"ntfy",
-		"--log-level=ERROR",
 		"access",
-		"--config=" + conf.File, // Dummy config file to avoid lookups of real file
 		"--auth-file=" + conf.AuthFile,
-		"--auth-default-access=" + conf.AuthDefault.String(),
+		"--auth-default-access=" + confToDefaultAccess(conf),
 	}
 	return app.Run(append(userArgs, args...))
 }

cmd/app.go

@@ -2,13 +2,10 @@
 package cmd
 
 import (
-	"fmt"
-	"os"
-	"regexp"
-
 	"github.com/urfave/cli/v2"
 	"github.com/urfave/cli/v2/altsrc"
-	"heckel.io/ntfy/v2/log"
+	"heckel.io/ntfy/log"
+	"os"
 )
 
 const (
@@ -16,12 +13,6 @@ const (
 	categoryServer = "Server commands"
 )
 
-// Build metadata keys for app.Metadata
-const (
-	MetadataKeyCommit = "commit"
-	MetadataKeyDate   = "date"
-)
-
 var commands = make([]*cli.Command, 0)
 
 var flagsDefault = []cli.Flag{
@@ -29,22 +20,15 @@ var flagsDefault = []cli.Flag{
 	&cli.BoolFlag{Name: "trace", EnvVars: []string{"NTFY_TRACE"}, Usage: "enable tracing (very verbose, be careful)"},
 	&cli.BoolFlag{Name: "no-log-dates", Aliases: []string{"no_log_dates"}, EnvVars: []string{"NTFY_NO_LOG_DATES"}, Usage: "disable the date/time prefix"},
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "log-level", Aliases: []string{"log_level"}, Value: log.InfoLevel.String(), EnvVars: []string{"NTFY_LOG_LEVEL"}, Usage: "set log level"}),
-	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "log-level-overrides", Aliases: []string{"log_level_overrides"}, EnvVars: []string{"NTFY_LOG_LEVEL_OVERRIDES"}, Usage: "set log level overrides"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "log-format", Aliases: []string{"log_format"}, Value: log.TextFormat.String(), EnvVars: []string{"NTFY_LOG_FORMAT"}, Usage: "set log format"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "log-file", Aliases: []string{"log_file"}, EnvVars: []string{"NTFY_LOG_FILE"}, Usage: "set log file, default is STDOUT"}),
 }
 
-var (
-	logLevelOverrideRegex = regexp.MustCompile(`(?i)^([^=\s]+)(?:\s*=\s*(\S+))?\s*->\s*(TRACE|DEBUG|INFO|WARN|ERROR)$`)
-)
-
 // New creates a new CLI application
 func New() *cli.App {
 	return &cli.App{
 		Name:                   "ntfy",
 		Usage:                  "Simple pub-sub notification service",
 		UsageText:              "ntfy [OPTION..]",
-		HideVersion:            false,
+		HideVersion:            true,
 		UseShortOptionHandling: true,
 		Reader:                 os.Stdin,
 		Writer:                 os.Stdout,
@@ -56,42 +40,15 @@ func New() *cli.App {
 }
 
 func initLogFunc(c *cli.Context) error {
-	log.SetLevel(log.ToLevel(c.String("log-level")))
-	log.SetFormat(log.ToFormat(c.String("log-format")))
 	if c.Bool("trace") {
 		log.SetLevel(log.TraceLevel)
 	} else if c.Bool("debug") {
 		log.SetLevel(log.DebugLevel)
+	} else {
+		log.SetLevel(log.ToLevel(c.String("log-level")))
 	}
 	if c.Bool("no-log-dates") {
 		log.DisableDates()
 	}
-	if err := applyLogLevelOverrides(c.StringSlice("log-level-overrides")); err != nil {
-		return err
-	}
-	logFile := c.String("log-file")
-	if logFile != "" {
-		w, err := os.OpenFile(logFile, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
-		if err != nil {
-			return err
-		}
-		log.SetOutput(w)
-	}
-	return nil
-}
-
-func applyLogLevelOverrides(rawOverrides []string) error {
-	for _, override := range rawOverrides {
-		m := logLevelOverrideRegex.FindStringSubmatch(override)
-		if len(m) == 4 {
-			field, value, level := m[1], m[2], m[3]
-			log.SetLevelOverride(field, value, log.ToLevel(level))
-		} else if len(m) == 3 {
-			field, level := m[1], m[2]
-			log.SetLevelOverride(field, "", log.ToLevel(level)) // Matches any value
-		} else {
-			return fmt.Errorf(`invalid log level override "%s", must be "field=value -> loglevel", e.g. "user_id=u_123 -> DEBUG"`, override)
-		}
-	}
 	return nil
 }

cmd/app_test.go

@@ -4,8 +4,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/client"
-	"heckel.io/ntfy/v2/log"
+	"heckel.io/ntfy/client"
 	"os"
 	"strings"
 	"testing"
@@ -14,7 +13,7 @@ import (
 // This only contains helpers so far
 
 func TestMain(m *testing.M) {
-	log.SetLevel(log.ErrorLevel)
+	// log.SetOutput(io.Discard)
 	os.Exit(m.Run())
 }
 

cmd/config_loader.go

@@ -5,7 +5,7 @@ import (
 	"github.com/urfave/cli/v2"
 	"github.com/urfave/cli/v2/altsrc"
 	"gopkg.in/yaml.v2"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/util"
 	"os"
 )
 

cmd/publish.go

@@ -4,9 +4,10 @@ import (
 	"errors"
 	"fmt"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/client"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/client"
+	"heckel.io/ntfy/log"
+	"heckel.io/ntfy/server"
+	"heckel.io/ntfy/util"
 	"io"
 	"os"
 	"os/exec"
@@ -20,7 +21,7 @@ func init() {
 }
 
 var flagsPublish = append(
-	append([]cli.Flag{}, flagsDefault...),
+	flagsDefault,
 	&cli.StringFlag{Name: "config", Aliases: []string{"c"}, EnvVars: []string{"NTFY_CONFIG"}, Usage: "client config file"},
 	&cli.StringFlag{Name: "title", Aliases: []string{"t"}, EnvVars: []string{"NTFY_TITLE"}, Usage: "message title"},
 	&cli.StringFlag{Name: "message", Aliases: []string{"m"}, EnvVars: []string{"NTFY_MESSAGE"}, Usage: "message body"},
@@ -31,18 +32,15 @@ var flagsPublish = append(
 	&cli.StringFlag{Name: "icon", Aliases: []string{"i"}, EnvVars: []string{"NTFY_ICON"}, Usage: "URL to use as notification icon"},
 	&cli.StringFlag{Name: "actions", Aliases: []string{"A"}, EnvVars: []string{"NTFY_ACTIONS"}, Usage: "actions JSON array or simple definition"},
 	&cli.StringFlag{Name: "attach", Aliases: []string{"a"}, EnvVars: []string{"NTFY_ATTACH"}, Usage: "URL to send as an external attachment"},
-	&cli.BoolFlag{Name: "markdown", Aliases: []string{"md"}, EnvVars: []string{"NTFY_MARKDOWN"}, Usage: "Message is formatted as Markdown"},
-	&cli.StringFlag{Name: "template", Aliases: []string{"tpl"}, EnvVars: []string{"NTFY_TEMPLATE"}, Usage: "use templates to transform JSON message body"},
 	&cli.StringFlag{Name: "filename", Aliases: []string{"name", "n"}, EnvVars: []string{"NTFY_FILENAME"}, Usage: "filename for the attachment"},
-	&cli.StringFlag{Name: "sequence-id", Aliases: []string{"sequence_id", "sid", "S"}, EnvVars: []string{"NTFY_SEQUENCE_ID"}, Usage: "sequence ID for updating notifications"},
 	&cli.StringFlag{Name: "file", Aliases: []string{"f"}, EnvVars: []string{"NTFY_FILE"}, Usage: "file to upload as an attachment"},
 	&cli.StringFlag{Name: "email", Aliases: []string{"mail", "e"}, EnvVars: []string{"NTFY_EMAIL"}, Usage: "also send to e-mail address"},
 	&cli.StringFlag{Name: "user", Aliases: []string{"u"}, EnvVars: []string{"NTFY_USER"}, Usage: "username[:password] used to auth against the server"},
-	&cli.StringFlag{Name: "token", Aliases: []string{"k"}, EnvVars: []string{"NTFY_TOKEN"}, Usage: "access token used to auth against the server"},
 	&cli.IntFlag{Name: "wait-pid", Aliases: []string{"wait_pid", "pid"}, EnvVars: []string{"NTFY_WAIT_PID"}, Usage: "wait until PID exits before publishing"},
 	&cli.BoolFlag{Name: "wait-cmd", Aliases: []string{"wait_cmd", "cmd", "done"}, EnvVars: []string{"NTFY_WAIT_CMD"}, Usage: "run command and wait until it finishes before publishing"},
 	&cli.BoolFlag{Name: "no-cache", Aliases: []string{"no_cache", "C"}, EnvVars: []string{"NTFY_NO_CACHE"}, Usage: "do not cache message server-side"},
 	&cli.BoolFlag{Name: "no-firebase", Aliases: []string{"no_firebase", "F"}, EnvVars: []string{"NTFY_NO_FIREBASE"}, Usage: "do not forward message to Firebase"},
+	&cli.BoolFlag{Name: "env-topic", Aliases: []string{"env_topic", "P"}, EnvVars: []string{"NTFY_ENV_TOPIC"}, Usage: "use topic from NTFY_TOPIC env variable"},
 	&cli.BoolFlag{Name: "quiet", Aliases: []string{"q"}, EnvVars: []string{"NTFY_QUIET"}, Usage: "do not print message"},
 )
 
@@ -52,7 +50,7 @@ var cmdPublish = &cli.Command{
 	Usage:   "Send message via a ntfy server",
 	UsageText: `ntfy publish [OPTIONS..] TOPIC [MESSAGE...]
 ntfy publish [OPTIONS..] --wait-cmd COMMAND...
-NTFY_TOPIC=.. ntfy publish [OPTIONS..] [MESSAGE...]`,
+NTFY_TOPIC=.. ntfy publish [OPTIONS..] -P [MESSAGE...]`,
 	Action:   execPublish,
 	Category: categoryClient,
 	Flags:    flagsPublish,
@@ -71,13 +69,11 @@ Examples:
   ntfy pub --icon="http://some.tld/icon.png" 'Icon!'      # Send notification with custom icon
   ntfy pub --attach="http://some.tld/file.zip" files      # Send ZIP archive from URL as attachment
   ntfy pub --file=flower.jpg flowers 'Nice!'              # Send image.jpg as attachment
-  ntfy pub -S my-id mytopic 'Update me'                   # Send with sequence ID for updates
-  echo 'message' | ntfy publish mytopic                   # Send message from stdin
   ntfy pub -u phil:mypass secret Psst                     # Publish with username/password
   ntfy pub --wait-pid 1234 mytopic                        # Wait for process 1234 to exit before publishing
   ntfy pub --wait-cmd mytopic rsync -av ./ /tmp/a         # Run command and publish after it completes
   NTFY_USER=phil:mypass ntfy pub secret Psst              # Use env variables to set username/password
-  NTFY_TOPIC=mytopic ntfy pub "some message"              # Use NTFY_TOPIC variable as topic 
+  NTFY_TOPIC=mytopic ntfy pub -P "some message"           # Use NTFY_TOPIC variable as topic 
   cat flower.jpg | ntfy pub --file=- flowers 'Nice!'      # Same as above, send image.jpg as attachment
   ntfy trigger mywebhook                                  # Sending without message, useful for webhooks
  
@@ -100,78 +96,50 @@ func execPublish(c *cli.Context) error {
 	icon := c.String("icon")
 	actions := c.String("actions")
 	attach := c.String("attach")
-	markdown := c.Bool("markdown")
-	template := c.String("template")
 	filename := c.String("filename")
-	sequenceID := c.String("sequence-id")
 	file := c.String("file")
 	email := c.String("email")
 	user := c.String("user")
-	token := c.String("token")
 	noCache := c.Bool("no-cache")
 	noFirebase := c.Bool("no-firebase")
 	quiet := c.Bool("quiet")
 	pid := c.Int("wait-pid")
-
-	// Checks
-	if user != "" && token != "" {
-		return errors.New("cannot set both --user and --token")
-	}
-
-	// Do the things
+	password := os.Getenv("NTFY_PASSWORD")
 	topic, message, command, err := parseTopicMessageCommand(c)
 	if err != nil {
 		return err
 	}
+	pm := &server.PublishMessage{
+		Topic:    topic,
+		Title:    title,
+		Message:  message,
+		Tags:     util.SplitNoEmpty(tags, ","),
+		Click:    click,
+		Actions:  nil,
+		Attach:   attach,
+		Filename: filename,
+		Email:    email,
+		Delay:    delay,
+	}
 	var options []client.PublishOption
-	if title != "" {
-		options = append(options, client.WithTitle(title))
-	}
-	if priority != "" {
-		options = append(options, client.WithPriority(priority))
-	}
-	if tags != "" {
-		options = append(options, client.WithTagsList(tags))
-	}
-	if delay != "" {
-		options = append(options, client.WithDelay(delay))
-	}
-	if click != "" {
-		options = append(options, client.WithClick(click))
+	p, err := util.ParsePriority(priority)
+	if err != nil {
+		return err
 	}
+	pm.Priority = p
 	if icon != "" {
 		options = append(options, client.WithIcon(icon))
 	}
 	if actions != "" {
 		options = append(options, client.WithActions(strings.ReplaceAll(actions, "\n", " ")))
 	}
-	if attach != "" {
-		options = append(options, client.WithAttach(attach))
-	}
-	if markdown {
-		options = append(options, client.WithMarkdown())
-	}
-	if template != "" {
-		options = append(options, client.WithTemplate(template))
-	}
-	if filename != "" {
-		options = append(options, client.WithFilename(filename))
-	}
-	if sequenceID != "" {
-		options = append(options, client.WithSequenceID(sequenceID))
-	}
-	if email != "" {
-		options = append(options, client.WithEmail(email))
-	}
 	if noCache {
 		options = append(options, client.WithNoCache())
 	}
 	if noFirebase {
 		options = append(options, client.WithNoFirebase())
 	}
-	if token != "" {
-		options = append(options, client.WithBearerAuth(token))
-	} else if user != "" {
+	if user != "" {
 		var pass string
 		parts := strings.SplitN(user, ":", 2)
 		if len(parts) == 2 {
@@ -187,24 +155,20 @@ func execPublish(c *cli.Context) error {
 			fmt.Fprintf(c.App.ErrWriter, "\r%s\r", strings.Repeat(" ", 20))
 		}
 		options = append(options, client.WithBasicAuth(user, pass))
-	} else if conf.DefaultToken != "" {
-		options = append(options, client.WithBearerAuth(conf.DefaultToken))
-	} else if conf.DefaultUser != "" && conf.DefaultPassword != nil {
-		options = append(options, client.WithBasicAuth(conf.DefaultUser, *conf.DefaultPassword))
 	}
 	if pid > 0 {
 		newMessage, err := waitForProcess(pid)
 		if err != nil {
 			return err
-		} else if message == "" {
-			message = newMessage
+		} else if pm.Message == "" {
+			pm.Message = newMessage
 		}
 	} else if len(command) > 0 {
 		newMessage, err := runAndWaitForCommand(command)
 		if err != nil {
 			return err
-		} else if message == "" {
-			message = newMessage
+		} else if pm.Message == "" {
+			pm.Message = newMessage
 		}
 	}
 	var body io.Reader
@@ -229,10 +193,16 @@ func execPublish(c *cli.Context) error {
 			}
 		}
 	}
+	var m *client.Message
 	cl := client.New(conf)
-	m, err := cl.PublishReader(topic, body, options...)
-	if err != nil {
-		return err
+	if password != "" {
+		if m, err = cl.PublishEncryptedReader(topic, m, password, options...); err != nil {
+			return err
+		}
+	} else {
+		if m, err = cl.PublishReader(topic, m, options...); err != nil {
+			return err
+		}
 	}
 	if !quiet {
 		fmt.Fprintln(c.App.Writer, strings.TrimSpace(m.Raw))
@@ -241,7 +211,7 @@ func execPublish(c *cli.Context) error {
 }
 
 // parseTopicMessageCommand reads the topic and the remaining arguments from the context.
-
+//
 // There are a few cases to consider:
 //
 //	ntfy publish <topic> [<message>]
@@ -266,22 +236,17 @@ func parseTopicMessageCommand(c *cli.Context) (topic string, message string, com
 	if c.String("message") != "" {
 		message = c.String("message")
 	}
-	if message == "" && isStdinRedirected() {
-		var data []byte
-		data, err = io.ReadAll(io.LimitReader(c.App.Reader, 1024*1024))
-		if err != nil {
-			log.Debug("Failed to read from stdin: %s", err.Error())
-			return
-		}
-		message = strings.TrimSpace(string(data))
-	}
 	return
 }
 
 func parseTopicAndArgs(c *cli.Context) (topic string, args []string, err error) {
-	envTopic := os.Getenv("NTFY_TOPIC")
-	if envTopic != "" {
-		topic = envTopic
+	envTopic := c.Bool("env-topic")
+	if envTopic {
+		fmt.Fprintln(c.App.ErrWriter, "\x1b[1;33mDeprecation notice: The --env-topic/-P flag will be removed in July 2022, see https://ntfy.sh/docs/deprecations/ for details.\x1b[0m")
+		topic = os.Getenv("NTFY_TOPIC")
+		if topic == "" {
+			return "", nil, errors.New("when --env-topic is passed, must define NTFY_TOPIC environment variable")
+		}
 		return topic, remainingArgs(c, 0), nil
 	}
 	if c.NArg() < 1 {
@@ -333,12 +298,3 @@ func runAndWaitForCommand(command []string) (message string, err error) {
 	log.Debug("Command succeeded after %s: %s", runtime, prettyCmd)
 	return fmt.Sprintf("Command succeeded after %s: %s", runtime, prettyCmd), nil
 }
-
-func isStdinRedirected() bool {
-	stat, err := os.Stdin.Stat()
-	if err != nil {
-		log.Debug("Failed to stat stdin: %s", err.Error())
-		return false
-	}
-	return (stat.Mode() & os.ModeCharDevice) == 0
-}

cmd/publish_test.go

@@ -2,38 +2,25 @@ package cmd
 
 import (
 	"fmt"
-	"net/http"
-	"net/http/httptest"
+	"github.com/stretchr/testify/require"
+	"heckel.io/ntfy/test"
+	"heckel.io/ntfy/util"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"strconv"
-	"strings"
 	"testing"
 	"time"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/test"
-	"heckel.io/ntfy/v2/util"
 )
 
 func TestCLI_Publish_Subscribe_Poll_Real_Server(t *testing.T) {
-	t.Skip("temporarily disabled") // FIXME
 	testMessage := util.RandomString(10)
+
 	app, _, _, _ := newTestApp()
 	require.Nil(t, app.Run([]string{"ntfy", "publish", "ntfytest", "ntfy unit test " + testMessage}))
 
-	_, err := util.Retry(func() (*int, error) {
-		app2, _, stdout, _ := newTestApp()
-		if err := app2.Run([]string{"ntfy", "subscribe", "--poll", "ntfytest"}); err != nil {
-			return nil, err
-		}
-		if !strings.Contains(stdout.String(), testMessage) {
-			return nil, fmt.Errorf("test message %s not found in topic", testMessage)
-		}
-		return util.Int(1), nil
-	}, time.Second, 2*time.Second, 5*time.Second) // Since #502, ntfy.sh writes messages to the cache asynchronously, after a timeout of ~1.5s
-	require.Nil(t, err)
+	app2, _, stdout, _ := newTestApp()
+	require.Nil(t, app2.Run([]string{"ntfy", "subscribe", "--poll", "ntfytest"}))
+	require.Contains(t, stdout.String(), testMessage)
 }
 
 func TestCLI_Publish_Subscribe_Poll(t *testing.T) {
@@ -135,11 +122,11 @@ func TestCLI_Publish_Wait_PID_And_Cmd(t *testing.T) {
 	require.Equal(t, `command failed: does-not-exist-no-really "really though", error: exec: "does-not-exist-no-really": executable file not found in $PATH`, err.Error())
 
 	// Tests with NTFY_TOPIC set ////
-	t.Setenv("NTFY_TOPIC", topic)
+	require.Nil(t, os.Setenv("NTFY_TOPIC", topic))
 
 	// Test: Successful command with NTFY_TOPIC
 	app, _, stdout, _ = newTestApp()
-	require.Nil(t, app.Run([]string{"ntfy", "publish", "--cmd", "echo", "hi there"}))
+	require.Nil(t, app.Run([]string{"ntfy", "publish", "--env-topic", "--cmd", "echo", "hi there"}))
 	m = toMessage(t, stdout.String())
 	require.Equal(t, "mytopic", m.Topic)
 
@@ -148,155 +135,7 @@ func TestCLI_Publish_Wait_PID_And_Cmd(t *testing.T) {
 	require.Nil(t, sleep.Start())
 	go sleep.Wait() // Must be called to release resources
 	app, _, stdout, _ = newTestApp()
-	require.Nil(t, app.Run([]string{"ntfy", "publish", "--wait-pid", strconv.Itoa(sleep.Process.Pid)}))
+	require.Nil(t, app.Run([]string{"ntfy", "publish", "--env-topic", "--wait-pid", strconv.Itoa(sleep.Process.Pid)}))
 	m = toMessage(t, stdout.String())
 	require.Regexp(t, `Process with PID \d+ exited after .+ms`, m.Message)
 }
-
-func TestCLI_Publish_Default_UserPass(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic", r.URL.Path)
-		require.Equal(t, "Basic cGhpbGlwcDpteXBhc3M=", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-user: philipp
-default-password: mypass
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-	require.Nil(t, app.Run([]string{"ntfy", "publish", "--config=" + filename, "mytopic", "triggered"}))
-	m := toMessage(t, stdout.String())
-	require.Equal(t, "triggered", m.Message)
-}
-
-func TestCLI_Publish_Default_Token(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic", r.URL.Path)
-		require.Equal(t, "Bearer tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-	require.Nil(t, app.Run([]string{"ntfy", "publish", "--config=" + filename, "mytopic", "triggered"}))
-	m := toMessage(t, stdout.String())
-	require.Equal(t, "triggered", m.Message)
-}
-
-func TestCLI_Publish_Default_UserPass_CLI_Token(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic", r.URL.Path)
-		require.Equal(t, "Bearer tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-user: philipp
-default-password: mypass
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-	require.Nil(t, app.Run([]string{"ntfy", "publish", "--config=" + filename, "--token", "tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", "mytopic", "triggered"}))
-	m := toMessage(t, stdout.String())
-	require.Equal(t, "triggered", m.Message)
-}
-
-func TestCLI_Publish_Default_Token_CLI_UserPass(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic", r.URL.Path)
-		require.Equal(t, "Basic cGhpbGlwcDpteXBhc3M=", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-	require.Nil(t, app.Run([]string{"ntfy", "publish", "--config=" + filename, "--user", "philipp:mypass", "mytopic", "triggered"}))
-	m := toMessage(t, stdout.String())
-	require.Equal(t, "triggered", m.Message)
-}
-
-func TestCLI_Publish_Default_Token_CLI_Token(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic", r.URL.Path)
-		require.Equal(t, "Bearer tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-token: tk_FAKETOKEN01234567890FAKETOKEN
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-	require.Nil(t, app.Run([]string{"ntfy", "publish", "--config=" + filename, "--token", "tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", "mytopic", "triggered"}))
-	m := toMessage(t, stdout.String())
-	require.Equal(t, "triggered", m.Message)
-}
-
-func TestCLI_Publish_Default_UserPass_CLI_UserPass(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic", r.URL.Path)
-		require.Equal(t, "Basic cGhpbGlwcDpteXBhc3M=", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-user: philipp
-default-password: fakepass
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-	require.Nil(t, app.Run([]string{"ntfy", "publish", "--config=" + filename, "--user", "philipp:mypass", "mytopic", "triggered"}))
-	m := toMessage(t, stdout.String())
-	require.Equal(t, "triggered", m.Message)
-}
-
-func TestCLI_Publish_Token_And_UserPass(t *testing.T) {
-	app, _, _, _ := newTestApp()
-	err := app.Run([]string{"ntfy", "publish", "--token", "tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", "--user", "philipp:mypass", "mytopic", "triggered"})
-	require.Error(t, err)
-	require.Equal(t, "cannot set both --user and --token", err.Error())
-}

cmd/publish_unix.go

@@ -1,4 +1,5 @@
 //go:build darwin || linux || dragonfly || freebsd || netbsd || openbsd
+// +build darwin linux dragonfly freebsd netbsd openbsd
 
 package cmd
 

cmd/serve.go

@@ -5,127 +5,71 @@ package cmd
 import (
 	"errors"
 	"fmt"
+	"heckel.io/ntfy/log"
 	"io/fs"
 	"math"
 	"net"
-	"net/netip"
-	"net/url"
-	"path/filepath"
-	"runtime"
+	"os"
+	"os/signal"
 	"strings"
-	"text/template"
+	"syscall"
 	"time"
 
 	"github.com/urfave/cli/v2"
 	"github.com/urfave/cli/v2/altsrc"
-	"heckel.io/ntfy/v2/ban"
-	"heckel.io/ntfy/v2/cluster"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/payments"
-	"heckel.io/ntfy/v2/server"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/server"
+	"heckel.io/ntfy/util"
 )
 
 func init() {
 	commands = append(commands, cmdServe)
 }
 
+const (
+	defaultServerConfigFile = "/etc/ntfy/server.yml"
+)
+
 var flagsServe = append(
-	append([]cli.Flag{}, flagsDefault...),
-	&cli.StringFlag{Name: "config", Aliases: []string{"c"}, EnvVars: []string{"NTFY_CONFIG_FILE"}, Value: server.DefaultConfigFile, Usage: "config file"},
+	flagsDefault,
+	&cli.StringFlag{Name: "config", Aliases: []string{"c"}, EnvVars: []string{"NTFY_CONFIG_FILE"}, Value: defaultServerConfigFile, DefaultText: defaultServerConfigFile, Usage: "config file"},
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "base-url", Aliases: []string{"base_url", "B"}, EnvVars: []string{"NTFY_BASE_URL"}, Usage: "externally visible base URL for this host (e.g. https://ntfy.sh)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "listen-http", Aliases: []string{"listen_http", "l"}, EnvVars: []string{"NTFY_LISTEN_HTTP"}, Value: server.DefaultListenHTTP, Usage: "ip:port used as HTTP listen address"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "listen-https", Aliases: []string{"listen_https", "L"}, EnvVars: []string{"NTFY_LISTEN_HTTPS"}, Usage: "ip:port used as HTTPS listen address"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "listen-http", Aliases: []string{"listen_http", "l"}, EnvVars: []string{"NTFY_LISTEN_HTTP"}, Value: server.DefaultListenHTTP, Usage: "ip:port used to as HTTP listen address"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "listen-https", Aliases: []string{"listen_https", "L"}, EnvVars: []string{"NTFY_LISTEN_HTTPS"}, Usage: "ip:port used to as HTTPS listen address"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "listen-unix", Aliases: []string{"listen_unix", "U"}, EnvVars: []string{"NTFY_LISTEN_UNIX"}, Usage: "listen on unix socket path"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "listen-unix-mode", Aliases: []string{"listen_unix_mode"}, EnvVars: []string{"NTFY_LISTEN_UNIX_MODE"}, DefaultText: "system default", Usage: "file permissions of unix socket, e.g. 0700"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "key-file", Aliases: []string{"key_file", "K"}, EnvVars: []string{"NTFY_KEY_FILE"}, Usage: "private key file, if listen-https is set"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "cert-file", Aliases: []string{"cert_file", "E"}, EnvVars: []string{"NTFY_CERT_FILE"}, Usage: "certificate file, if listen-https is set"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "firebase-key-file", Aliases: []string{"firebase_key_file", "F"}, EnvVars: []string{"NTFY_FIREBASE_KEY_FILE"}, Usage: "Firebase credentials file; if set additionally publish to FCM topic"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "database-url", Aliases: []string{"database_url"}, EnvVars: []string{"NTFY_DATABASE_URL"}, Usage: "PostgreSQL connection string for database-backed stores (e.g. postgres://user:pass@host:5432/ntfy)"}),
-	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "database-replica-urls", Aliases: []string{"database_replica_urls"}, EnvVars: []string{"NTFY_DATABASE_REPLICA_URLS"}, Usage: "PostgreSQL read replica connection strings for offloading read queries"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cluster-node-id", Aliases: []string{"cluster_node_id"}, EnvVars: []string{"NTFY_CLUSTER_NODE_ID"}, Usage: "stable per-node identifier for the cluster node registry (required in cluster mode)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cluster-listen", Aliases: []string{"cluster_listen"}, EnvVars: []string{"NTFY_CLUSTER_LISTEN"}, Usage: "ip:port for the dedicated cluster fan-out listener; bind it to the private network (e.g. 10.0.0.5:2587)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cluster-advertise-url", Aliases: []string{"cluster_advertise_url"}, EnvVars: []string{"NTFY_CLUSTER_ADVERTISE_URL"}, Usage: "base URL peer nodes use to reach this node's fan-out listener (defaults to http://<cluster-listen>)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cluster-secret", Aliases: []string{"cluster_secret"}, EnvVars: []string{"NTFY_CLUSTER_SECRET"}, Usage: "shared secret authenticating node-to-node fan-out requests"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cluster-batch-linger", Aliases: []string{"cluster_batch_linger"}, EnvVars: []string{"NTFY_CLUSTER_BATCH_LINGER"}, Value: util.FormatDuration(cluster.DefaultBatchLinger), Usage: "how long fan-out messages wait to form a batch per peer node (0 = send immediately)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "cache-file", Aliases: []string{"cache_file", "C"}, EnvVars: []string{"NTFY_CACHE_FILE"}, Usage: "cache file used for message caching"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cache-duration", Aliases: []string{"cache_duration", "b"}, EnvVars: []string{"NTFY_CACHE_DURATION"}, Value: util.FormatDuration(server.DefaultCacheDuration), Usage: "buffer messages for this time to allow `since` requests"}),
-	altsrc.NewIntFlag(&cli.IntFlag{Name: "cache-batch-size", Aliases: []string{"cache_batch_size"}, EnvVars: []string{"NTFY_BATCH_SIZE"}, Usage: "max size of messages to batch together when writing to message cache (if zero, writes are synchronous)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "cache-batch-timeout", Aliases: []string{"cache_batch_timeout"}, EnvVars: []string{"NTFY_CACHE_BATCH_TIMEOUT"}, Value: util.FormatDuration(server.DefaultCacheBatchTimeout), Usage: "timeout for batched async writes to the message cache (if zero, writes are synchronous)"}),
+	altsrc.NewDurationFlag(&cli.DurationFlag{Name: "cache-duration", Aliases: []string{"cache_duration", "b"}, EnvVars: []string{"NTFY_CACHE_DURATION"}, Value: server.DefaultCacheDuration, Usage: "buffer messages for this time to allow `since` requests"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "cache-startup-queries", Aliases: []string{"cache_startup_queries"}, EnvVars: []string{"NTFY_CACHE_STARTUP_QUERIES"}, Usage: "queries run when the cache database is initialized"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "auth-file", Aliases: []string{"auth_file", "H"}, EnvVars: []string{"NTFY_AUTH_FILE"}, Usage: "auth database file used for access control"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "auth-startup-queries", Aliases: []string{"auth_startup_queries"}, EnvVars: []string{"NTFY_AUTH_STARTUP_QUERIES"}, Usage: "queries run when the auth database is initialized"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "auth-default-access", Aliases: []string{"auth_default_access", "p"}, EnvVars: []string{"NTFY_AUTH_DEFAULT_ACCESS"}, Value: "read-write", Usage: "default permissions if no matching entries in the auth database are found"}),
-	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "auth-users", Aliases: []string{"auth_users"}, EnvVars: []string{"NTFY_AUTH_USERS"}, Usage: "pre-provisioned declarative users"}),
-	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "auth-access", Aliases: []string{"auth_access"}, EnvVars: []string{"NTFY_AUTH_ACCESS"}, Usage: "pre-provisioned declarative access control entries"}),
-	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "auth-tokens", Aliases: []string{"auth_tokens"}, EnvVars: []string{"NTFY_AUTH_TOKENS"}, Usage: "pre-provisioned declarative access tokens"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "auth-access-cache", Aliases: []string{"auth_access_cache"}, EnvVars: []string{"NTFY_AUTH_ACCESS_CACHE"}, Value: user.DefaultAccessCacheEnabled, Usage: "enables the in-memory ACL cache (high-volume servers only)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-cache-dir", Aliases: []string{"attachment_cache_dir"}, EnvVars: []string{"NTFY_ATTACHMENT_CACHE_DIR"}, Usage: "cache directory for attached files, or S3 URL (s3://ACCESS_KEY:SECRET_KEY@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT])"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-total-size-limit", Aliases: []string{"attachment_total_size_limit", "A"}, EnvVars: []string{"NTFY_ATTACHMENT_TOTAL_SIZE_LIMIT"}, Value: util.FormatSize(server.DefaultAttachmentTotalSizeLimit), Usage: "limit of the on-disk attachment cache"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-file-size-limit", Aliases: []string{"attachment_file_size_limit", "Y"}, EnvVars: []string{"NTFY_ATTACHMENT_FILE_SIZE_LIMIT"}, Value: util.FormatSize(server.DefaultAttachmentFileSizeLimit), Usage: "per-file attachment size limit (e.g. 300k, 2M, 100M)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-expiry-duration", Aliases: []string{"attachment_expiry_duration", "X"}, EnvVars: []string{"NTFY_ATTACHMENT_EXPIRY_DURATION"}, Value: util.FormatDuration(server.DefaultAttachmentExpiryDuration), Usage: "duration after which uploaded attachments will be deleted (e.g. 3h, 20h)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "template-dir", Aliases: []string{"template_dir"}, EnvVars: []string{"NTFY_TEMPLATE_DIR"}, Value: server.DefaultTemplateDir, Usage: "directory to load named message templates from"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "keepalive-interval", Aliases: []string{"keepalive_interval", "k"}, EnvVars: []string{"NTFY_KEEPALIVE_INTERVAL"}, Value: util.FormatDuration(server.DefaultKeepaliveInterval), Usage: "interval of keepalive messages"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "manager-interval", Aliases: []string{"manager_interval", "m"}, EnvVars: []string{"NTFY_MANAGER_INTERVAL"}, Value: util.FormatDuration(server.DefaultManagerInterval), Usage: "interval of for message pruning and stats printing"}),
-	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "disallowed-topics", Aliases: []string{"disallowed_topics"}, EnvVars: []string{"NTFY_DISALLOWED_TOPICS"}, Usage: "topics that are not allowed to be used"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-root", Aliases: []string{"web_root"}, EnvVars: []string{"NTFY_WEB_ROOT"}, Value: "/", Usage: "sets root of the web app (e.g. /, or /app), or disables it (disable)"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "enable-signup", Aliases: []string{"enable_signup"}, EnvVars: []string{"NTFY_ENABLE_SIGNUP"}, Value: false, Usage: "allows users to sign up via the web app, or API"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "enable-login", Aliases: []string{"enable_login"}, EnvVars: []string{"NTFY_ENABLE_LOGIN"}, Value: false, Usage: "allows users to log in via the web app, or API"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "enable-reservations", Aliases: []string{"enable_reservations"}, EnvVars: []string{"NTFY_ENABLE_RESERVATIONS"}, Value: false, Usage: "allows users to reserve topics (if their tier allows it)"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "require-login", Aliases: []string{"require_login"}, EnvVars: []string{"NTFY_REQUIRE_LOGIN"}, Value: false, Usage: "all actions via the web app requires a login"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-cache-dir", Aliases: []string{"attachment_cache_dir"}, EnvVars: []string{"NTFY_ATTACHMENT_CACHE_DIR"}, Usage: "cache directory for attached files"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-total-size-limit", Aliases: []string{"attachment_total_size_limit", "A"}, EnvVars: []string{"NTFY_ATTACHMENT_TOTAL_SIZE_LIMIT"}, DefaultText: "5G", Usage: "limit of the on-disk attachment cache"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-file-size-limit", Aliases: []string{"attachment_file_size_limit", "Y"}, EnvVars: []string{"NTFY_ATTACHMENT_FILE_SIZE_LIMIT"}, DefaultText: "15M", Usage: "per-file attachment size limit (e.g. 300k, 2M, 100M)"}),
+	altsrc.NewDurationFlag(&cli.DurationFlag{Name: "attachment-expiry-duration", Aliases: []string{"attachment_expiry_duration", "X"}, EnvVars: []string{"NTFY_ATTACHMENT_EXPIRY_DURATION"}, Value: server.DefaultAttachmentExpiryDuration, DefaultText: "3h", Usage: "duration after which uploaded attachments will be deleted (e.g. 3h, 20h)"}),
+	altsrc.NewDurationFlag(&cli.DurationFlag{Name: "keepalive-interval", Aliases: []string{"keepalive_interval", "k"}, EnvVars: []string{"NTFY_KEEPALIVE_INTERVAL"}, Value: server.DefaultKeepaliveInterval, Usage: "interval of keepalive messages"}),
+	altsrc.NewDurationFlag(&cli.DurationFlag{Name: "manager-interval", Aliases: []string{"manager_interval", "m"}, EnvVars: []string{"NTFY_MANAGER_INTERVAL"}, Value: server.DefaultManagerInterval, Usage: "interval of for message pruning and stats printing"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-root", Aliases: []string{"web_root"}, EnvVars: []string{"NTFY_WEB_ROOT"}, Value: "app", Usage: "sets web root to landing page (home), web app (app) or disabled (disable)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "upstream-base-url", Aliases: []string{"upstream_base_url"}, EnvVars: []string{"NTFY_UPSTREAM_BASE_URL"}, Value: "", Usage: "forward poll request to an upstream server, this is needed for iOS push notifications for self-hosted servers"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "upstream-access-token", Aliases: []string{"upstream_access_token"}, EnvVars: []string{"NTFY_UPSTREAM_ACCESS_TOKEN"}, Value: "", Usage: "access token to use for the upstream server; needed only if upstream rate limits are exceeded or upstream server requires auth"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-addr", Aliases: []string{"smtp_sender_addr"}, EnvVars: []string{"NTFY_SMTP_SENDER_ADDR"}, Usage: "SMTP server address (host:port) for outgoing emails"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-user", Aliases: []string{"smtp_sender_user"}, EnvVars: []string{"NTFY_SMTP_SENDER_USER"}, Usage: "SMTP user (if e-mail sending is enabled)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-pass", Aliases: []string{"smtp_sender_pass"}, EnvVars: []string{"NTFY_SMTP_SENDER_PASS"}, Usage: "SMTP password (if e-mail sending is enabled)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-from", Aliases: []string{"smtp_sender_from"}, EnvVars: []string{"NTFY_SMTP_SENDER_FROM"}, Usage: "SMTP sender address (if e-mail sending is enabled)"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "smtp-sender-verify", Aliases: []string{"smtp_sender_verify"}, EnvVars: []string{"NTFY_SMTP_SENDER_VERIFY"}, Value: false, Usage: "require verified email addresses for sending email notifications"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-server-listen", Aliases: []string{"smtp_server_listen"}, EnvVars: []string{"NTFY_SMTP_SERVER_LISTEN"}, Usage: "SMTP server address (ip:port) for incoming emails, e.g. :25"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-server-domain", Aliases: []string{"smtp_server_domain"}, EnvVars: []string{"NTFY_SMTP_SERVER_DOMAIN"}, Usage: "SMTP domain for incoming e-mail, e.g. ntfy.sh"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-server-addr-prefix", Aliases: []string{"smtp_server_addr_prefix"}, EnvVars: []string{"NTFY_SMTP_SERVER_ADDR_PREFIX"}, Usage: "SMTP email address prefix for topics to prevent spam (e.g. 'ntfy-')"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "twilio-account", Aliases: []string{"twilio_account"}, EnvVars: []string{"NTFY_TWILIO_ACCOUNT"}, Usage: "Twilio account SID, used for phone calls, e.g. AC123..."}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "twilio-auth-token", Aliases: []string{"twilio_auth_token"}, EnvVars: []string{"NTFY_TWILIO_AUTH_TOKEN"}, Usage: "Twilio auth token"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "twilio-phone-number", Aliases: []string{"twilio_phone_number"}, EnvVars: []string{"NTFY_TWILIO_PHONE_NUMBER"}, Usage: "Twilio number to use for outgoing calls"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "twilio-verify-service", Aliases: []string{"twilio_verify_service"}, EnvVars: []string{"NTFY_TWILIO_VERIFY_SERVICE"}, Usage: "Twilio Verify service ID, used for phone number verification"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "twilio-call-format", Aliases: []string{"twilio_call_format"}, EnvVars: []string{"NTFY_TWILIO_CALL_FORMAT"}, Usage: "Twilio/TwiML format string for phone calls"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "message-size-limit", Aliases: []string{"message_size_limit"}, EnvVars: []string{"NTFY_MESSAGE_SIZE_LIMIT"}, Value: util.FormatSize(server.DefaultMessageSizeLimit), Usage: "size limit for the message (see docs for limitations)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "message-delay-limit", Aliases: []string{"message_delay_limit"}, EnvVars: []string{"NTFY_MESSAGE_DELAY_LIMIT"}, Value: util.FormatDuration(server.DefaultMessageDelayMax), Usage: "max duration a message can be scheduled into the future"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "global-topic-limit", Aliases: []string{"global_topic_limit", "T"}, EnvVars: []string{"NTFY_GLOBAL_TOPIC_LIMIT"}, Value: server.DefaultTotalTopicLimit, Usage: "total number of topics allowed"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-subscription-limit", Aliases: []string{"visitor_subscription_limit"}, EnvVars: []string{"NTFY_VISITOR_SUBSCRIPTION_LIMIT"}, Value: server.DefaultVisitorSubscriptionLimit, Usage: "number of subscriptions per visitor"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "visitor-subscriber-rate-limiting", Aliases: []string{"visitor_subscriber_rate_limiting"}, EnvVars: []string{"NTFY_VISITOR_SUBSCRIBER_RATE_LIMITING"}, Value: false, Usage: "enables subscriber-based rate limiting"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-attachment-total-size-limit", Aliases: []string{"visitor_attachment_total_size_limit"}, EnvVars: []string{"NTFY_VISITOR_ATTACHMENT_TOTAL_SIZE_LIMIT"}, Value: util.FormatSize(server.DefaultVisitorAttachmentTotalSizeLimit), Usage: "total storage limit used for attachments per visitor"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-attachment-total-size-limit", Aliases: []string{"visitor_attachment_total_size_limit"}, EnvVars: []string{"NTFY_VISITOR_ATTACHMENT_TOTAL_SIZE_LIMIT"}, Value: "100M", Usage: "total storage limit used for attachments per visitor"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-attachment-daily-bandwidth-limit", Aliases: []string{"visitor_attachment_daily_bandwidth_limit"}, EnvVars: []string{"NTFY_VISITOR_ATTACHMENT_DAILY_BANDWIDTH_LIMIT"}, Value: "500M", Usage: "total daily attachment download/upload bandwidth limit per visitor"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-request-limit-burst", Aliases: []string{"visitor_request_limit_burst"}, EnvVars: []string{"NTFY_VISITOR_REQUEST_LIMIT_BURST"}, Value: server.DefaultVisitorRequestLimitBurst, Usage: "initial limit of requests per visitor"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-request-limit-replenish", Aliases: []string{"visitor_request_limit_replenish"}, EnvVars: []string{"NTFY_VISITOR_REQUEST_LIMIT_REPLENISH"}, Value: util.FormatDuration(server.DefaultVisitorRequestLimitReplenish), Usage: "interval at which burst limit is replenished (one per x)"}),
+	altsrc.NewDurationFlag(&cli.DurationFlag{Name: "visitor-request-limit-replenish", Aliases: []string{"visitor_request_limit_replenish"}, EnvVars: []string{"NTFY_VISITOR_REQUEST_LIMIT_REPLENISH"}, Value: server.DefaultVisitorRequestLimitReplenish, Usage: "interval at which burst limit is replenished (one per x)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-request-limit-exempt-hosts", Aliases: []string{"visitor_request_limit_exempt_hosts"}, EnvVars: []string{"NTFY_VISITOR_REQUEST_LIMIT_EXEMPT_HOSTS"}, Value: "", Usage: "hostnames and/or IP addresses of hosts that will be exempt from the visitor request limit"}),
-	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-message-daily-limit", Aliases: []string{"visitor_message_daily_limit"}, EnvVars: []string{"NTFY_VISITOR_MESSAGE_DAILY_LIMIT"}, Value: server.DefaultVisitorMessageDailyLimit, Usage: "max messages per visitor per day, derived from request limit if unset"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-email-limit-burst", Aliases: []string{"visitor_email_limit_burst"}, EnvVars: []string{"NTFY_VISITOR_EMAIL_LIMIT_BURST"}, Value: server.DefaultVisitorEmailLimitBurst, Usage: "initial limit of e-mails per visitor"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-email-limit-replenish", Aliases: []string{"visitor_email_limit_replenish"}, EnvVars: []string{"NTFY_VISITOR_EMAIL_LIMIT_REPLENISH"}, Value: util.FormatDuration(server.DefaultVisitorEmailLimitReplenish), Usage: "interval at which burst limit is replenished (one per x)"}),
-	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-topic-creation-limit-burst", Aliases: []string{"visitor_topic_creation_limit_burst"}, EnvVars: []string{"NTFY_VISITOR_TOPIC_CREATION_LIMIT_BURST"}, Value: server.DefaultVisitorTopicCreationLimitBurst, Usage: "burst of new topic creations per visitor (0 = disabled)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-topic-creation-limit-replenish", Aliases: []string{"visitor_topic_creation_limit_replenish"}, EnvVars: []string{"NTFY_VISITOR_TOPIC_CREATION_LIMIT_REPLENISH"}, Value: util.FormatDuration(server.DefaultVisitorTopicCreationLimitReplenish), Usage: "interval at which topic-creation tokens are refilled (one per x)"}),
-	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-prefix-bits-ipv4", Aliases: []string{"visitor_prefix_bits_ipv4"}, EnvVars: []string{"NTFY_VISITOR_PREFIX_BITS_IPV4"}, Value: server.DefaultVisitorPrefixBitsIPv4, Usage: "number of bits of the IPv4 address to use for rate limiting (default: 32, full address)"}),
-	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-prefix-bits-ipv6", Aliases: []string{"visitor_prefix_bits_ipv6"}, EnvVars: []string{"NTFY_VISITOR_PREFIX_BITS_IPV6"}, Value: server.DefaultVisitorPrefixBitsIPv6, Usage: "number of bits of the IPv6 address to use for rate limiting (default: 64, /64 subnet)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "ban-file", Aliases: []string{"ban_file"}, EnvVars: []string{"NTFY_BAN_FILE"}, Value: "", Usage: "if set, append IPs of abusive visitors to this file for fail2ban to tail (empty disables)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "ban-window", Aliases: []string{"ban_window"}, EnvVars: []string{"NTFY_BAN_WINDOW"}, Value: util.FormatDuration(server.DefaultBanWindow), Usage: "rolling window over which weighted strikes are counted for the ban file"}),
-	altsrc.NewIntFlag(&cli.IntFlag{Name: "ban-threshold", Aliases: []string{"ban_threshold"}, EnvVars: []string{"NTFY_BAN_THRESHOLD"}, Value: server.DefaultBanThreshold, Usage: "weighted strikes per window before an offender is banned"}),
-	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "ban-weights", Aliases: []string{"ban_weights"}, EnvVars: []string{"NTFY_BAN_WEIGHTS"}, Value: cli.NewStringSlice(server.DefaultBanWeights...), Usage: "per-code strike weights as KEY:WEIGHT, where KEY is an ntfy code, an HTTP status, a PREFIX*, or '*' (weight 0 exempts)"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "behind-proxy", Aliases: []string{"behind_proxy", "P"}, EnvVars: []string{"NTFY_BEHIND_PROXY"}, Value: false, Usage: "if set, use forwarded header (e.g. X-Forwarded-For, X-Client-IP) to determine visitor IP address (for rate limiting)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "proxy-forwarded-header", Aliases: []string{"proxy_forwarded_header"}, EnvVars: []string{"NTFY_PROXY_FORWARDED_HEADER"}, Value: "X-Forwarded-For", Usage: "use specified header to determine visitor IP address (for rate limiting)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "proxy-trusted-hosts", Aliases: []string{"proxy_trusted_hosts"}, EnvVars: []string{"NTFY_PROXY_TRUSTED_HOSTS"}, Value: "", Usage: "comma-separated list of trusted IP addresses, hosts, or CIDRs to remove from forwarded header"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "stripe-secret-key", Aliases: []string{"stripe_secret_key"}, EnvVars: []string{"NTFY_STRIPE_SECRET_KEY"}, Value: "", Usage: "key used for the Stripe API communication, this enables payments"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "stripe-webhook-key", Aliases: []string{"stripe_webhook_key"}, EnvVars: []string{"NTFY_STRIPE_WEBHOOK_KEY"}, Value: "", Usage: "key required to validate the authenticity of incoming webhooks from Stripe"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "billing-contact", Aliases: []string{"billing_contact"}, EnvVars: []string{"NTFY_BILLING_CONTACT"}, Value: "", Usage: "e-mail or website to display in upgrade dialog (only if payments are enabled)"}),
-	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "enable-metrics", Aliases: []string{"enable_metrics"}, EnvVars: []string{"NTFY_ENABLE_METRICS"}, Value: false, Usage: "if set, Prometheus metrics are exposed via the /metrics endpoint"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "metrics-listen-http", Aliases: []string{"metrics_listen_http"}, EnvVars: []string{"NTFY_METRICS_LISTEN_HTTP"}, Usage: "ip:port used to expose the metrics endpoint (implicitly enables metrics)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "profile-listen-http", Aliases: []string{"profile_listen_http"}, EnvVars: []string{"NTFY_PROFILE_LISTEN_HTTP"}, Usage: "ip:port used to expose the profiling endpoints (implicitly enables profiling)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-push-public-key", Aliases: []string{"web_push_public_key"}, EnvVars: []string{"NTFY_WEB_PUSH_PUBLIC_KEY"}, Usage: "public key used for web push notifications"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-push-private-key", Aliases: []string{"web_push_private_key"}, EnvVars: []string{"NTFY_WEB_PUSH_PRIVATE_KEY"}, Usage: "private key used for web push notifications"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-push-file", Aliases: []string{"web_push_file"}, EnvVars: []string{"NTFY_WEB_PUSH_FILE"}, Usage: "file used to store web push subscriptions"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-push-email-address", Aliases: []string{"web_push_email_address"}, EnvVars: []string{"NTFY_WEB_PUSH_EMAIL_ADDRESS"}, Usage: "e-mail address of sender, required to use browser push services"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-push-startup-queries", Aliases: []string{"web_push_startup_queries"}, EnvVars: []string{"NTFY_WEB_PUSH_STARTUP_QUERIES"}, Usage: "queries run when the web push database is initialized"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-push-expiry-duration", Aliases: []string{"web_push_expiry_duration"}, EnvVars: []string{"NTFY_WEB_PUSH_EXPIRY_DURATION"}, Value: util.FormatDuration(server.DefaultWebPushExpiryDuration), Usage: "automatically expire unused subscriptions after this time"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "web-push-expiry-warning-duration", Aliases: []string{"web_push_expiry_warning_duration"}, EnvVars: []string{"NTFY_WEB_PUSH_EXPIRY_WARNING_DURATION"}, Value: util.FormatDuration(server.DefaultWebPushExpiryWarningDuration), Usage: "send web push warning notification after this time before expiring unused subscriptions"}),
+	altsrc.NewDurationFlag(&cli.DurationFlag{Name: "visitor-email-limit-replenish", Aliases: []string{"visitor_email_limit_replenish"}, EnvVars: []string{"NTFY_VISITOR_EMAIL_LIMIT_REPLENISH"}, Value: server.DefaultVisitorEmailLimitReplenish, Usage: "interval at which burst limit is replenished (one per x)"}),
+	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "behind-proxy", Aliases: []string{"behind_proxy", "P"}, EnvVars: []string{"NTFY_BEHIND_PROXY"}, Value: false, Usage: "if set, use X-Forwarded-For header to determine visitor IP address (for rate limiting)"}),
 )
 
 var cmdServe = &cli.Command{
@@ -153,7 +97,7 @@ func execServe(c *cli.Context) error {
 
 	// Read all the options
 	config := c.String("config")
-	baseURL := strings.TrimSuffix(c.String("base-url"), "/")
+	baseURL := c.String("base-url")
 	listenHTTP := c.String("listen-http")
 	listenHTTPS := c.String("listen-https")
 	listenUnix := c.String("listen-unix")
@@ -161,198 +105,40 @@ func execServe(c *cli.Context) error {
 	keyFile := c.String("key-file")
 	certFile := c.String("cert-file")
 	firebaseKeyFile := c.String("firebase-key-file")
-	databaseURL := c.String("database-url")
-	databaseReplicaURLs := c.StringSlice("database-replica-urls")
-	clusterNodeID := c.String("cluster-node-id")
-	clusterListen := c.String("cluster-listen")
-	clusterAdvertiseURL := c.String("cluster-advertise-url")
-	clusterSecret := c.String("cluster-secret")
-	clusterBatchLingerStr := c.String("cluster-batch-linger")
-	webPushPrivateKey := c.String("web-push-private-key")
-	webPushPublicKey := c.String("web-push-public-key")
-	webPushFile := c.String("web-push-file")
-	webPushEmailAddress := c.String("web-push-email-address")
-	webPushStartupQueries := c.String("web-push-startup-queries")
-	webPushExpiryDurationStr := c.String("web-push-expiry-duration")
-	webPushExpiryWarningDurationStr := c.String("web-push-expiry-warning-duration")
 	cacheFile := c.String("cache-file")
-	cacheDurationStr := c.String("cache-duration")
+	cacheDuration := c.Duration("cache-duration")
 	cacheStartupQueries := c.String("cache-startup-queries")
-	cacheBatchSize := c.Int("cache-batch-size")
-	cacheBatchTimeoutStr := c.String("cache-batch-timeout")
 	authFile := c.String("auth-file")
-	authStartupQueries := c.String("auth-startup-queries")
 	authDefaultAccess := c.String("auth-default-access")
-	authUsersRaw := c.StringSlice("auth-users")
-	authAccessRaw := c.StringSlice("auth-access")
-	authTokensRaw := c.StringSlice("auth-tokens")
-	authAccessCacheEnabled := c.Bool("auth-access-cache")
 	attachmentCacheDir := c.String("attachment-cache-dir")
 	attachmentTotalSizeLimitStr := c.String("attachment-total-size-limit")
 	attachmentFileSizeLimitStr := c.String("attachment-file-size-limit")
-	attachmentExpiryDurationStr := c.String("attachment-expiry-duration")
-	templateDir := c.String("template-dir")
-	keepaliveIntervalStr := c.String("keepalive-interval")
-	managerIntervalStr := c.String("manager-interval")
-	disallowedTopics := c.StringSlice("disallowed-topics")
+	attachmentExpiryDuration := c.Duration("attachment-expiry-duration")
+	keepaliveInterval := c.Duration("keepalive-interval")
+	managerInterval := c.Duration("manager-interval")
 	webRoot := c.String("web-root")
-	enableSignup := c.Bool("enable-signup")
-	enableLogin := c.Bool("enable-login")
-	requireLogin := c.Bool("require-login")
-	enableReservations := c.Bool("enable-reservations")
 	upstreamBaseURL := c.String("upstream-base-url")
-	upstreamAccessToken := c.String("upstream-access-token")
 	smtpSenderAddr := c.String("smtp-sender-addr")
 	smtpSenderUser := c.String("smtp-sender-user")
 	smtpSenderPass := c.String("smtp-sender-pass")
 	smtpSenderFrom := c.String("smtp-sender-from")
-	smtpSenderVerify := c.Bool("smtp-sender-verify")
 	smtpServerListen := c.String("smtp-server-listen")
 	smtpServerDomain := c.String("smtp-server-domain")
 	smtpServerAddrPrefix := c.String("smtp-server-addr-prefix")
-	twilioAccount := c.String("twilio-account")
-	twilioAuthToken := c.String("twilio-auth-token")
-	twilioPhoneNumber := c.String("twilio-phone-number")
-	twilioVerifyService := c.String("twilio-verify-service")
-	twilioCallFormat := c.String("twilio-call-format")
-	messageSizeLimitStr := c.String("message-size-limit")
-	messageDelayLimitStr := c.String("message-delay-limit")
 	totalTopicLimit := c.Int("global-topic-limit")
 	visitorSubscriptionLimit := c.Int("visitor-subscription-limit")
-	visitorSubscriberRateLimiting := c.Bool("visitor-subscriber-rate-limiting")
 	visitorAttachmentTotalSizeLimitStr := c.String("visitor-attachment-total-size-limit")
 	visitorAttachmentDailyBandwidthLimitStr := c.String("visitor-attachment-daily-bandwidth-limit")
 	visitorRequestLimitBurst := c.Int("visitor-request-limit-burst")
-	visitorRequestLimitReplenishStr := c.String("visitor-request-limit-replenish")
+	visitorRequestLimitReplenish := c.Duration("visitor-request-limit-replenish")
 	visitorRequestLimitExemptHosts := util.SplitNoEmpty(c.String("visitor-request-limit-exempt-hosts"), ",")
-	visitorMessageDailyLimit := c.Int("visitor-message-daily-limit")
 	visitorEmailLimitBurst := c.Int("visitor-email-limit-burst")
-	visitorEmailLimitReplenishStr := c.String("visitor-email-limit-replenish")
-	visitorTopicCreationLimitBurst := c.Int("visitor-topic-creation-limit-burst")
-	visitorTopicCreationLimitReplenishStr := c.String("visitor-topic-creation-limit-replenish")
-	visitorPrefixBitsIPv4 := c.Int("visitor-prefix-bits-ipv4")
-	visitorPrefixBitsIPv6 := c.Int("visitor-prefix-bits-ipv6")
-	banFile := c.String("ban-file")
-	banWindowStr := c.String("ban-window")
-	banThreshold := c.Int("ban-threshold")
-	banWeightsRaw := c.StringSlice("ban-weights")
+	visitorEmailLimitReplenish := c.Duration("visitor-email-limit-replenish")
 	behindProxy := c.Bool("behind-proxy")
-	proxyForwardedHeader := c.String("proxy-forwarded-header")
-	proxyTrustedHosts := util.SplitNoEmpty(c.String("proxy-trusted-hosts"), ",")
-	stripeSecretKey := c.String("stripe-secret-key")
-	stripeWebhookKey := c.String("stripe-webhook-key")
-	billingContact := c.String("billing-contact")
-	metricsListenHTTP := c.String("metrics-listen-http")
-	enableMetrics := c.Bool("enable-metrics") || metricsListenHTTP != ""
-	profileListenHTTP := c.String("profile-listen-http")
-
-	// Convert durations
-	cacheDuration, err := util.ParseDuration(cacheDurationStr)
-	if err != nil {
-		return fmt.Errorf("invalid cache duration: %s", cacheDurationStr)
-	}
-	cacheBatchTimeout, err := util.ParseDuration(cacheBatchTimeoutStr)
-	if err != nil {
-		return fmt.Errorf("invalid cache batch timeout: %s", cacheBatchTimeoutStr)
-	}
-	attachmentExpiryDuration, err := util.ParseDuration(attachmentExpiryDurationStr)
-	if err != nil {
-		return fmt.Errorf("invalid attachment expiry duration: %s", attachmentExpiryDurationStr)
-	}
-	keepaliveInterval, err := util.ParseDuration(keepaliveIntervalStr)
-	if err != nil {
-		return fmt.Errorf("invalid keepalive interval: %s", keepaliveIntervalStr)
-	}
-	clusterBatchLinger, err := util.ParseDuration(clusterBatchLingerStr)
-	if err != nil || clusterBatchLinger < 0 {
-		return fmt.Errorf("invalid cluster batch linger: %s", clusterBatchLingerStr)
-	}
-	managerInterval, err := util.ParseDuration(managerIntervalStr)
-	if err != nil {
-		return fmt.Errorf("invalid manager interval: %s", managerIntervalStr)
-	}
-	messageDelayLimit, err := util.ParseDuration(messageDelayLimitStr)
-	if err != nil {
-		return fmt.Errorf("invalid message delay limit: %s", messageDelayLimitStr)
-	}
-	visitorRequestLimitReplenish, err := util.ParseDuration(visitorRequestLimitReplenishStr)
-	if err != nil {
-		return fmt.Errorf("invalid visitor request limit replenish: %s", visitorRequestLimitReplenishStr)
-	}
-	visitorEmailLimitReplenish, err := util.ParseDuration(visitorEmailLimitReplenishStr)
-	if err != nil {
-		return fmt.Errorf("invalid visitor email limit replenish: %s", visitorEmailLimitReplenishStr)
-	}
-	visitorTopicCreationLimitReplenish, err := util.ParseDuration(visitorTopicCreationLimitReplenishStr)
-	if err != nil {
-		return fmt.Errorf("invalid visitor topic creation limit replenish: %s", visitorTopicCreationLimitReplenishStr)
-	}
-	webPushExpiryDuration, err := util.ParseDuration(webPushExpiryDurationStr)
-	if err != nil {
-		return fmt.Errorf("invalid web push expiry duration: %s", webPushExpiryDurationStr)
-	}
-	webPushExpiryWarningDuration, err := util.ParseDuration(webPushExpiryWarningDurationStr)
-	if err != nil {
-		return fmt.Errorf("invalid web push expiry warning duration: %s", webPushExpiryWarningDurationStr)
-	}
-	banWindow, err := util.ParseDuration(banWindowStr)
-	if err != nil {
-		return fmt.Errorf("invalid ban window: %s", banWindowStr)
-	}
-
-	// Parse abuse ban-feed weights ("KEY:WEIGHT" list, "*" fallback)
-	banWeights, err := ban.ParseWeights(banWeightsRaw)
-	if err != nil {
-		return err
-	}
-
-	// Convert sizes to bytes
-	messageSizeLimit, err := util.ParseSize(messageSizeLimitStr)
-	if err != nil {
-		return fmt.Errorf("invalid message size limit: %s", messageSizeLimitStr)
-	}
-	attachmentTotalSizeLimit, err := util.ParseSize(attachmentTotalSizeLimitStr)
-	if err != nil {
-		return fmt.Errorf("invalid attachment total size limit: %s", attachmentTotalSizeLimitStr)
-	}
-	attachmentFileSizeLimit, err := util.ParseSize(attachmentFileSizeLimitStr)
-	if err != nil {
-		return fmt.Errorf("invalid attachment file size limit: %s", attachmentFileSizeLimitStr)
-	}
-	visitorAttachmentTotalSizeLimit, err := util.ParseSize(visitorAttachmentTotalSizeLimitStr)
-	if err != nil {
-		return fmt.Errorf("invalid visitor attachment total size limit: %s", visitorAttachmentTotalSizeLimitStr)
-	}
-	visitorAttachmentDailyBandwidthLimit, err := util.ParseSize(visitorAttachmentDailyBandwidthLimitStr)
-	if err != nil {
-		return fmt.Errorf("invalid visitor attachment daily bandwidth limit: %s", visitorAttachmentDailyBandwidthLimitStr)
-	} else if visitorAttachmentDailyBandwidthLimit > math.MaxInt {
-		return fmt.Errorf("config option visitor-attachment-daily-bandwidth-limit must be lower than %d", math.MaxInt)
-	}
 
 	// Check values
-	if databaseURL != "" && !strings.HasPrefix(databaseURL, "postgres://") && !strings.HasPrefix(databaseURL, "postgresql://") {
-		return errors.New("if database-url is set, it must start with postgres:// or postgresql://")
-	} else if databaseURL != "" && (authFile != "" || cacheFile != "" || webPushFile != "") {
-		return errors.New("if database-url is set, auth-file, cache-file, and web-push-file must not be set")
-	} else if len(databaseReplicaURLs) > 0 && databaseURL == "" {
-		return errors.New("database-replica-urls can only be used if database-url is also set")
-	} else if clusterListen != "" && databaseURL == "" {
-		return errors.New("cluster-listen requires database-url to be set")
-	} else if clusterListen != "" && clusterSecret == "" {
-		return errors.New("cluster-listen requires cluster-secret to be set")
-	} else if clusterListen != "" && clusterNodeID == "" {
-		return errors.New("cluster-listen requires cluster-node-id to be set")
-	} else if clusterListen == "" && clusterSecret != "" {
-		return errors.New("cluster-secret can only be used if cluster-listen is set")
-	} else if clusterListen != "" && clusterAdvertiseURL == "" && wildcardAddr(clusterListen) {
-		return errors.New("cluster-advertise-url must be set if cluster-listen binds a wildcard address")
-	} else if firebaseKeyFile != "" && !util.FileExists(firebaseKeyFile) {
+	if firebaseKeyFile != "" && !util.FileExists(firebaseKeyFile) {
 		return errors.New("if set, FCM key file must exist")
-	} else if firebaseKeyFile != "" && !server.FirebaseAvailable {
-		return errors.New("cannot set firebase-key-file, support for Firebase is not available (nofirebase)")
-	} else if webPushPublicKey != "" && (webPushPrivateKey == "" || (webPushFile == "" && databaseURL == "") || webPushEmailAddress == "" || baseURL == "") {
-		return errors.New("if web push is enabled, web-push-private-key, web-push-public-key, web-push-file (or database-url), web-push-email-address, and base-url should be set. run 'ntfy webpush keys' to generate keys")
 	} else if keepaliveInterval < 5*time.Second {
 		return errors.New("keepalive interval cannot be lower than five seconds")
 	} else if managerInterval < 5*time.Second {
@@ -365,23 +151,20 @@ func execServe(c *cli.Context) error {
 		return errors.New("if set, certificate file must exist")
 	} else if listenHTTPS != "" && (keyFile == "" || certFile == "") {
 		return errors.New("if listen-https is set, both key-file and cert-file must be set")
-	} else if smtpSenderAddr != "" && (baseURL == "" || smtpSenderFrom == "") {
-		return errors.New("if smtp-sender-addr is set, base-url, and smtp-sender-from must also be set")
-	} else if smtpSenderVerify && smtpSenderAddr == "" {
-		return errors.New("if smtp-sender-verify is set, smtp-sender-addr must also be set")
+	} else if smtpSenderAddr != "" && (baseURL == "" || smtpSenderUser == "" || smtpSenderPass == "" || smtpSenderFrom == "") {
+		return errors.New("if smtp-sender-addr is set, base-url, smtp-sender-user, smtp-sender-pass and smtp-sender-from must also be set")
 	} else if smtpServerListen != "" && smtpServerDomain == "" {
 		return errors.New("if smtp-server-listen is set, smtp-server-domain must also be set")
 	} else if attachmentCacheDir != "" && baseURL == "" {
 		return errors.New("if attachment-cache-dir is set, base-url must also be set")
-	} else if baseURL != "" {
-		u, err := url.Parse(baseURL)
-		if err != nil {
-			return fmt.Errorf("if set, base-url must be a valid URL, e.g. https://ntfy.mydomain.com: %v", err)
-		} else if u.Scheme != "http" && u.Scheme != "https" {
-			return errors.New("if set, base-url must be a valid URL starting with http:// or https://, e.g. https://ntfy.mydomain.com")
-		} else if u.Path != "" {
-			return fmt.Errorf("if set, base-url must not have a path (%s), as hosting ntfy on a sub-path is not supported, e.g. https://ntfy.mydomain.com", u.Path)
-		}
+	} else if baseURL != "" && !strings.HasPrefix(baseURL, "http://") && !strings.HasPrefix(baseURL, "https://") {
+		return errors.New("if set, base-url must start with http:// or https://")
+	} else if baseURL != "" && strings.HasSuffix(baseURL, "/") {
+		return errors.New("if set, base-url must not end with a slash (/)")
+	} else if !util.Contains([]string{"read-write", "read-only", "write-only", "deny-all"}, authDefaultAccess) {
+		return errors.New("if set, auth-default-access must start set to 'read-write', 'read-only', 'write-only' or 'deny-all'")
+	} else if !util.Contains([]string{"app", "home", "disable"}, webRoot) {
+		return errors.New("if set, web-root must be 'home' or 'app'")
 	} else if upstreamBaseURL != "" && !strings.HasPrefix(upstreamBaseURL, "http://") && !strings.HasPrefix(upstreamBaseURL, "https://") {
 		return errors.New("if set, upstream-base-url must start with http:// or https://")
 	} else if upstreamBaseURL != "" && strings.HasSuffix(upstreamBaseURL, "/") {
@@ -390,120 +173,55 @@ func execServe(c *cli.Context) error {
 		return errors.New("if upstream-base-url is set, base-url must also be set")
 	} else if upstreamBaseURL != "" && baseURL != "" && baseURL == upstreamBaseURL {
 		return errors.New("base-url and upstream-base-url cannot be identical, you'll likely want to set upstream-base-url to https://ntfy.sh, see https://ntfy.sh/docs/config/#ios-instant-notifications")
-	} else if authFile == "" && databaseURL == "" && (enableSignup || enableLogin || requireLogin || enableReservations || stripeSecretKey != "") {
-		return errors.New("cannot set enable-signup, enable-login, require-login, enable-reserve-topics, or stripe-secret-key if auth-file or database-url is not set")
-	} else if enableSignup && !enableLogin {
-		return errors.New("cannot set enable-signup without also setting enable-login")
-	} else if requireLogin && !enableLogin {
-		return errors.New("cannot set require-login without also setting enable-login")
-	} else if !payments.Available && (stripeSecretKey != "" || stripeWebhookKey != "") {
-		return errors.New("cannot set stripe-secret-key or stripe-webhook-key, support for payments is not available in this build (nopayments)")
-	} else if stripeSecretKey != "" && (stripeWebhookKey == "" || baseURL == "") {
-		return errors.New("if stripe-secret-key is set, stripe-webhook-key and base-url must also be set")
-	} else if twilioAccount != "" && (twilioAuthToken == "" || twilioPhoneNumber == "" || twilioVerifyService == "" || baseURL == "" || (authFile == "" && databaseURL == "")) {
-		return errors.New("if twilio-account is set, twilio-auth-token, twilio-phone-number, twilio-verify-service, base-url, and auth-file (or database-url) must also be set")
-	} else if messageSizeLimit > server.DefaultMessageSizeLimit {
-		log.Warn("message-size-limit is greater than 4K, this is not recommended and largely untested, and may lead to issues with some clients")
-		if messageSizeLimit > 5*1024*1024 {
-			return errors.New("message-size-limit cannot be higher than 5M")
-		}
-	} else if !server.WebPushAvailable && (webPushPrivateKey != "" || webPushPublicKey != "" || webPushFile != "") {
-		return errors.New("cannot enable WebPush, support is not available in this build (nowebpush)")
-	} else if webPushExpiryWarningDuration > 0 && webPushExpiryWarningDuration > webPushExpiryDuration {
-		return errors.New("web push expiry warning duration cannot be higher than web push expiry duration")
-	} else if behindProxy && proxyForwardedHeader == "" {
-		return errors.New("if behind-proxy is set, proxy-forwarded-header must also be set")
-	} else if visitorPrefixBitsIPv4 < 1 || visitorPrefixBitsIPv4 > 32 {
-		return errors.New("visitor-prefix-bits-ipv4 must be between 1 and 32")
-	} else if visitorPrefixBitsIPv6 < 1 || visitorPrefixBitsIPv6 > 128 {
-		return errors.New("visitor-prefix-bits-ipv6 must be between 1 and 128")
-	} else if banFile != "" && banWindow <= 0 {
-		return errors.New("if ban-file is set, ban-window must be greater than zero")
-	} else if banFile != "" && banThreshold <= 0 {
-		return errors.New("if ban-file is set, ban-threshold must be greater than zero")
-	} else if banFile != "" && len(banWeights) == 0 {
-		return errors.New("if ban-file is set, ban-weights must not be empty")
-	} else if banFile != "" && !util.FileExists(filepath.Dir(banFile)) {
-		return fmt.Errorf("if ban-file is set, its directory (%s) must exist", filepath.Dir(banFile))
-	} else if runtime.GOOS == "windows" && listenUnix != "" {
-		return errors.New("listen-unix is not supported on Windows")
 	}
 
-	// Backwards compatibility
-	if webRoot == "app" {
-		webRoot = "/"
-	} else if webRoot == "home" {
-		webRoot = "/app"
-	} else if webRoot == "disable" {
-		webRoot = ""
-	} else if !strings.HasPrefix(webRoot, "/") {
-		webRoot = "/" + webRoot
-	}
+	webRootIsApp := webRoot == "app"
+	enableWeb := webRoot != "disable"
 
-	// Convert default auth permission, read provisioned users
-	authDefault, err := user.ParsePermission(authDefaultAccess)
-	if err != nil {
-		return errors.New("if set, auth-default-access must start set to 'read-write', 'read-only', 'write-only' or 'deny-all'")
-	}
-	authUsers, err := parseUsers(authUsersRaw)
-	if err != nil {
-		return err
-	}
-	authAccess, err := parseAccess(authUsers, authAccessRaw)
-	if err != nil {
-		return err
-	}
-	authTokens, err := parseTokens(authUsers, authTokensRaw)
-	if err != nil {
-		return err
-	}
+	// Default auth permissions
+	authDefaultRead := authDefaultAccess == "read-write" || authDefaultAccess == "read-only"
+	authDefaultWrite := authDefaultAccess == "read-write" || authDefaultAccess == "write-only"
 
 	// Special case: Unset default
 	if listenHTTP == "-" {
 		listenHTTP = ""
 	}
 
+	// Convert sizes to bytes
+	attachmentTotalSizeLimit, err := parseSize(attachmentTotalSizeLimitStr, server.DefaultAttachmentTotalSizeLimit)
+	if err != nil {
+		return err
+	}
+	attachmentFileSizeLimit, err := parseSize(attachmentFileSizeLimitStr, server.DefaultAttachmentFileSizeLimit)
+	if err != nil {
+		return err
+	}
+	visitorAttachmentTotalSizeLimit, err := parseSize(visitorAttachmentTotalSizeLimitStr, server.DefaultVisitorAttachmentTotalSizeLimit)
+	if err != nil {
+		return err
+	}
+	visitorAttachmentDailyBandwidthLimit, err := parseSize(visitorAttachmentDailyBandwidthLimitStr, server.DefaultVisitorAttachmentDailyBandwidthLimit)
+	if err != nil {
+		return err
+	} else if visitorAttachmentDailyBandwidthLimit > math.MaxInt {
+		return fmt.Errorf("config option visitor-attachment-daily-bandwidth-limit must be lower than %d", math.MaxInt)
+	}
+
 	// Resolve hosts
-	visitorRequestLimitExemptPrefixes := make([]netip.Prefix, 0)
+	visitorRequestLimitExemptIPs := make([]string, 0)
 	for _, host := range visitorRequestLimitExemptHosts {
-		prefixes, err := parseIPHostPrefix(host)
+		ips, err := net.LookupIP(host)
 		if err != nil {
 			log.Warn("cannot resolve host %s: %s, ignoring visitor request exemption", host, err.Error())
 			continue
 		}
-		visitorRequestLimitExemptPrefixes = append(visitorRequestLimitExemptPrefixes, prefixes...)
-	}
-
-	// Parse trusted prefixes
-	trustedProxyPrefixes := make([]netip.Prefix, 0)
-	for _, host := range proxyTrustedHosts {
-		prefixes, err := parseIPHostPrefix(host)
-		if err != nil {
-			return fmt.Errorf("cannot resolve trusted proxy host %s: %s", host, err.Error())
-		}
-		trustedProxyPrefixes = append(trustedProxyPrefixes, prefixes...)
-	}
-
-	// Stripe things
-	if stripeSecretKey != "" {
-		payments.Setup(stripeSecretKey)
-	}
-
-	// Parse Twilio template
-	var twilioCallFormatTemplate *template.Template
-	if twilioCallFormat != "" {
-		twilioCallFormatTemplate, err = template.New("").Parse(twilioCallFormat)
-		if err != nil {
-			return fmt.Errorf("failed to parse twilio-call-format template: %w", err)
+		for _, ip := range ips {
+			visitorRequestLimitExemptIPs = append(visitorRequestLimitExemptIPs, ip.String())
 		}
 	}
 
-	// Add default forbidden topics
-	disallowedTopics = append(disallowedTopics, server.DefaultDisallowedTopics...)
-
 	// Run server
 	conf := server.NewConfig()
-	conf.File = config
 	conf.BaseURL = baseURL
 	conf.ListenHTTP = listenHTTP
 	conf.ListenHTTPS = listenHTTPS
@@ -515,98 +233,36 @@ func execServe(c *cli.Context) error {
 	conf.CacheFile = cacheFile
 	conf.CacheDuration = cacheDuration
 	conf.CacheStartupQueries = cacheStartupQueries
-	conf.CacheBatchSize = cacheBatchSize
-	conf.CacheBatchTimeout = cacheBatchTimeout
 	conf.AuthFile = authFile
-	conf.AuthStartupQueries = authStartupQueries
-	conf.AuthDefault = authDefault
-	conf.AuthUsers = authUsers
-	conf.AuthAccess = authAccess
-	conf.AuthTokens = authTokens
-	conf.AuthAccessCacheEnabled = authAccessCacheEnabled
+	conf.AuthDefaultRead = authDefaultRead
+	conf.AuthDefaultWrite = authDefaultWrite
 	conf.AttachmentCacheDir = attachmentCacheDir
 	conf.AttachmentTotalSizeLimit = attachmentTotalSizeLimit
 	conf.AttachmentFileSizeLimit = attachmentFileSizeLimit
 	conf.AttachmentExpiryDuration = attachmentExpiryDuration
-	conf.TemplateDir = templateDir
 	conf.KeepaliveInterval = keepaliveInterval
 	conf.ManagerInterval = managerInterval
-	conf.DisallowedTopics = disallowedTopics
-	conf.WebRoot = webRoot
+	conf.WebRootIsApp = webRootIsApp
 	conf.UpstreamBaseURL = upstreamBaseURL
-	conf.UpstreamAccessToken = upstreamAccessToken
 	conf.SMTPSenderAddr = smtpSenderAddr
 	conf.SMTPSenderUser = smtpSenderUser
 	conf.SMTPSenderPass = smtpSenderPass
 	conf.SMTPSenderFrom = smtpSenderFrom
-	conf.SMTPSenderVerify = smtpSenderVerify
 	conf.SMTPServerListen = smtpServerListen
 	conf.SMTPServerDomain = smtpServerDomain
 	conf.SMTPServerAddrPrefix = smtpServerAddrPrefix
-	conf.TwilioAccount = twilioAccount
-	conf.TwilioAuthToken = twilioAuthToken
-	conf.TwilioPhoneNumber = twilioPhoneNumber
-	conf.TwilioVerifyService = twilioVerifyService
-	conf.TwilioCallFormat = twilioCallFormatTemplate
-	conf.MessageSizeLimit = int(messageSizeLimit)
-	conf.MessageDelayMax = messageDelayLimit
 	conf.TotalTopicLimit = totalTopicLimit
 	conf.VisitorSubscriptionLimit = visitorSubscriptionLimit
-	conf.VisitorSubscriberRateLimiting = visitorSubscriberRateLimiting
 	conf.VisitorAttachmentTotalSizeLimit = visitorAttachmentTotalSizeLimit
-	conf.VisitorAttachmentDailyBandwidthLimit = visitorAttachmentDailyBandwidthLimit
+	conf.VisitorAttachmentDailyBandwidthLimit = int(visitorAttachmentDailyBandwidthLimit)
 	conf.VisitorRequestLimitBurst = visitorRequestLimitBurst
 	conf.VisitorRequestLimitReplenish = visitorRequestLimitReplenish
-	conf.VisitorRequestExemptPrefixes = visitorRequestLimitExemptPrefixes
-	conf.VisitorMessageDailyLimit = visitorMessageDailyLimit
+	conf.VisitorRequestExemptIPAddrs = visitorRequestLimitExemptIPs
 	conf.VisitorEmailLimitBurst = visitorEmailLimitBurst
 	conf.VisitorEmailLimitReplenish = visitorEmailLimitReplenish
-	conf.VisitorTopicCreationLimitBurst = visitorTopicCreationLimitBurst
-	conf.VisitorTopicCreationLimitReplenish = visitorTopicCreationLimitReplenish
-	conf.VisitorPrefixBitsIPv4 = visitorPrefixBitsIPv4
-	conf.VisitorPrefixBitsIPv6 = visitorPrefixBitsIPv6
-	conf.BanFile = banFile
-	conf.BanWindow = banWindow
-	conf.BanThreshold = banThreshold
-	conf.BanWeights = banWeights
 	conf.BehindProxy = behindProxy
-	conf.ProxyForwardedHeader = proxyForwardedHeader
-	conf.ProxyTrustedPrefixes = trustedProxyPrefixes
-	conf.StripeSecretKey = stripeSecretKey
-	conf.StripeWebhookKey = stripeWebhookKey
-	conf.BillingContact = billingContact
-	conf.EnableSignup = enableSignup
-	conf.EnableLogin = enableLogin
-	conf.RequireLogin = requireLogin
-	conf.EnableReservations = enableReservations
-	conf.EnableMetrics = enableMetrics
-	conf.MetricsListenHTTP = metricsListenHTTP
-	conf.ProfileListenHTTP = profileListenHTTP
-	conf.DatabaseURL = databaseURL
-	conf.DatabaseReplicaURLs = databaseReplicaURLs
-	conf.ClusterNodeID = clusterNodeID
-	conf.ClusterListen = clusterListen
-	conf.ClusterAdvertiseURL = clusterAdvertiseURL
-	conf.ClusterSecret = clusterSecret
-	conf.ClusterBatchLinger = clusterBatchLinger
-	conf.WebPushPrivateKey = webPushPrivateKey
-	conf.WebPushPublicKey = webPushPublicKey
-	conf.WebPushFile = webPushFile
-	conf.WebPushEmailAddress = webPushEmailAddress
-	conf.WebPushStartupQueries = webPushStartupQueries
-	conf.WebPushExpiryDuration = webPushExpiryDuration
-	conf.WebPushExpiryWarningDuration = webPushExpiryWarningDuration
-	conf.BuildVersion = c.App.Version
-	conf.BuildDate = maybeFromMetadata(c.App.Metadata, MetadataKeyDate)
-	conf.BuildCommit = maybeFromMetadata(c.App.Metadata, MetadataKeyCommit)
-
-	// Check if we should run as a Windows service
-	if ranAsService, err := maybeRunAsService(conf); err != nil {
-		log.Fatal("%s", err.Error())
-	} else if ranAsService {
-		log.Info("Exiting.")
-		return nil
-	}
+	conf.EnableWeb = enableWeb
+	conf.Version = c.App.Version
 
 	// Set up hot-reloading of config
 	go sigHandlerConfigReload(config)
@@ -614,166 +270,46 @@ func execServe(c *cli.Context) error {
 	// Run server
 	s, err := server.New(conf)
 	if err != nil {
-		log.Fatal("%s", err.Error())
+		log.Fatal(err)
 	} else if err := s.Run(); err != nil {
-		log.Fatal("%s", err.Error())
+		log.Fatal(err)
 	}
 	log.Info("Exiting.")
 	return nil
 }
 
-func parseIPHostPrefix(host string) (prefixes []netip.Prefix, err error) {
-	// Try parsing as prefix, e.g. 10.0.1.0/24 or 2001:db8::/32
-	prefix, err := netip.ParsePrefix(host)
-	if err == nil {
-		prefixes = append(prefixes, prefix.Masked())
-		return prefixes, nil
+func parseSize(s string, defaultValue int64) (v int64, err error) {
+	if s == "" {
+		return defaultValue, nil
 	}
-	// Not a prefix, parse as host or IP (LookupHost passes through an IP as is)
-	ips, err := net.LookupHost(host)
+	v, err = util.ParseSize(s)
 	if err != nil {
-		return nil, err
+		return 0, err
 	}
-	for _, ipStr := range ips {
-		ip, err := netip.ParseAddr(ipStr)
-		if err == nil {
-			prefix, err := ip.Prefix(ip.BitLen())
-			if err != nil {
-				return nil, fmt.Errorf("%s successfully parsed but unable to make prefix: %s", ip.String(), err.Error())
-			}
-			prefixes = append(prefixes, prefix.Masked())
-		}
-	}
-	return
+	return v, nil
 }
 
-func parseUsers(usersRaw []string) ([]*user.User, error) {
-	users := make([]*user.User, 0)
-	for _, userLine := range usersRaw {
-		parts := strings.Split(userLine, ":")
-		if len(parts) != 3 {
-			return nil, fmt.Errorf("invalid auth-users: %s, expected format: 'name:hash:role'", userLine)
-		}
-		username := strings.TrimSpace(parts[0])
-		passwordHash := strings.TrimSpace(parts[1])
-		role := user.Role(strings.TrimSpace(parts[2]))
-		if !user.AllowedUsername(username) {
-			return nil, fmt.Errorf("invalid auth-users: %s, username invalid", userLine)
-		} else if err := user.ValidPasswordHash(passwordHash, user.DefaultUserPasswordBcryptCost); err != nil {
-			return nil, fmt.Errorf("invalid auth-users: %s, password hash invalid, %s", userLine, err.Error())
-		} else if !user.AllowedRole(role) {
-			return nil, fmt.Errorf("invalid auth-users: %s, role %s is not allowed, allowed roles are 'admin' or 'user'", userLine, role)
-		}
-		users = append(users, &user.User{
-			Name:        username,
-			Hash:        passwordHash,
-			Role:        role,
-			Provisioned: true,
-		})
-	}
-	return users, nil
-}
-
-func parseAccess(users []*user.User, accessRaw []string) (map[string][]*user.Grant, error) {
-	access := make(map[string][]*user.Grant)
-	for _, accessLine := range accessRaw {
-		parts := strings.Split(accessLine, ":")
-		if len(parts) != 3 {
-			return nil, fmt.Errorf("invalid auth-access: %s, expected format: 'user:topic:permission'", accessLine)
-		}
-		username := strings.TrimSpace(parts[0])
-		if username == userEveryone {
-			username = user.Everyone
-		}
-		u, exists := util.Find(users, func(u *user.User) bool {
-			return u.Name == username
-		})
-		if username != user.Everyone {
-			if !exists {
-				return nil, fmt.Errorf("invalid auth-access: %s, user %s is not provisioned", accessLine, username)
-			} else if !user.AllowedUsername(username) {
-				return nil, fmt.Errorf("invalid auth-access: %s, username %s invalid", accessLine, username)
-			} else if u.Role != user.RoleUser {
-				return nil, fmt.Errorf("invalid auth-access: %s, user %s is not a regular user, only regular users can have ACL entries", accessLine, username)
-			}
-		}
-		topic := strings.TrimSpace(parts[1])
-		if !user.AllowedTopicPattern(topic) {
-			return nil, fmt.Errorf("invalid auth-access: %s, topic pattern %s invalid", accessLine, topic)
-		}
-		permission, err := user.ParsePermission(strings.TrimSpace(parts[2]))
+func sigHandlerConfigReload(config string) {
+	sigs := make(chan os.Signal, 1)
+	signal.Notify(sigs, syscall.SIGHUP)
+	for range sigs {
+		log.Info("Partially hot reloading configuration ...")
+		inputSource, err := newYamlSourceFromFile(config, flagsServe)
 		if err != nil {
-			return nil, fmt.Errorf("invalid auth-access: %s, permission %s invalid, %s", accessLine, parts[2], err.Error())
+			log.Warn("Hot reload failed: %s", err.Error())
+			continue
 		}
-		if _, exists := access[username]; !exists {
-			access[username] = make([]*user.Grant, 0)
-		}
-		access[username] = append(access[username], &user.Grant{
-			TopicPattern: topic,
-			Permission:   permission,
-			Provisioned:  true,
-		})
+		reloadLogLevel(inputSource)
 	}
-	return access, nil
 }
 
-func parseTokens(users []*user.User, tokensRaw []string) (map[string][]*user.Token, error) {
-	tokens := make(map[string][]*user.Token)
-	for _, tokenLine := range tokensRaw {
-		parts := strings.Split(tokenLine, ":")
-		if len(parts) < 2 || len(parts) > 3 {
-			return nil, fmt.Errorf("invalid auth-tokens: %s, expected format: 'user:token[:label]'", tokenLine)
-		}
-		username := strings.TrimSpace(parts[0])
-		_, exists := util.Find(users, func(u *user.User) bool {
-			return u.Name == username
-		})
-		if !exists {
-			return nil, fmt.Errorf("invalid auth-tokens: %s, user %s is not provisioned", tokenLine, username)
-		} else if !user.AllowedUsername(username) {
-			return nil, fmt.Errorf("invalid auth-tokens: %s, username %s invalid", tokenLine, username)
-		}
-		token := strings.TrimSpace(parts[1])
-		if !user.ValidToken(token) {
-			return nil, fmt.Errorf("invalid auth-tokens: %s, token %s invalid, use 'ntfy token generate' to generate a random token", tokenLine, token)
-		}
-		var label string
-		if len(parts) > 2 {
-			label = parts[2]
-		}
-		if _, exists := tokens[username]; !exists {
-			tokens[username] = make([]*user.Token, 0)
-		}
-		tokens[username] = append(tokens[username], &user.Token{
-			Value:       token,
-			Label:       label,
-			Provisioned: true,
-		})
-	}
-	return tokens, nil
-}
-
-func maybeFromMetadata(m map[string]any, key string) string {
-	if m == nil {
-		return ""
-	}
-	v, exists := m[key]
-	if !exists {
-		return ""
-	}
-	s, ok := v.(string)
-	if !ok {
-		return ""
-	}
-	return s
-}
-
-// wildcardAddr reports whether the given listen address binds all interfaces (e.g. ":2587",
-// "0.0.0.0:2587", "[::]:2587"), in which case peers cannot derive a reachable URL from it.
-func wildcardAddr(addr string) bool {
-	host, _, err := net.SplitHostPort(addr)
+func reloadLogLevel(inputSource altsrc.InputSourceContext) {
+	newLevelStr, err := inputSource.String("log-level")
 	if err != nil {
-		return true // Unparseable -> cannot derive a URL either
+		log.Warn("Cannot load log level: %s", err.Error())
+		return
 	}
-	return host == "" || host == "0.0.0.0" || host == "::"
+	newLevel := log.ToLevel(newLevelStr)
+	log.SetLevel(newLevel)
+	log.Info("Log level is %s", newLevel.String())
 }

cmd/serve_test.go

@@ -2,471 +2,21 @@ package cmd
 
 import (
 	"fmt"
+	"github.com/gorilla/websocket"
+	"github.com/stretchr/testify/require"
+	"heckel.io/ntfy/client"
+	"heckel.io/ntfy/test"
+	"heckel.io/ntfy/util"
 	"math/rand"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"testing"
 	"time"
-
-	"github.com/gorilla/websocket"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/client"
-	"heckel.io/ntfy/v2/test"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
 )
 
-func TestParseUsers_Success(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    []string
-		expected []*user.User
-	}{
-		{
-			name:  "single user",
-			input: []string{"alice:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user"},
-			expected: []*user.User{
-				{
-					Name:        "alice",
-					Hash:        "$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S",
-					Role:        user.RoleUser,
-					Provisioned: true,
-				},
-			},
-		},
-		{
-			name: "multiple users with different roles",
-			input: []string{
-				"alice:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user",
-				"bob:$2a$10$jIcuBWcbxd6oW1aPvoJ5iOShzu3/UJ2kSxKbTZtDypG06nBflQagq:admin",
-			},
-			expected: []*user.User{
-				{
-					Name:        "alice",
-					Hash:        "$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S",
-					Role:        user.RoleUser,
-					Provisioned: true,
-				},
-				{
-					Name:        "bob",
-					Hash:        "$2a$10$jIcuBWcbxd6oW1aPvoJ5iOShzu3/UJ2kSxKbTZtDypG06nBflQagq",
-					Role:        user.RoleAdmin,
-					Provisioned: true,
-				},
-			},
-		},
-		{
-			name:     "empty input",
-			input:    []string{},
-			expected: []*user.User{},
-		},
-		{
-			name:  "user with special characters in name",
-			input: []string{"alice.test+123@example.com:$2a$10$RYUYAsl5zOnAIp6fH7BPX.Eug0rUfEUk92r8WiVusb0VK.vGojWBe:user"},
-			expected: []*user.User{
-				{
-					Name:        "alice.test+123@example.com",
-					Hash:        "$2a$10$RYUYAsl5zOnAIp6fH7BPX.Eug0rUfEUk92r8WiVusb0VK.vGojWBe",
-					Role:        user.RoleUser,
-					Provisioned: true,
-				},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := parseUsers(tt.input)
-			require.NoError(t, err)
-			require.Len(t, result, len(tt.expected))
-
-			for i, expectedUser := range tt.expected {
-				assert.Equal(t, expectedUser.Name, result[i].Name)
-				assert.Equal(t, expectedUser.Hash, result[i].Hash)
-				assert.Equal(t, expectedUser.Role, result[i].Role)
-				assert.Equal(t, expectedUser.Provisioned, result[i].Provisioned)
-			}
-		})
-	}
-}
-
-func TestParseUsers_Errors(t *testing.T) {
-	tests := []struct {
-		name  string
-		input []string
-		error string
-	}{
-		{
-			name:  "invalid format - too few parts",
-			input: []string{"alice:hash"},
-			error: "invalid auth-users: alice:hash, expected format: 'name:hash:role'",
-		},
-		{
-			name:  "invalid format - too many parts",
-			input: []string{"alice:hash:role:extra"},
-			error: "invalid auth-users: alice:hash:role:extra, expected format: 'name:hash:role'",
-		},
-		{
-			name:  "invalid username",
-			input: []string{"alice@#$%:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user"},
-			error: "invalid auth-users: alice@#$%:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user, username invalid",
-		},
-		{
-			name:  "invalid password hash - wrong prefix",
-			input: []string{"alice:plaintext:user"},
-			error: "invalid auth-users: alice:plaintext:user, password hash invalid, password hash must be a bcrypt hash, use 'ntfy user hash' to generate",
-		},
-		{
-			name:  "invalid role",
-			input: []string{"alice:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:invalid"},
-			error: "invalid auth-users: alice:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:invalid, role invalid is not allowed, allowed roles are 'admin' or 'user'",
-		},
-		{
-			name:  "empty username",
-			input: []string{":$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user"},
-			error: "invalid auth-users: :$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user, username invalid",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := parseUsers(tt.input)
-			require.Error(t, err)
-			require.Nil(t, result)
-			assert.Contains(t, err.Error(), tt.error)
-		})
-	}
-}
-
-func TestParseAccess_Success(t *testing.T) {
-	users := []*user.User{
-		{Name: "alice", Role: user.RoleUser},
-		{Name: "bob", Role: user.RoleUser},
-	}
-
-	tests := []struct {
-		name     string
-		users    []*user.User
-		input    []string
-		expected map[string][]*user.Grant
-	}{
-		{
-			name:  "single access entry",
-			users: users,
-			input: []string{"alice:mytopic:read-write"},
-			expected: map[string][]*user.Grant{
-				"alice": {
-					{
-						TopicPattern: "mytopic",
-						Permission:   user.PermissionReadWrite,
-						Provisioned:  true,
-					},
-				},
-			},
-		},
-		{
-			name:  "multiple access entries for same user",
-			users: users,
-			input: []string{
-				"alice:topic1:read-only",
-				"alice:topic2:write-only",
-			},
-			expected: map[string][]*user.Grant{
-				"alice": {
-					{
-						TopicPattern: "topic1",
-						Permission:   user.PermissionRead,
-						Provisioned:  true,
-					},
-					{
-						TopicPattern: "topic2",
-						Permission:   user.PermissionWrite,
-						Provisioned:  true,
-					},
-				},
-			},
-		},
-		{
-			name:  "access for everyone",
-			users: users,
-			input: []string{"everyone:publictopic:read-only"},
-			expected: map[string][]*user.Grant{
-				user.Everyone: {
-					{
-						TopicPattern: "publictopic",
-						Permission:   user.PermissionRead,
-						Provisioned:  true,
-					},
-				},
-			},
-		},
-		{
-			name:  "wildcard topic pattern",
-			users: users,
-			input: []string{"alice:topic*:read-write"},
-			expected: map[string][]*user.Grant{
-				"alice": {
-					{
-						TopicPattern: "topic*",
-						Permission:   user.PermissionReadWrite,
-						Provisioned:  true,
-					},
-				},
-			},
-		},
-		{
-			name:     "empty input",
-			users:    users,
-			input:    []string{},
-			expected: map[string][]*user.Grant{},
-		},
-		{
-			name:  "deny-all permission",
-			users: users,
-			input: []string{"alice:secretopic:deny-all"},
-			expected: map[string][]*user.Grant{
-				"alice": {
-					{
-						TopicPattern: "secretopic",
-						Permission:   user.PermissionDenyAll,
-						Provisioned:  true,
-					},
-				},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := parseAccess(tt.users, tt.input)
-			require.NoError(t, err)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestParseAccess_Errors(t *testing.T) {
-	users := []*user.User{
-		{Name: "alice", Role: user.RoleUser},
-		{Name: "admin", Role: user.RoleAdmin},
-	}
-
-	tests := []struct {
-		name  string
-		users []*user.User
-		input []string
-		error string
-	}{
-		{
-			name:  "invalid format - too few parts",
-			users: users,
-			input: []string{"alice:topic"},
-			error: "invalid auth-access: alice:topic, expected format: 'user:topic:permission'",
-		},
-		{
-			name:  "invalid format - too many parts",
-			users: users,
-			input: []string{"alice:topic:read:extra"},
-			error: "invalid auth-access: alice:topic:read:extra, expected format: 'user:topic:permission'",
-		},
-		{
-			name:  "user not provisioned",
-			users: users,
-			input: []string{"charlie:topic:read"},
-			error: "invalid auth-access: charlie:topic:read, user charlie is not provisioned",
-		},
-		{
-			name:  "admin user cannot have ACL entries",
-			users: users,
-			input: []string{"admin:topic:read"},
-			error: "invalid auth-access: admin:topic:read, user admin is not a regular user, only regular users can have ACL entries",
-		},
-		{
-			name:  "invalid topic pattern",
-			users: users,
-			input: []string{"alice:topic-with-invalid-chars!:read"},
-			error: "invalid auth-access: alice:topic-with-invalid-chars!:read, topic pattern topic-with-invalid-chars! invalid",
-		},
-		{
-			name:  "invalid permission",
-			users: users,
-			input: []string{"alice:topic:invalid-permission"},
-			error: "invalid auth-access: alice:topic:invalid-permission, permission invalid-permission invalid",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := parseAccess(tt.users, tt.input)
-			require.Error(t, err)
-			require.Nil(t, result)
-			assert.Contains(t, err.Error(), tt.error)
-		})
-	}
-}
-
-func TestParseTokens_Success(t *testing.T) {
-	users := []*user.User{
-		{Name: "alice"},
-		{Name: "bob"},
-	}
-
-	tests := []struct {
-		name     string
-		users    []*user.User
-		input    []string
-		expected map[string][]*user.Token
-	}{
-		{
-			name:  "single token without label",
-			users: users,
-			input: []string{"alice:tk_abcdefghijklmnopqrstuvwxyz123"},
-			expected: map[string][]*user.Token{
-				"alice": {
-					{
-						Value:       "tk_abcdefghijklmnopqrstuvwxyz123",
-						Label:       "",
-						Provisioned: true,
-					},
-				},
-			},
-		},
-		{
-			name:  "single token with label",
-			users: users,
-			input: []string{"alice:tk_abcdefghijklmnopqrstuvwxyz123:My Phone"},
-			expected: map[string][]*user.Token{
-				"alice": {
-					{
-						Value:       "tk_abcdefghijklmnopqrstuvwxyz123",
-						Label:       "My Phone",
-						Provisioned: true,
-					},
-				},
-			},
-		},
-		{
-			name:  "multiple tokens for same user",
-			users: users,
-			input: []string{
-				"alice:tk_abcdefghijklmnopqrstuvwxyz123:Phone",
-				"alice:tk_zyxwvutsrqponmlkjihgfedcba987:Laptop",
-			},
-			expected: map[string][]*user.Token{
-				"alice": {
-					{
-						Value:       "tk_abcdefghijklmnopqrstuvwxyz123",
-						Label:       "Phone",
-						Provisioned: true,
-					},
-					{
-						Value:       "tk_zyxwvutsrqponmlkjihgfedcba987",
-						Label:       "Laptop",
-						Provisioned: true,
-					},
-				},
-			},
-		},
-		{
-			name:  "tokens for multiple users",
-			users: users,
-			input: []string{
-				"alice:tk_abcdefghijklmnopqrstuvwxyz123:Phone",
-				"bob:tk_zyxwvutsrqponmlkjihgfedcba987:Tablet",
-			},
-			expected: map[string][]*user.Token{
-				"alice": {
-					{
-						Value:       "tk_abcdefghijklmnopqrstuvwxyz123",
-						Label:       "Phone",
-						Provisioned: true,
-					},
-				},
-				"bob": {
-					{
-						Value:       "tk_zyxwvutsrqponmlkjihgfedcba987",
-						Label:       "Tablet",
-						Provisioned: true,
-					},
-				},
-			},
-		},
-		{
-			name:     "empty input",
-			users:    users,
-			input:    []string{},
-			expected: map[string][]*user.Token{},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := parseTokens(tt.users, tt.input)
-			require.NoError(t, err)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestParseTokens_Errors(t *testing.T) {
-	users := []*user.User{
-		{Name: "alice"},
-	}
-
-	tests := []struct {
-		name  string
-		users []*user.User
-		input []string
-		error string
-	}{
-		{
-			name:  "invalid format - too few parts",
-			users: users,
-			input: []string{"alice"},
-			error: "invalid auth-tokens: alice, expected format: 'user:token[:label]'",
-		},
-		{
-			name:  "invalid format - too many parts",
-			users: users,
-			input: []string{"alice:token:label:extra:parts"},
-			error: "invalid auth-tokens: alice:token:label:extra:parts, expected format: 'user:token[:label]'",
-		},
-		{
-			name:  "user not provisioned",
-			users: users,
-			input: []string{"charlie:tk_abcdefghijklmnopqrstuvwxyz123"},
-			error: "invalid auth-tokens: charlie:tk_abcdefghijklmnopqrstuvwxyz123, user charlie is not provisioned",
-		},
-		{
-			name:  "invalid token format",
-			users: users,
-			input: []string{"alice:invalid-token"},
-			error: "invalid auth-tokens: alice:invalid-token, token invalid-token invalid, use 'ntfy token generate' to generate a random token",
-		},
-		{
-			name:  "token too short",
-			users: users,
-			input: []string{"alice:tk_short"},
-			error: "invalid auth-tokens: alice:tk_short, token tk_short invalid, use 'ntfy token generate' to generate a random token",
-		},
-		{
-			name:  "token without prefix",
-			users: users,
-			input: []string{"alice:abcdefghijklmnopqrstuvwxyz12345"},
-			error: "invalid auth-tokens: alice:abcdefghijklmnopqrstuvwxyz12345, token abcdefghijklmnopqrstuvwxyz12345 invalid, use 'ntfy token generate' to generate a random token",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := parseTokens(tt.users, tt.input)
-			require.Error(t, err)
-			require.Nil(t, result)
-			assert.Contains(t, err.Error(), tt.error)
-		})
-	}
+func init() {
+	rand.Seed(time.Now().UnixMilli())
 }
 
 func TestCLI_Serve_Unix_Curl(t *testing.T) {
@@ -520,57 +70,6 @@ func TestCLI_Serve_WebSocket(t *testing.T) {
 	require.Equal(t, "mytopic", m.Topic)
 }
 
-func TestIP_Host_Parsing(t *testing.T) {
-	cases := map[string]string{
-		"1.1.1.1":          "1.1.1.1/32",
-		"fd00::1234":       "fd00::1234/128",
-		"192.168.0.3/24":   "192.168.0.0/24",
-		"10.1.2.3/8":       "10.0.0.0/8",
-		"201:be93::4a6/21": "201:b800::/21",
-	}
-	for q, expectedAnswer := range cases {
-		ips, err := parseIPHostPrefix(q)
-		require.Nil(t, err)
-		assert.Equal(t, 1, len(ips))
-		assert.Equal(t, expectedAnswer, ips[0].String())
-	}
-}
-
-func TestCLI_Serve_ClusterValidation(t *testing.T) {
-	configFile := newEmptyFile(t) // Avoid issues with existing server.yml file on system
-	// Setting cluster-listen implicitly enables clustering, which requires database-url; all
-	// validation must fail before any database connection is attempted
-	app, _, _, _ := newTestApp()
-	err := app.Run([]string{"ntfy", "serve", "--config=" + configFile, "--cluster-listen=127.0.0.1:2587"})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "database-url")
-	// cluster-listen requires cluster-secret
-	app, _, _, _ = newTestApp()
-	err = app.Run([]string{"ntfy", "serve", "--config=" + configFile, "--cluster-listen=127.0.0.1:2587", "--database-url=postgres://user:pass@localhost:1/na"})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "cluster-secret")
-	// cluster-listen requires an explicit stable node ID
-	app, _, _, _ = newTestApp()
-	err = app.Run([]string{"ntfy", "serve", "--config=" + configFile, "--cluster-listen=127.0.0.1:2587", "--database-url=postgres://user:pass@localhost:1/na", "--cluster-secret=s3cret"})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "cluster-node-id")
-	// cluster-secret without cluster-listen is a config error (clustering would silently be off)
-	app, _, _, _ = newTestApp()
-	err = app.Run([]string{"ntfy", "serve", "--config=" + configFile, "--cluster-secret=s3cret"})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "cluster-listen")
-	// A wildcard cluster-listen bind cannot derive an advertise URL
-	app, _, _, _ = newTestApp()
-	err = app.Run([]string{"ntfy", "serve", "--config=" + configFile, "--cluster-listen=:2587", "--database-url=postgres://user:pass@localhost:1/na", "--cluster-secret=s3cret", "--cluster-node-id=node-a"})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "cluster-advertise-url")
-	// cluster-batch-linger must not be negative
-	app, _, _, _ = newTestApp()
-	err = app.Run([]string{"ntfy", "serve", "--config=" + configFile, "--cluster-batch-linger=-1s"})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "cluster batch linger")
-}
-
 func newEmptyFile(t *testing.T) string {
 	filename := filepath.Join(t.TempDir(), "empty")
 	require.Nil(t, os.WriteFile(filename, []byte{}, 0600))

cmd/serve_unix.go

@@ -1,55 +0,0 @@
-//go:build (darwin || linux || dragonfly || freebsd || netbsd || openbsd) && !noserver
-
-package cmd
-
-import (
-	"os"
-	"os/signal"
-	"syscall"
-
-	"github.com/urfave/cli/v2/altsrc"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/server"
-)
-
-func sigHandlerConfigReload(config string) {
-	sigs := make(chan os.Signal, 1)
-	signal.Notify(sigs, syscall.SIGHUP)
-	for range sigs {
-		log.Info("Partially hot reloading configuration ...")
-		inputSource, err := newYamlSourceFromFile(config, flagsServe)
-		if err != nil {
-			log.Warn("Hot reload failed: %s", err.Error())
-			continue
-		}
-		if err := reloadLogLevel(inputSource); err != nil {
-			log.Warn("Reloading log level failed: %s", err.Error())
-		}
-	}
-}
-
-func reloadLogLevel(inputSource altsrc.InputSourceContext) error {
-	newLevelStr, err := inputSource.String("log-level")
-	if err != nil {
-		return err
-	}
-	overrides, err := inputSource.StringSlice("log-level-overrides")
-	if err != nil {
-		return err
-	}
-	log.ResetLevelOverrides()
-	if err := applyLogLevelOverrides(overrides); err != nil {
-		return err
-	}
-	log.SetLevel(log.ToLevel(newLevelStr))
-	if len(overrides) > 0 {
-		log.Info("Log level is %v, %d override(s) in place", newLevelStr, len(overrides))
-	} else {
-		log.Info("Log level is %v", newLevelStr)
-	}
-	return nil
-}
-
-func maybeRunAsService(conf *server.Config) (bool, error) {
-	return false, nil
-}

cmd/serve_windows.go

@@ -1,100 +0,0 @@
-//go:build windows && !noserver
-
-package cmd
-
-import (
-	"fmt"
-	"sync"
-
-	"golang.org/x/sys/windows/svc"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/server"
-)
-
-const serviceName = "ntfy"
-
-// sigHandlerConfigReload is a no-op on Windows since SIGHUP is not available.
-// Windows users can restart the service to reload configuration.
-func sigHandlerConfigReload(config string) {
-	log.Debug("Config hot-reload via SIGHUP is not supported on Windows")
-}
-
-// runAsWindowsService runs the ntfy server as a Windows service
-func runAsWindowsService(conf *server.Config) error {
-	return svc.Run(serviceName, &windowsService{conf: conf})
-}
-
-// windowsService implements the svc.Handler interface
-type windowsService struct {
-	conf   *server.Config
-	server *server.Server
-	mu     sync.Mutex
-}
-
-// Execute is the main entry point for the Windows service
-func (s *windowsService) Execute(args []string, requests <-chan svc.ChangeRequest, status chan<- svc.Status) (bool, uint32) {
-	const cmdsAccepted = svc.AcceptStop | svc.AcceptShutdown
-	status <- svc.Status{State: svc.StartPending}
-
-	// Create and start the server
-	var err error
-	s.mu.Lock()
-	s.server, err = server.New(s.conf)
-	s.mu.Unlock()
-	if err != nil {
-		log.Error("Failed to create server: %s", err.Error())
-		return true, 1
-	}
-
-	// Start server in a goroutine
-	serverErrChan := make(chan error, 1)
-	go func() {
-		serverErrChan <- s.server.Run()
-	}()
-
-	status <- svc.Status{State: svc.Running, Accepts: cmdsAccepted}
-	log.Info("Windows service started")
-
-	for {
-		select {
-		case err := <-serverErrChan:
-			if err != nil {
-				log.Error("Server error: %s", err.Error())
-				return true, 1
-			}
-			return false, 0
-		case req := <-requests:
-			switch req.Cmd {
-			case svc.Interrogate:
-				status <- req.CurrentStatus
-			case svc.Stop, svc.Shutdown:
-				log.Info("Windows service stopping...")
-				status <- svc.Status{State: svc.StopPending}
-				s.mu.Lock()
-				if s.server != nil {
-					s.server.Stop()
-				}
-				s.mu.Unlock()
-				return false, 0
-			default:
-				log.Warn("Unexpected service control request: %d", req.Cmd)
-			}
-		}
-	}
-}
-
-// maybeRunAsService checks if the process is running as a Windows service,
-// and if so, runs the server as a service. Returns true if it ran as a service.
-func maybeRunAsService(conf *server.Config) (bool, error) {
-	isService, err := svc.IsWindowsService()
-	if err != nil {
-		return false, fmt.Errorf("failed to detect Windows service mode: %w", err)
-	} else if !isService {
-		return false, nil
-	}
-	log.Info("Running as Windows service")
-	if err := runAsWindowsService(conf); err != nil {
-		return true, fmt.Errorf("failed to run as Windows service: %w", err)
-	}
-	return true, nil
-}

cmd/subscribe.go

@@ -3,27 +3,33 @@ package cmd
 import (
 	"errors"
 	"fmt"
+	"github.com/urfave/cli/v2"
+	"heckel.io/ntfy/client"
+	"heckel.io/ntfy/log"
+	"heckel.io/ntfy/util"
 	"os"
 	"os/exec"
+	"os/user"
+	"path/filepath"
 	"sort"
 	"strings"
-
-	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/client"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/util"
 )
 
 func init() {
 	commands = append(commands, cmdSubscribe)
 }
 
+const (
+	clientRootConfigFileUnixAbsolute    = "/etc/ntfy/client.yml"
+	clientUserConfigFileUnixRelative    = "ntfy/client.yml"
+	clientUserConfigFileWindowsRelative = "ntfy\\client.yml"
+)
+
 var flagsSubscribe = append(
-	append([]cli.Flag{}, flagsDefault...),
+	flagsDefault,
 	&cli.StringFlag{Name: "config", Aliases: []string{"c"}, Usage: "client config file"},
 	&cli.StringFlag{Name: "since", Aliases: []string{"s"}, Usage: "return events since `SINCE` (Unix timestamp, or all)"},
-	&cli.StringFlag{Name: "user", Aliases: []string{"u"}, EnvVars: []string{"NTFY_USER"}, Usage: "username[:password] used to auth against the server"},
-	&cli.StringFlag{Name: "token", Aliases: []string{"k"}, EnvVars: []string{"NTFY_TOKEN"}, Usage: "access token used to auth against the server"},
+	&cli.StringFlag{Name: "user", Aliases: []string{"u"}, Usage: "username[:password] used to auth against the server"},
 	&cli.BoolFlag{Name: "from-config", Aliases: []string{"from_config", "C"}, Usage: "read subscriptions from config file (service mode)"},
 	&cli.BoolFlag{Name: "poll", Aliases: []string{"p"}, Usage: "return events and exit, do not listen for new events"},
 	&cli.BoolFlag{Name: "scheduled", Aliases: []string{"sched", "S"}, Usage: "also return scheduled/delayed events"},
@@ -65,7 +71,7 @@ ntfy subscribe TOPIC COMMAND
     $NTFY_TITLE     $title, $t            Message title
     $NTFY_PRIORITY  $priority, $prio, $p  Message priority (1=min, 5=max)
     $NTFY_TAGS      $tags, $tag, $ta      Message tags (comma separated list)
-    $NTFY_RAW       $raw                  Raw JSON message
+	$NTFY_RAW       $raw                  Raw JSON message
 
   Examples:
     ntfy sub mytopic 'notify-send "$m"'    # Execute command for incoming messages
@@ -91,18 +97,11 @@ func execSubscribe(c *cli.Context) error {
 	cl := client.New(conf)
 	since := c.String("since")
 	user := c.String("user")
-	token := c.String("token")
 	poll := c.Bool("poll")
 	scheduled := c.Bool("scheduled")
 	fromConfig := c.Bool("from-config")
 	topic := c.Args().Get(0)
 	command := c.Args().Get(1)
-
-	// Checks
-	if user != "" && token != "" {
-		return errors.New("cannot set both --user and --token")
-	}
-
 	if !fromConfig {
 		conf.Subscribe = nil // wipe if --from-config not passed
 	}
@@ -110,9 +109,7 @@ func execSubscribe(c *cli.Context) error {
 	if since != "" {
 		options = append(options, client.WithSince(since))
 	}
-	if token != "" {
-		options = append(options, client.WithBearerAuth(token))
-	} else if user != "" {
+	if user != "" {
 		var pass string
 		parts := strings.SplitN(user, ":", 2)
 		if len(parts) == 2 {
@@ -128,10 +125,9 @@ func execSubscribe(c *cli.Context) error {
 			fmt.Fprintf(c.App.ErrWriter, "\r%s\r", strings.Repeat(" ", 20))
 		}
 		options = append(options, client.WithBasicAuth(user, pass))
-	} else if conf.DefaultToken != "" {
-		options = append(options, client.WithBearerAuth(conf.DefaultToken))
-	} else if conf.DefaultUser != "" && conf.DefaultPassword != nil {
-		options = append(options, client.WithBasicAuth(conf.DefaultUser, *conf.DefaultPassword))
+	}
+	if poll {
+		options = append(options, client.WithPoll())
 	}
 	if scheduled {
 		options = append(options, client.WithScheduled())
@@ -149,9 +145,6 @@ func execSubscribe(c *cli.Context) error {
 
 func doPoll(c *cli.Context, cl *client.Client, conf *client.Config, topic, command string, options ...client.SubscribeOption) error {
 	for _, s := range conf.Subscribe { // may be nil
-		if auth := maybeAddAuthHeader(s, conf); auth != nil {
-			options = append(options, auth)
-		}
 		if err := doPollSingle(c, cl, s.Topic, s.Command, options...); err != nil {
 			return err
 		}
@@ -182,15 +175,21 @@ func doSubscribe(c *cli.Context, cl *client.Client, conf *client.Config, topic,
 		for filter, value := range s.If {
 			topicOptions = append(topicOptions, client.WithFilter(filter, value))
 		}
-
-		if auth := maybeAddAuthHeader(s, conf); auth != nil {
-			topicOptions = append(topicOptions, auth)
+		var user, password string
+		if s.User != "" {
+			user = s.User
+		} else if conf.DefaultUser != "" {
+			user = conf.DefaultUser
 		}
-
-		subscriptionID, err := cl.Subscribe(s.Topic, topicOptions...)
-		if err != nil {
-			return err
+		if s.Password != "" {
+			password = s.Password
+		} else if conf.DefaultPassword != "" {
+			password = conf.DefaultPassword
 		}
+		if user != "" && password != "" {
+			topicOptions = append(topicOptions, client.WithBasicAuth(user, password))
+		}
+		subscriptionID := cl.Subscribe(s.Topic, topicOptions...)
 		if s.Command != "" {
 			cmds[subscriptionID] = s.Command
 		} else if conf.DefaultCommand != "" {
@@ -200,10 +199,7 @@ func doSubscribe(c *cli.Context, cl *client.Client, conf *client.Config, topic,
 		}
 	}
 	if topic != "" {
-		subscriptionID, err := cl.Subscribe(topic, options...)
-		if err != nil {
-			return err
-		}
+		subscriptionID := cl.Subscribe(topic, options...)
 		cmds[subscriptionID] = command
 	}
 	for m := range cl.Messages {
@@ -217,30 +213,6 @@ func doSubscribe(c *cli.Context, cl *client.Client, conf *client.Config, topic,
 	return nil
 }
 
-func maybeAddAuthHeader(s client.Subscribe, conf *client.Config) client.SubscribeOption {
-	// if an explicit empty token or empty user:pass is given, exit without auth
-	if (s.Token != nil && *s.Token == "") || (s.User != nil && *s.User == "" && s.Password != nil && *s.Password == "") {
-		return client.WithEmptyAuth()
-	}
-
-	// check for subscription token then subscription user:pass
-	if s.Token != nil && *s.Token != "" {
-		return client.WithBearerAuth(*s.Token)
-	}
-	if s.User != nil && *s.User != "" && s.Password != nil {
-		return client.WithBasicAuth(*s.User, *s.Password)
-	}
-
-	// if no subscription token nor subscription user:pass, check for default token then default user:pass
-	if conf.DefaultToken != "" {
-		return client.WithBearerAuth(conf.DefaultToken)
-	}
-	if conf.DefaultUser != "" && conf.DefaultPassword != nil {
-		return client.WithBasicAuth(conf.DefaultUser, *conf.DefaultPassword)
-	}
-	return nil
-}
-
 func printMessageOrRunCommand(c *cli.Context, m *client.Message, command string) {
 	if command != "" {
 		runCommand(c, command, m)
@@ -303,16 +275,30 @@ func loadConfig(c *cli.Context) (*client.Config, error) {
 	if filename != "" {
 		return client.LoadConfig(filename)
 	}
-	if client.DefaultConfigFile != "" {
-		if s, _ := os.Stat(client.DefaultConfigFile); s != nil {
-			return client.LoadConfig(client.DefaultConfigFile)
-		}
-		log.Debug("Config file %s not found", client.DefaultConfigFile)
+	configFile := defaultClientConfigFile()
+	if s, _ := os.Stat(configFile); s != nil {
+		return client.LoadConfig(configFile)
 	}
-	log.Debug("Loading default config")
 	return client.NewConfig(), nil
 }
 
+//lint:ignore U1000 Conditionally used in different builds
+func defaultClientConfigFileUnix() string {
+	u, _ := user.Current()
+	configFile := clientRootConfigFileUnixAbsolute
+	if u.Uid != "0" {
+		homeDir, _ := os.UserConfigDir()
+		return filepath.Join(homeDir, clientUserConfigFileUnixRelative)
+	}
+	return configFile
+}
+
+//lint:ignore U1000 Conditionally used in different builds
+func defaultClientConfigFileWindows() string {
+	homeDir, _ := os.UserConfigDir()
+	return filepath.Join(homeDir, clientUserConfigFileWindowsRelative)
+}
+
 func logMessagePrefix(m *client.Message) string {
 	return fmt.Sprintf("%s/%s", util.ShortTopicURL(m.TopicURL), m.ID)
 }

cmd/subscribe_darwin.go

@@ -1,5 +1,3 @@
-//go:build darwin
-
 package cmd
 
 const (
@@ -12,3 +10,7 @@ or "~/Library/Application Support/ntfy/client.yml" for all other users.`
 var (
 	scriptLauncher = []string{"sh", "-c"}
 )
+
+func defaultClientConfigFile() string {
+	return defaultClientConfigFileUnix()
+}

cmd/subscribe_test.go

@@ -1,417 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"github.com/stretchr/testify/require"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestCLI_Subscribe_Default_UserPass_Subscription_Token(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "Bearer tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-user: philipp
-default-password: mypass
-subscribe:
-  - topic: mytopic
-    token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Default_Token_Subscription_UserPass(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "Basic cGhpbGlwcDpteXBhc3M=", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
-subscribe:
-  - topic: mytopic
-    user: philipp
-    password: mypass
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Default_Token_Subscription_Token(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "Bearer tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-token: tk_FAKETOKEN01234567890FAKETOKEN
-subscribe:
-  - topic: mytopic
-    token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Default_UserPass_Subscription_UserPass(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "Basic cGhpbGlwcDpteXBhc3M=", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-user: fake
-default-password: password
-subscribe:
-  - topic: mytopic
-    user: philipp
-    password: mypass
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Default_Token_Subscription_Empty(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "Bearer tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
-subscribe:
-  - topic: mytopic
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Default_UserPass_Subscription_Empty(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "Basic cGhpbGlwcDpteXBhc3M=", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-user: philipp
-default-password: mypass
-subscribe:
-  - topic: mytopic
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Default_Empty_Subscription_Token(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "Bearer tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-subscribe:
-  - topic: mytopic
-    token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Default_Empty_Subscription_UserPass(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "Basic cGhpbGlwcDpteXBhc3M=", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-subscribe:
-  - topic: mytopic
-    user: philipp
-    password: mypass
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Default_Token_CLI_Token(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "Bearer tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-token: tk_FAKETOKEN0123456789FAKETOKEN
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename, "--token", "tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", "mytopic"}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Default_Token_CLI_UserPass(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "Basic cGhpbGlwcDpteXBhc3M=", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename, "--user", "philipp:mypass", "mytopic"}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Default_Token_Subscription_Token_CLI_UserPass(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "Bearer tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-token: tk_FAKETOKEN01234567890FAKETOKEN
-subscribe:
-  - topic: mytopic
-    token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename, "--user", "philipp:mypass"}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Token_And_UserPass(t *testing.T) {
-	app, _, _, _ := newTestApp()
-	err := app.Run([]string{"ntfy", "subscribe", "--poll", "--token", "tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", "--user", "philipp:mypass", "mytopic", "triggered"})
-	require.Error(t, err)
-	require.Equal(t, "cannot set both --user and --token", err.Error())
-}
-
-func TestCLI_Subscribe_Default_Token(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "Bearer tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename, "mytopic"}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Default_UserPass(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "Basic cGhpbGlwcDpteXBhc3M=", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-user: philipp
-default-password: mypass
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename, "mytopic"}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Override_Default_UserPass_With_Empty_UserPass(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-user: philipp
-default-password: mypass
-subscribe:
-  - topic: mytopic
-    user: ""
-    password: ""
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}
-
-func TestCLI_Subscribe_Override_Default_Token_With_Empty_Token(t *testing.T) {
-	message := `{"id":"RXIQBFaieLVr","time":124,"expires":1124,"event":"message","topic":"mytopic","message":"triggered"}`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/mytopic/json", r.URL.Path)
-		require.Equal(t, "", r.Header.Get("Authorization"))
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(message))
-	}))
-	defer server.Close()
-
-	filename := filepath.Join(t.TempDir(), "client.yml")
-	require.Nil(t, os.WriteFile(filename, []byte(fmt.Sprintf(`
-default-host: %s
-default-token: tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2
-subscribe:
-  - topic: mytopic
-    token: ""
-`, server.URL)), 0600))
-
-	app, _, stdout, _ := newTestApp()
-
-	require.Nil(t, app.Run([]string{"ntfy", "subscribe", "--poll", "--from-config", "--config=" + filename}))
-
-	require.Equal(t, message, strings.TrimSpace(stdout.String()))
-}

cmd/subscribe_unix.go

@@ -1,4 +1,5 @@
 //go:build linux || dragonfly || freebsd || netbsd || openbsd
+// +build linux dragonfly freebsd netbsd openbsd
 
 package cmd
 
@@ -12,3 +13,7 @@ or ~/.config/ntfy/client.yml for all other users.`
 var (
 	scriptLauncher = []string{"sh", "-c"}
 )
+
+func defaultClientConfigFile() string {
+	return defaultClientConfigFileUnix()
+}

cmd/subscribe_windows.go

@@ -1,5 +1,3 @@
-//go:build windows
-
 package cmd
 
 const (
@@ -11,3 +9,7 @@ const (
 var (
 	scriptLauncher = []string{"cmd.exe", "/Q", "/C"}
 )
+
+func defaultClientConfigFile() string {
+	return defaultClientConfigFileWindows()
+}

cmd/tier.go

@@ -1,374 +0,0 @@
-//go:build !noserver
-
-package cmd
-
-import (
-	"errors"
-	"fmt"
-	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
-)
-
-func init() {
-	commands = append(commands, cmdTier)
-}
-
-const (
-	defaultMessageLimit             = 5000
-	defaultMessageExpiryDuration    = "12h"
-	defaultEmailLimit               = 20
-	defaultCallLimit                = 0
-	defaultReservationLimit         = 3
-	defaultAttachmentFileSizeLimit  = "15M"
-	defaultAttachmentTotalSizeLimit = "100M"
-	defaultAttachmentExpiryDuration = "6h"
-	defaultAttachmentBandwidthLimit = "1G"
-)
-
-var (
-	flagsTier = append([]cli.Flag{}, flagsUser...)
-)
-
-var cmdTier = &cli.Command{
-	Name:      "tier",
-	Usage:     "Manage/show tiers",
-	UsageText: "ntfy tier [list|add|change|remove] ...",
-	Flags:     flagsTier,
-	Before:    initConfigFileInputSourceFunc("config", flagsUser, initLogFunc),
-	Category:  categoryServer,
-	Subcommands: []*cli.Command{
-		{
-			Name:      "add",
-			Aliases:   []string{"a"},
-			Usage:     "Adds a new tier",
-			UsageText: "ntfy tier add [OPTIONS] CODE",
-			Action:    execTierAdd,
-			Flags: []cli.Flag{
-				&cli.StringFlag{Name: "name", Usage: "tier name"},
-				&cli.Int64Flag{Name: "message-limit", Value: defaultMessageLimit, Usage: "daily message limit"},
-				&cli.StringFlag{Name: "message-expiry-duration", Value: defaultMessageExpiryDuration, Usage: "duration after which messages are deleted"},
-				&cli.Int64Flag{Name: "email-limit", Value: defaultEmailLimit, Usage: "daily email limit"},
-				&cli.Int64Flag{Name: "call-limit", Value: defaultCallLimit, Usage: "daily phone call limit"},
-				&cli.Int64Flag{Name: "reservation-limit", Value: defaultReservationLimit, Usage: "topic reservation limit"},
-				&cli.StringFlag{Name: "attachment-file-size-limit", Value: defaultAttachmentFileSizeLimit, Usage: "per-attachment file size limit"},
-				&cli.StringFlag{Name: "attachment-total-size-limit", Value: defaultAttachmentTotalSizeLimit, Usage: "total size limit of attachments for the user"},
-				&cli.StringFlag{Name: "attachment-expiry-duration", Value: defaultAttachmentExpiryDuration, Usage: "duration after which attachments are deleted"},
-				&cli.StringFlag{Name: "attachment-bandwidth-limit", Value: defaultAttachmentBandwidthLimit, Usage: "daily bandwidth limit for attachment uploads/downloads"},
-				&cli.StringFlag{Name: "stripe-monthly-price-id", Usage: "Monthly Stripe price ID for paid tiers (e.g. price_12345)"},
-				&cli.StringFlag{Name: "stripe-yearly-price-id", Usage: "Yearly Stripe price ID for paid tiers (e.g. price_12345)"},
-				&cli.BoolFlag{Name: "ignore-exists", Usage: "if the tier already exists, perform no action and exit"},
-			},
-			Description: `Add a new tier to the ntfy user database.
-
-Tiers can be used to grant users higher limits, such as daily message limits, attachment size, or
-make it possible for users to reserve topics.
-
-This is a server-only command. It directly reads from user.db as defined in the server config
-file server.yml. The command only works if 'auth-file' is properly defined.
-
-Examples:
-  ntfy tier add pro                     # Add tier with code "pro", using the defaults
-  ntfy tier add \                       # Add a tier with custom limits
-    --name="Pro" \
-    --message-limit=10000 \
-    --message-expiry-duration=24h \
-    --email-limit=50 \
-    --reservation-limit=10 \
-    --attachment-file-size-limit=100M \
-    --attachment-total-size-limit=1G \
-    --attachment-expiry-duration=12h \
-    --attachment-bandwidth-limit=5G \
-    pro
-`,
-		},
-		{
-			Name:      "change",
-			Aliases:   []string{"ch"},
-			Usage:     "Change a tier",
-			UsageText: "ntfy tier change [OPTIONS] CODE",
-			Action:    execTierChange,
-			Flags: []cli.Flag{
-				&cli.StringFlag{Name: "name", Usage: "tier name"},
-				&cli.Int64Flag{Name: "message-limit", Usage: "daily message limit"},
-				&cli.StringFlag{Name: "message-expiry-duration", Usage: "duration after which messages are deleted"},
-				&cli.Int64Flag{Name: "email-limit", Usage: "daily email limit"},
-				&cli.Int64Flag{Name: "call-limit", Usage: "daily phone call limit"},
-				&cli.Int64Flag{Name: "reservation-limit", Usage: "topic reservation limit"},
-				&cli.StringFlag{Name: "attachment-file-size-limit", Usage: "per-attachment file size limit"},
-				&cli.StringFlag{Name: "attachment-total-size-limit", Usage: "total size limit of attachments for the user"},
-				&cli.StringFlag{Name: "attachment-expiry-duration", Usage: "duration after which attachments are deleted"},
-				&cli.StringFlag{Name: "attachment-bandwidth-limit", Usage: "daily bandwidth limit for attachment uploads/downloads"},
-				&cli.StringFlag{Name: "stripe-monthly-price-id", Usage: "Monthly Stripe price ID for paid tiers (e.g. price_12345)"},
-				&cli.StringFlag{Name: "stripe-yearly-price-id", Usage: "Yearly Stripe price ID for paid tiers (e.g. price_12345)"},
-			},
-			Description: `Updates a tier to change the limits.
-
-After updating a tier, you may have to restart the ntfy server to apply them 
-to all visitors. 
-
-This is a server-only command. It directly reads from user.db as defined in the server config
-file server.yml. The command only works if 'auth-file' is properly defined.
-
-Examples:
-  ntfy tier change --name="Pro" pro        # Update the name of an existing tier
-  ntfy tier change \                       # Update multiple limits and fields
-    --message-expiry-duration=24h \
-    --stripe-monthly-price-id=price_1234 \
-    --stripe-monthly-price-id=price_5678 \
-    pro
-`,
-		},
-		{
-			Name:      "remove",
-			Aliases:   []string{"del", "rm"},
-			Usage:     "Removes a tier",
-			UsageText: "ntfy tier remove CODE",
-			Action:    execTierDel,
-			Description: `Remove a tier from the ntfy user database.
-
-You cannot remove a tier if there are users associated with a tier. Use "ntfy user change-tier"
-to remove or switch their tier first.
-
-This is a server-only command. It directly reads from user.db as defined in the server config
-file server.yml. The command only works if 'auth-file' is properly defined.
-
-Example:
-  ntfy tier del pro
-`,
-		},
-		{
-			Name:    "list",
-			Aliases: []string{"l"},
-			Usage:   "Shows a list of tiers",
-			Action:  execTierList,
-			Description: `Shows a list of all configured tiers.
-
-This is a server-only command. It directly reads from user.db as defined in the server config
-file server.yml. The command only works if 'auth-file' is properly defined.
-`,
-		},
-	},
-	Description: `Manage tiers of the ntfy server.
-
-The command allows you to add/remove/change tiers in the ntfy user database. Tiers are used
-to grant users higher limits, such as daily message limits, attachment size, or make it 
-possible for users to reserve topics.
-
-This is a server-only command. It directly manages the user.db as defined in the server config
-file server.yml. The command only works if 'auth-file' is properly defined.
-
-Examples:
-  ntfy tier add pro                     # Add tier with code "pro", using the defaults
-  ntfy tier change --name="Pro" pro     # Update the name of an existing tier
-  ntfy tier del pro                     # Delete an existing tier
-`,
-}
-
-func execTierAdd(c *cli.Context) error {
-	code := c.Args().Get(0)
-	if code == "" {
-		return errors.New("tier code expected, type 'ntfy tier add --help' for help")
-	} else if !user.AllowedTier(code) {
-		return errors.New("tier code must consist only of numbers and letters")
-	} else if c.String("stripe-monthly-price-id") != "" && c.String("stripe-yearly-price-id") == "" {
-		return errors.New("if stripe-monthly-price-id is set, stripe-yearly-price-id must also be set")
-	} else if c.String("stripe-monthly-price-id") == "" && c.String("stripe-yearly-price-id") != "" {
-		return errors.New("if stripe-yearly-price-id is set, stripe-monthly-price-id must also be set")
-	}
-	manager, err := createUserManager(c)
-	if err != nil {
-		return err
-	}
-	if tier, _ := manager.Tier(code); tier != nil {
-		if c.Bool("ignore-exists") {
-			fmt.Fprintf(c.App.Writer, "tier %s already exists (exited successfully)\n", code)
-			return nil
-		}
-		return fmt.Errorf("tier %s already exists", code)
-	}
-	name := c.String("name")
-	if name == "" {
-		name = code
-	}
-	messageExpiryDuration, err := util.ParseDuration(c.String("message-expiry-duration"))
-	if err != nil {
-		return err
-	}
-	attachmentFileSizeLimit, err := util.ParseSize(c.String("attachment-file-size-limit"))
-	if err != nil {
-		return err
-	}
-	attachmentTotalSizeLimit, err := util.ParseSize(c.String("attachment-total-size-limit"))
-	if err != nil {
-		return err
-	}
-	attachmentBandwidthLimit, err := util.ParseSize(c.String("attachment-bandwidth-limit"))
-	if err != nil {
-		return err
-	}
-	attachmentExpiryDuration, err := util.ParseDuration(c.String("attachment-expiry-duration"))
-	if err != nil {
-		return err
-	}
-	tier := &user.Tier{
-		ID:                       "", // Generated
-		Code:                     code,
-		Name:                     name,
-		MessageLimit:             c.Int64("message-limit"),
-		MessageExpiryDuration:    messageExpiryDuration,
-		EmailLimit:               c.Int64("email-limit"),
-		CallLimit:                c.Int64("call-limit"),
-		ReservationLimit:         c.Int64("reservation-limit"),
-		AttachmentFileSizeLimit:  attachmentFileSizeLimit,
-		AttachmentTotalSizeLimit: attachmentTotalSizeLimit,
-		AttachmentExpiryDuration: attachmentExpiryDuration,
-		AttachmentBandwidthLimit: attachmentBandwidthLimit,
-		StripeMonthlyPriceID:     c.String("stripe-monthly-price-id"),
-		StripeYearlyPriceID:      c.String("stripe-yearly-price-id"),
-	}
-	if err := manager.AddTier(tier); err != nil {
-		return err
-	}
-	tier, err = manager.Tier(code)
-	if err != nil {
-		return err
-	}
-	fmt.Fprintf(c.App.Writer, "tier added\n\n")
-	printTier(c, tier)
-	return nil
-}
-
-func execTierChange(c *cli.Context) error {
-	code := c.Args().Get(0)
-	if code == "" {
-		return errors.New("tier code expected, type 'ntfy tier change --help' for help")
-	} else if !user.AllowedTier(code) {
-		return errors.New("tier code must consist only of numbers and letters")
-	}
-	manager, err := createUserManager(c)
-	if err != nil {
-		return err
-	}
-	tier, err := manager.Tier(code)
-	if err == user.ErrTierNotFound {
-		return fmt.Errorf("tier %s does not exist", code)
-	} else if err != nil {
-		return err
-	}
-	if c.IsSet("name") {
-		tier.Name = c.String("name")
-	}
-	if c.IsSet("message-limit") {
-		tier.MessageLimit = c.Int64("message-limit")
-	}
-	if c.IsSet("message-expiry-duration") {
-		tier.MessageExpiryDuration, err = util.ParseDuration(c.String("message-expiry-duration"))
-		if err != nil {
-			return err
-		}
-	}
-	if c.IsSet("email-limit") {
-		tier.EmailLimit = c.Int64("email-limit")
-	}
-	if c.IsSet("call-limit") {
-		tier.CallLimit = c.Int64("call-limit")
-	}
-	if c.IsSet("reservation-limit") {
-		tier.ReservationLimit = c.Int64("reservation-limit")
-	}
-	if c.IsSet("attachment-file-size-limit") {
-		tier.AttachmentFileSizeLimit, err = util.ParseSize(c.String("attachment-file-size-limit"))
-		if err != nil {
-			return err
-		}
-	}
-	if c.IsSet("attachment-total-size-limit") {
-		tier.AttachmentTotalSizeLimit, err = util.ParseSize(c.String("attachment-total-size-limit"))
-		if err != nil {
-			return err
-		}
-	}
-	if c.IsSet("attachment-expiry-duration") {
-		tier.AttachmentExpiryDuration, err = util.ParseDuration(c.String("attachment-expiry-duration"))
-		if err != nil {
-			return err
-		}
-	}
-	if c.IsSet("attachment-bandwidth-limit") {
-		tier.AttachmentBandwidthLimit, err = util.ParseSize(c.String("attachment-bandwidth-limit"))
-		if err != nil {
-			return err
-		}
-	}
-	if c.IsSet("stripe-monthly-price-id") {
-		tier.StripeMonthlyPriceID = c.String("stripe-monthly-price-id")
-	}
-	if c.IsSet("stripe-yearly-price-id") {
-		tier.StripeYearlyPriceID = c.String("stripe-yearly-price-id")
-	}
-	if tier.StripeMonthlyPriceID != "" && tier.StripeYearlyPriceID == "" {
-		return errors.New("if stripe-monthly-price-id is set, stripe-yearly-price-id must also be set")
-	} else if tier.StripeMonthlyPriceID == "" && tier.StripeYearlyPriceID != "" {
-		return errors.New("if stripe-yearly-price-id is set, stripe-monthly-price-id must also be set")
-	}
-	if err := manager.UpdateTier(tier); err != nil {
-		return err
-	}
-	fmt.Fprintf(c.App.Writer, "tier updated\n\n")
-	printTier(c, tier)
-	return nil
-}
-
-func execTierDel(c *cli.Context) error {
-	code := c.Args().Get(0)
-	if code == "" {
-		return errors.New("tier code expected, type 'ntfy tier del --help' for help")
-	}
-	manager, err := createUserManager(c)
-	if err != nil {
-		return err
-	}
-	if _, err := manager.Tier(code); err == user.ErrTierNotFound {
-		return fmt.Errorf("tier %s does not exist", code)
-	}
-	if err := manager.RemoveTier(code); err != nil {
-		return err
-	}
-	fmt.Fprintf(c.App.Writer, "tier %s removed\n", code)
-	return nil
-}
-
-func execTierList(c *cli.Context) error {
-	manager, err := createUserManager(c)
-	if err != nil {
-		return err
-	}
-	tiers, err := manager.Tiers()
-	if err != nil {
-		return err
-	}
-	for _, tier := range tiers {
-		printTier(c, tier)
-	}
-	return nil
-}
-
-func printTier(c *cli.Context, tier *user.Tier) {
-	prices := "(none)"
-	if tier.StripeMonthlyPriceID != "" && tier.StripeYearlyPriceID != "" {
-		prices = fmt.Sprintf("%s / %s", tier.StripeMonthlyPriceID, tier.StripeYearlyPriceID)
-	}
-	fmt.Fprintf(c.App.Writer, "tier %s (id: %s)\n", tier.Code, tier.ID)
-	fmt.Fprintf(c.App.Writer, "- Name: %s\n", tier.Name)
-	fmt.Fprintf(c.App.Writer, "- Message limit: %d\n", tier.MessageLimit)
-	fmt.Fprintf(c.App.Writer, "- Message expiry duration: %s (%d seconds)\n", tier.MessageExpiryDuration.String(), int64(tier.MessageExpiryDuration.Seconds()))
-	fmt.Fprintf(c.App.Writer, "- Email limit: %d\n", tier.EmailLimit)
-	fmt.Fprintf(c.App.Writer, "- Phone call limit: %d\n", tier.CallLimit)
-	fmt.Fprintf(c.App.Writer, "- Reservation limit: %d\n", tier.ReservationLimit)
-	fmt.Fprintf(c.App.Writer, "- Attachment file size limit: %s\n", util.FormatSizeHuman(tier.AttachmentFileSizeLimit))
-	fmt.Fprintf(c.App.Writer, "- Attachment total size limit: %s\n", util.FormatSizeHuman(tier.AttachmentTotalSizeLimit))
-	fmt.Fprintf(c.App.Writer, "- Attachment expiry duration: %s (%d seconds)\n", tier.AttachmentExpiryDuration.String(), int64(tier.AttachmentExpiryDuration.Seconds()))
-	fmt.Fprintf(c.App.Writer, "- Attachment daily bandwidth limit: %s\n", util.FormatSizeHuman(tier.AttachmentBandwidthLimit))
-	fmt.Fprintf(c.App.Writer, "- Stripe prices (monthly/yearly): %s\n", prices)
-}

cmd/tier_test.go

@@ -1,67 +0,0 @@
-package cmd
-
-import (
-	"github.com/stretchr/testify/require"
-	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/server"
-	"heckel.io/ntfy/v2/test"
-	"testing"
-)
-
-func TestCLI_Tier_AddListChangeDelete(t *testing.T) {
-	s, conf, port := newTestServerWithAuth(t)
-	defer test.StopServer(t, s, port)
-
-	app, _, stdout, _ := newTestApp()
-	require.Nil(t, runTierCommand(app, conf, "add", "--name", "Pro", "--message-limit", "1234", "pro"))
-	require.Contains(t, stdout.String(), "tier added\n\ntier pro (id: ti_")
-
-	err := runTierCommand(app, conf, "add", "pro")
-	require.NotNil(t, err)
-	require.Equal(t, "tier pro already exists", err.Error())
-
-	app, _, stdout, _ = newTestApp()
-	require.Nil(t, runTierCommand(app, conf, "list"))
-	require.Contains(t, stdout.String(), "tier pro (id: ti_")
-	require.Contains(t, stdout.String(), "- Name: Pro")
-	require.Contains(t, stdout.String(), "- Message limit: 1234")
-
-	app, _, stdout, _ = newTestApp()
-	require.Nil(t, runTierCommand(app, conf, "change",
-		"--message-limit=999",
-		"--message-expiry-duration=2d",
-		"--email-limit=91",
-		"--reservation-limit=98",
-		"--attachment-file-size-limit=100m",
-		"--attachment-expiry-duration=1d",
-		"--attachment-total-size-limit=10G",
-		"--attachment-bandwidth-limit=100G",
-		"--stripe-monthly-price-id=price_991",
-		"--stripe-yearly-price-id=price_992",
-		"pro",
-	))
-	require.Contains(t, stdout.String(), "- Message limit: 999")
-	require.Contains(t, stdout.String(), "- Message expiry duration: 48h")
-	require.Contains(t, stdout.String(), "- Email limit: 91")
-	require.Contains(t, stdout.String(), "- Reservation limit: 98")
-	require.Contains(t, stdout.String(), "- Attachment file size limit: 100.0 MB")
-	require.Contains(t, stdout.String(), "- Attachment expiry duration: 24h")
-	require.Contains(t, stdout.String(), "- Attachment total size limit: 10.0 GB")
-	require.Contains(t, stdout.String(), "- Stripe prices (monthly/yearly): price_991 / price_992")
-
-	app, _, stdout, _ = newTestApp()
-	require.Nil(t, runTierCommand(app, conf, "remove", "pro"))
-	require.Contains(t, stdout.String(), "tier pro removed")
-}
-
-func runTierCommand(app *cli.App, conf *server.Config, args ...string) error {
-	userArgs := []string{
-		"ntfy",
-		"--log-level=ERROR",
-		"tier",
-		"--config=" + conf.File, // Dummy config file to avoid lookups of real file
-		"--auth-file=" + conf.AuthFile,
-		"--auth-default-access=" + conf.AuthDefault.String(),
-	}
-	return app.Run(append(userArgs, args...))
-}

cmd/token.go

@@ -1,227 +0,0 @@
-//go:build !noserver
-
-package cmd
-
-import (
-	"errors"
-	"fmt"
-	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
-	"net/netip"
-	"time"
-)
-
-func init() {
-	commands = append(commands, cmdToken)
-}
-
-var flagsToken = append([]cli.Flag{}, flagsUser...)
-
-var cmdToken = &cli.Command{
-	Name:      "token",
-	Usage:     "Create, list or delete user tokens",
-	UsageText: "ntfy token [list|add|remove] ...",
-	Flags:     flagsToken,
-	Before:    initConfigFileInputSourceFunc("config", flagsToken, initLogFunc),
-	Category:  categoryServer,
-	Subcommands: []*cli.Command{
-		{
-			Name:      "add",
-			Aliases:   []string{"a"},
-			Usage:     "Create a new token",
-			UsageText: "ntfy token add [--expires=<duration>] [--label=..] USERNAME",
-			Action:    execTokenAdd,
-			Flags: []cli.Flag{
-				&cli.StringFlag{Name: "expires", Aliases: []string{"e"}, Value: "", Usage: "token expires after"},
-				&cli.StringFlag{Name: "label", Aliases: []string{"l"}, Value: "", Usage: "token label"},
-			},
-			Description: `Create a new user access token.
-
-User access tokens can be used to publish, subscribe, or perform any other user-specific tasks.
-Tokens have full access, and can perform any task a user can do. They are meant to be used to 
-avoid spreading the password to various places.
-
-This is a server-only command. It directly reads from user.db as defined in the server config
-file server.yml. The command only works if 'auth-file' is properly defined.
-
-Examples:
-  ntfy token add phil                   # Create token for user phil which never expires
-  ntfy token add --expires=2d phil      # Create token for user phil which expires in 2 days
-  ntfy token add -e "tuesday, 8pm" phil # Create token for user phil which expires next Tuesday
-  ntfy token add -l backups phil        # Create token for user phil with label "backups"`,
-		},
-		{
-			Name:      "remove",
-			Aliases:   []string{"del", "rm"},
-			Usage:     "Removes a token",
-			UsageText: "ntfy token remove USERNAME TOKEN",
-			Action:    execTokenDel,
-			Description: `Remove a token from the ntfy user database.
-
-Example:
-  ntfy token del phil tk_th2srHVlxrANQHAso5t0HuQ1J1TjN`,
-		},
-		{
-			Name:    "list",
-			Aliases: []string{"l"},
-			Usage:   "Shows a list of tokens",
-			Action:  execTokenList,
-			Description: `Shows a list of all tokens.
-
-This is a server-only command. It directly reads from user.db as defined in the server config
-file server.yml. The command only works if 'auth-file' is properly defined.`,
-		},
-		{
-			Name:   "generate",
-			Usage:  "Generates a random token",
-			Action: execTokenGenerate,
-			Description: `Randomly generate a token to be used in provisioned tokens.
-
-This command only generates the token value, but does not persist it anywhere.
-The output can be used in the 'auth-tokens' config option.`,
-		},
-	},
-	Description: `Manage access tokens for individual users.
-
-User access tokens can be used to publish, subscribe, or perform any other user-specific tasks.
-Tokens have full access, and can perform any task a user can do. They are meant to be used to 
-avoid spreading the password to various places.
-
-This is a server-only command. It directly manages the user.db as defined in the server config
-file server.yml. The command only works if 'auth-file' is properly defined.
-
-Examples:
-  ntfy token list                               # Shows list of tokens for all users
-  ntfy token list phil                          # Shows list of tokens for user phil
-  ntfy token add phil                           # Create token for user phil which never expires
-  ntfy token add --expires=2d phil              # Create token for user phil which expires in 2 days
-  ntfy token remove phil tk_th2srHVlxr...       # Delete token`,
-}
-
-func execTokenAdd(c *cli.Context) error {
-	username := c.Args().Get(0)
-	expiresStr := c.String("expires")
-	label := c.String("label")
-	if username == "" {
-		return errors.New("username expected, type 'ntfy token add --help' for help")
-	} else if username == userEveryone || username == user.Everyone {
-		return errors.New("username not allowed")
-	}
-	expires := time.Unix(0, 0)
-	if expiresStr != "" {
-		var err error
-		expires, err = util.ParseFutureTime(expiresStr, time.Now())
-		if err != nil {
-			return err
-		}
-	}
-	manager, err := createUserManager(c)
-	if err != nil {
-		return err
-	}
-	u, err := manager.User(username)
-	if errors.Is(err, user.ErrUserNotFound) {
-		return fmt.Errorf("user %s does not exist", username)
-	} else if err != nil {
-		return err
-	}
-	token, err := manager.CreateToken(u.ID, label, expires, netip.IPv4Unspecified(), false)
-	if err != nil {
-		return err
-	}
-	if expires.Unix() == 0 {
-		fmt.Fprintf(c.App.Writer, "token %s created for user %s, never expires\n", token.Value, u.Name)
-	} else {
-		fmt.Fprintf(c.App.Writer, "token %s created for user %s, expires %v\n", token.Value, u.Name, expires.Format(time.UnixDate))
-	}
-	return nil
-}
-
-func execTokenDel(c *cli.Context) error {
-	username, token := c.Args().Get(0), c.Args().Get(1)
-	if username == "" || token == "" {
-		return errors.New("username and token expected, type 'ntfy token remove --help' for help")
-	} else if username == userEveryone || username == user.Everyone {
-		return errors.New("username not allowed")
-	}
-	manager, err := createUserManager(c)
-	if err != nil {
-		return err
-	}
-	u, err := manager.User(username)
-	if errors.Is(err, user.ErrUserNotFound) {
-		return fmt.Errorf("user %s does not exist", username)
-	} else if err != nil {
-		return err
-	}
-	if err := manager.RemoveToken(u.ID, token); err != nil {
-		return err
-	}
-	fmt.Fprintf(c.App.Writer, "token %s for user %s removed\n", token, username)
-	return nil
-}
-
-func execTokenList(c *cli.Context) error {
-	username := c.Args().Get(0)
-	if username == userEveryone || username == user.Everyone {
-		return errors.New("username not allowed")
-	}
-	manager, err := createUserManager(c)
-	if err != nil {
-		return err
-	}
-	var users []*user.User
-	if username != "" {
-		u, err := manager.User(username)
-		if errors.Is(err, user.ErrUserNotFound) {
-			return fmt.Errorf("user %s does not exist", username)
-		} else if err != nil {
-			return err
-		}
-		users = append(users, u)
-	} else {
-		users, err = manager.Users()
-		if err != nil {
-			return err
-		}
-	}
-	usersWithTokens := 0
-	for _, u := range users {
-		tokens, err := manager.Tokens(u.ID)
-		if err != nil {
-			return err
-		} else if len(tokens) == 0 && username != "" {
-			fmt.Fprintf(c.App.Writer, "user %s has no access tokens\n", username)
-			return nil
-		} else if len(tokens) == 0 {
-			continue
-		}
-		usersWithTokens++
-		fmt.Fprintf(c.App.Writer, "user %s\n", u.Name)
-		for _, t := range tokens {
-			var label, expires, provisioned string
-			if t.Label != "" {
-				label = fmt.Sprintf(" (%s)", t.Label)
-			}
-			if t.Expires.Unix() == 0 {
-				expires = "never expires"
-			} else {
-				expires = fmt.Sprintf("expires %s", t.Expires.Format(time.RFC822))
-			}
-			if t.Provisioned {
-				provisioned = " (server config)"
-			}
-			fmt.Fprintf(c.App.Writer, "- %s%s, %s, accessed from %s at %s%s\n", t.Value, label, expires, t.LastOrigin.String(), t.LastAccess.Format(time.RFC822), provisioned)
-		}
-	}
-	if usersWithTokens == 0 {
-		fmt.Fprintf(c.App.Writer, "no users with tokens\n")
-	}
-	return nil
-}
-
-func execTokenGenerate(c *cli.Context) error {
-	fmt.Fprintln(c.App.Writer, user.GenerateToken())
-	return nil
-}

cmd/token_test.go

@@ -1,50 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"github.com/stretchr/testify/require"
-	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/server"
-	"heckel.io/ntfy/v2/test"
-	"regexp"
-	"testing"
-)
-
-func TestCLI_Token_AddListRemove(t *testing.T) {
-	s, conf, port := newTestServerWithAuth(t)
-	defer test.StopServer(t, s, port)
-
-	app, stdin, stdout, _ := newTestApp()
-	stdin.WriteString("mypass\nmypass")
-	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role user")
-
-	app, _, stdout, _ = newTestApp()
-	require.Nil(t, runTokenCommand(app, conf, "add", "phil"))
-	require.Regexp(t, `token tk_.+ created for user phil, never expires`, stdout.String())
-
-	app, _, stdout, _ = newTestApp()
-	require.Nil(t, runTokenCommand(app, conf, "list", "phil"))
-	require.Regexp(t, `user phil\n- tk_.+, never expires, accessed from 0.0.0.0 at .+`, stdout.String())
-	re := regexp.MustCompile(`tk_\w+`)
-	token := re.FindString(stdout.String())
-
-	app, _, stdout, _ = newTestApp()
-	require.Nil(t, runTokenCommand(app, conf, "remove", "phil", token))
-	require.Regexp(t, fmt.Sprintf("token %s for user phil removed", token), stdout.String())
-
-	app, _, stdout, _ = newTestApp()
-	require.Nil(t, runTokenCommand(app, conf, "list"))
-	require.Equal(t, "no users with tokens\n", stdout.String())
-}
-
-func runTokenCommand(app *cli.App, conf *server.Config, args ...string) error {
-	userArgs := []string{
-		"ntfy",
-		"--log-level=ERROR",
-		"token",
-		"--config=" + conf.File, // Dummy config file to avoid lookups of real file
-		"--auth-file=" + conf.AuthFile,
-	}
-	return app.Run(append(userArgs, args...))
-}

cmd/user.go

@@ -8,20 +8,11 @@ import (
 	"fmt"
 	"os"
 	"strings"
-	"time"
 
 	"github.com/urfave/cli/v2"
 	"github.com/urfave/cli/v2/altsrc"
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/db/pg"
-	"heckel.io/ntfy/v2/mail"
-	"heckel.io/ntfy/v2/server"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
-)
-
-const (
-	tierReset = "-"
+	"heckel.io/ntfy/auth"
+	"heckel.io/ntfy/util"
 )
 
 func init() {
@@ -29,22 +20,16 @@ func init() {
 }
 
 var flagsUser = append(
-	append([]cli.Flag{}, flagsDefault...),
-	&cli.StringFlag{Name: "config", Aliases: []string{"c"}, EnvVars: []string{"NTFY_CONFIG_FILE"}, Value: server.DefaultConfigFile, DefaultText: server.DefaultConfigFile, Usage: "config file"},
+	flagsDefault,
+	&cli.StringFlag{Name: "config", Aliases: []string{"c"}, EnvVars: []string{"NTFY_CONFIG_FILE"}, Value: defaultServerConfigFile, DefaultText: defaultServerConfigFile, Usage: "config file"},
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "auth-file", Aliases: []string{"auth_file", "H"}, EnvVars: []string{"NTFY_AUTH_FILE"}, Usage: "auth database file used for access control"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "auth-default-access", Aliases: []string{"auth_default_access", "p"}, EnvVars: []string{"NTFY_AUTH_DEFAULT_ACCESS"}, Value: "read-write", Usage: "default permissions if no matching entries in the auth database are found"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "database-url", Aliases: []string{"database_url"}, EnvVars: []string{"NTFY_DATABASE_URL"}, Usage: "PostgreSQL connection string for database-backed stores"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "base-url", Aliases: []string{"base_url", "B"}, EnvVars: []string{"NTFY_BASE_URL"}, Usage: "externally visible base URL for this host (e.g. https://ntfy.sh)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-addr", Aliases: []string{"smtp_sender_addr"}, EnvVars: []string{"NTFY_SMTP_SENDER_ADDR"}, Usage: "SMTP server address (host:port) for outgoing emails"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-user", Aliases: []string{"smtp_sender_user"}, EnvVars: []string{"NTFY_SMTP_SENDER_USER"}, Usage: "SMTP user (if e-mail sending is enabled)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-pass", Aliases: []string{"smtp_sender_pass"}, EnvVars: []string{"NTFY_SMTP_SENDER_PASS"}, Usage: "SMTP password (if e-mail sending is enabled)"}),
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-from", Aliases: []string{"smtp_sender_from"}, EnvVars: []string{"NTFY_SMTP_SENDER_FROM"}, Usage: "SMTP sender address (if e-mail sending is enabled)"}),
 )
 
 var cmdUser = &cli.Command{
 	Name:      "user",
 	Usage:     "Manage/show users",
-	UsageText: "ntfy user [list|add|remove|change-pass|reset-pass|change-role] ...",
+	UsageText: "ntfy user [list|add|remove|change-pass|change-role] ...",
 	Flags:     flagsUser,
 	Before:    initConfigFileInputSourceFunc("config", flagsUser, initLogFunc),
 	Category:  categoryServer,
@@ -53,11 +38,10 @@ var cmdUser = &cli.Command{
 			Name:      "add",
 			Aliases:   []string{"a"},
 			Usage:     "Adds a new user",
-			UsageText: "ntfy user add [--role=admin|user] USERNAME\nNTFY_PASSWORD=... ntfy user add [--role=admin|user] USERNAME\nNTFY_PASSWORD_HASH=... ntfy user add [--role=admin|user] USERNAME",
+			UsageText: "ntfy user add [--role=admin|user] USERNAME\nNTFY_PASSWORD=... ntfy user add [--role=admin|user] USERNAME",
 			Action:    execUserAdd,
 			Flags: []cli.Flag{
-				&cli.StringFlag{Name: "role", Aliases: []string{"r"}, Value: string(user.RoleUser), Usage: "user role"},
-				&cli.BoolFlag{Name: "ignore-exists", Usage: "if the user already exists, perform no action and exit"},
+				&cli.StringFlag{Name: "role", Aliases: []string{"r"}, Value: string(auth.RoleUser), Usage: "user role"},
 			},
 			Description: `Add a new user to the ntfy user database.
 
@@ -66,13 +50,12 @@ granted otherwise by the auth-default-access setting). An admin user has read an
 topics.
 
 Examples:
-  ntfy user add phil                          # Add regular user phil
-  ntfy user add --role=admin phil             # Add admin user phil
-  NTFY_PASSWORD=... ntfy user add phil        # Add user, using env variable to set password (for scripts)
-  NTFY_PASSWORD_HASH=... ntfy user add phil   # Add user, using env variable to set password hash (for scripts)
+  ntfy user add phil                     # Add regular user phil  
+  ntfy user add --role=admin phil        # Add admin user phil
+  NTFY_PASSWORD=... ntfy user add phil   # Add user, using env variable to set password (for scripts)
 
-You may set the NTFY_PASSWORD environment variable to pass the password, or NTFY_PASSWORD_HASH to pass
-directly the bcrypt hash. This is useful if you are creating users via scripts.
+You may set the NTFY_PASSWORD environment variable to pass the password. This is useful if 
+you are creating users via scripts.
 `,
 		},
 		{
@@ -91,7 +74,7 @@ Example:
 			Name:      "change-pass",
 			Aliases:   []string{"chp"},
 			Usage:     "Changes a user's password",
-			UsageText: "ntfy user change-pass USERNAME\nNTFY_PASSWORD=... ntfy user change-pass USERNAME\nNTFY_PASSWORD_HASH=... ntfy user change-pass USERNAME",
+			UsageText: "ntfy user change-pass USERNAME\nNTFY_PASSWORD=... ntfy user change-pass USERNAME",
 			Action:    execUserChangePass,
 			Description: `Change the password for the given user.
 
@@ -101,34 +84,10 @@ it twice.
 Example:
   ntfy user change-pass phil
   NTFY_PASSWORD=.. ntfy user change-pass phil
-  NTFY_PASSWORD_HASH=.. ntfy user change-pass phil
 
-You may set the NTFY_PASSWORD environment variable to pass the new password or NTFY_PASSWORD_HASH to pass
-directly the bcrypt hash. This is useful if you are updating users via scripts.
-`,
-		},
-		{
-			Name:      "reset-pass",
-			Aliases:   []string{"rp"},
-			Usage:     "Generates a password reset link for a user",
-			UsageText: "ntfy user reset-pass [--send-email] USERNAME",
-			Action:    execUserResetPass,
-			Flags: []cli.Flag{
-				&cli.BoolFlag{Name: "send-email", Aliases: []string{"e"}, Usage: "also email the reset link to the user's primary email"},
-			},
-			Description: `Generate a password reset link for the given user and print it to stdout.
+You may set the NTFY_PASSWORD environment variable to pass the new password. This is 
+useful if you are updating users via scripts.
 
-The user completes the reset by opening the link in a browser and choosing a new password;
-the admin never learns or chooses the new password. The link is single-use and expires after
-one hour. This is an admin override of the self-service reset flow -- unlike self-service, it
-does not require the user to have a verified primary email (the token is bound to the user).
-
-With --send-email, the link is additionally emailed to the user's primary email address (this
-requires SMTP to be configured and the user to have a verified primary email).
-
-Example:
-  ntfy user reset-pass phil               # Print a reset link for user phil
-  ntfy user reset-pass --send-email phil  # Print and email the reset link
 `,
 		},
 		{
@@ -151,38 +110,6 @@ user are removed, since they are no longer necessary.
 Example:
   ntfy user change-role phil admin   # Make user phil an admin 
   ntfy user change-role phil user    # Remove admin role from user phil 
-`,
-		},
-		{
-			Name:      "change-tier",
-			Aliases:   []string{"cht"},
-			Usage:     "Changes the tier of a user",
-			UsageText: "ntfy user change-tier USERNAME (TIER|-)",
-			Action:    execUserChangeTier,
-			Description: `Change the tier for the given user.
-
-This command can be used to change the tier of a user. Tiers define usage limits, such
-as messages per day, attachment file sizes, etc.
-
-Example:
-  ntfy user change-tier phil pro   # Change tier to "pro" for user "phil"  
-  ntfy user change-tier phil -     # Remove tier from user "phil" entirely 
-`,
-		},
-		{
-			Name:      "hash",
-			Usage:     "Create password hash for a predefined user",
-			UsageText: "ntfy user hash",
-			Action:    execUserHash,
-			Description: `Asks for a password and creates a bcrypt password hash.
-
-This command is useful to create a password hash for a user, which can then be used
-for predefined users in the server config file, in auth-users.
-
-Example:
-  $ ntfy user hash
-  (asks for password and confirmation)
-  $2a$10$YLiO8U21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C
 `,
 		},
 		{
@@ -192,22 +119,22 @@ Example:
 			Action:  execUserList,
 			Description: `Shows a list of all configured users, including the everyone ('*') user.
 
-This command is an alias to calling 'ntfy access' (display access control list).
+This is a server-only command. It directly reads from the user.db as defined in the server config
+file server.yml. The command only works if 'auth-file' is properly defined. 
 
-This is a server-only command. It directly reads from user.db as defined in the server config
-file server.yml. The command only works if 'auth-file' is properly defined.
+This command is an alias to calling 'ntfy access' (display access control list).
 `,
 		},
 	},
 	Description: `Manage users of the ntfy server.
 
-The command allows you to add/remove/change users in the ntfy user database, as well as change 
-passwords or roles.
-
 This is a server-only command. It directly manages the user.db as defined in the server config
 file server.yml. The command only works if 'auth-file' is properly defined. Please also refer
 to the related command 'ntfy access'.
 
+The command allows you to add/remove/change users in the ntfy user database, as well as change 
+passwords or roles.
+
 Examples:
   ntfy user list                               # Shows list of users (alias: 'ntfy access')                      
   ntfy user add phil                           # Add regular user phil  
@@ -225,29 +152,20 @@ variable to pass the new password. This is useful if you are creating/updating u
 
 func execUserAdd(c *cli.Context) error {
 	username := c.Args().Get(0)
-	role := user.Role(c.String("role"))
-	password, hashed := os.LookupEnv("NTFY_PASSWORD_HASH")
-
-	if !hashed {
-		password = os.Getenv("NTFY_PASSWORD")
-	}
-
+	role := auth.Role(c.String("role"))
+	password := os.Getenv("NTFY_PASSWORD")
 	if username == "" {
 		return errors.New("username expected, type 'ntfy user add --help' for help")
-	} else if username == userEveryone || username == user.Everyone {
+	} else if username == userEveryone {
 		return errors.New("username not allowed")
-	} else if !user.AllowedRole(role) {
+	} else if !auth.AllowedRole(role) {
 		return errors.New("role must be either 'user' or 'admin'")
 	}
-	manager, err := createUserManager(c)
+	manager, err := createAuthManager(c)
 	if err != nil {
 		return err
 	}
 	if user, _ := manager.User(username); user != nil {
-		if c.Bool("ignore-exists") {
-			fmt.Fprintf(c.App.Writer, "user %s already exists (exited successfully)\n", username)
-			return nil
-		}
 		return fmt.Errorf("user %s already exists", username)
 	}
 	if password == "" {
@@ -255,12 +173,13 @@ func execUserAdd(c *cli.Context) error {
 		if err != nil {
 			return err
 		}
+
 		password = p
 	}
-	if err := manager.AddUser(username, password, role, hashed); err != nil {
+	if err := manager.AddUser(username, password, role); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "user %s added with role %s\n", username, role)
+	fmt.Fprintf(c.App.ErrWriter, "user %s added with role %s\n", username, role)
 	return nil
 }
 
@@ -268,39 +187,36 @@ func execUserDel(c *cli.Context) error {
 	username := c.Args().Get(0)
 	if username == "" {
 		return errors.New("username expected, type 'ntfy user del --help' for help")
-	} else if username == userEveryone || username == user.Everyone {
+	} else if username == userEveryone {
 		return errors.New("username not allowed")
 	}
-	manager, err := createUserManager(c)
+	manager, err := createAuthManager(c)
 	if err != nil {
 		return err
 	}
-	if _, err := manager.User(username); errors.Is(err, user.ErrUserNotFound) {
+	if _, err := manager.User(username); err == auth.ErrNotFound {
 		return fmt.Errorf("user %s does not exist", username)
 	}
 	if err := manager.RemoveUser(username); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "user %s removed\n", username)
+	fmt.Fprintf(c.App.ErrWriter, "user %s removed\n", username)
 	return nil
 }
 
 func execUserChangePass(c *cli.Context) error {
 	username := c.Args().Get(0)
-	password, hashed := os.LookupEnv("NTFY_PASSWORD_HASH")
-	if !hashed {
-		password = os.Getenv("NTFY_PASSWORD")
-	}
+	password := os.Getenv("NTFY_PASSWORD")
 	if username == "" {
 		return errors.New("username expected, type 'ntfy user change-pass --help' for help")
-	} else if username == userEveryone || username == user.Everyone {
+	} else if username == userEveryone {
 		return errors.New("username not allowed")
 	}
-	manager, err := createUserManager(c)
+	manager, err := createAuthManager(c)
 	if err != nil {
 		return err
 	}
-	if _, err := manager.User(username); errors.Is(err, user.ErrUserNotFound) {
+	if _, err := manager.User(username); err == auth.ErrNotFound {
 		return fmt.Errorf("user %s does not exist", username)
 	}
 	if password == "" {
@@ -309,136 +225,37 @@ func execUserChangePass(c *cli.Context) error {
 			return err
 		}
 	}
-	if err := manager.ChangePassword(username, password, hashed); err != nil {
+	if err := manager.ChangePassword(username, password); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "changed password for user %s\n", username)
-	return nil
-}
-
-func execUserResetPass(c *cli.Context) error {
-	username := c.Args().Get(0)
-	sendEmail := c.Bool("send-email")
-	baseURL := strings.TrimSuffix(c.String("base-url"), "/")
-	if username == "" {
-		return errors.New("username expected, type 'ntfy user reset-pass --help' for help")
-	} else if username == userEveryone || username == user.Everyone {
-		return errors.New("username not allowed")
-	} else if baseURL == "" {
-		return errors.New("base-url must be configured to generate a reset link")
-	}
-	manager, err := createUserManager(c)
-	if err != nil {
-		return err
-	}
-	u, err := manager.User(username)
-	if errors.Is(err, user.ErrUserNotFound) {
-		return fmt.Errorf("user %s does not exist", username)
-	} else if err != nil {
-		return err
-	} else if u.Provisioned {
-		return fmt.Errorf("user %s is provisioned in the config file; its password cannot be reset", username)
-	}
-	// Resolve the primary email up front if we need to send -- fail before creating a token
-	var primaryEmail string
-	if sendEmail {
-		primaryEmail, err = manager.PrimaryEmail(u.ID)
-		if err != nil {
-			return err
-		} else if primaryEmail == "" {
-			return fmt.Errorf("user %s has no primary email; cannot send reset link (omit --send-email to just print it)", username)
-		}
-	}
-	// The reset token is bound to the user, not an email -- so this works even with no SMTP
-	token, err := manager.AddMagicLink(user.MagicLinkKindPasswordReset, u.ID, "", time.Hour)
-	if err != nil {
-		return err
-	}
-	link := baseURL + "/account/password/reset/" + token
-	fmt.Fprintln(c.App.Writer, link)
-	if sendEmail {
-		sender := mail.NewSender(&mail.Config{
-			SMTPAddr: c.String("smtp-sender-addr"),
-			SMTPUser: c.String("smtp-sender-user"),
-			SMTPPass: c.String("smtp-sender-pass"),
-			From:     c.String("smtp-sender-from"),
-		})
-		if err := sender.SendPasswordReset(primaryEmail, link); err != nil {
-			return fmt.Errorf("failed to send reset email to %s: %w", primaryEmail, err)
-		}
-		fmt.Fprintf(c.App.ErrWriter, "reset link emailed to %s\n", primaryEmail)
-	}
+	fmt.Fprintf(c.App.ErrWriter, "changed password for user %s\n", username)
 	return nil
 }
 
 func execUserChangeRole(c *cli.Context) error {
 	username := c.Args().Get(0)
-	role := user.Role(c.Args().Get(1))
-	if username == "" || !user.AllowedRole(role) {
+	role := auth.Role(c.Args().Get(1))
+	if username == "" || !auth.AllowedRole(role) {
 		return errors.New("username and new role expected, type 'ntfy user change-role --help' for help")
-	} else if username == userEveryone || username == user.Everyone {
+	} else if username == userEveryone {
 		return errors.New("username not allowed")
 	}
-	manager, err := createUserManager(c)
+	manager, err := createAuthManager(c)
 	if err != nil {
 		return err
 	}
-	if _, err := manager.User(username); errors.Is(err, user.ErrUserNotFound) {
+	if _, err := manager.User(username); err == auth.ErrNotFound {
 		return fmt.Errorf("user %s does not exist", username)
 	}
 	if err := manager.ChangeRole(username, role); err != nil {
 		return err
 	}
-	fmt.Fprintf(c.App.Writer, "changed role for user %s to %s\n", username, role)
-	return nil
-}
-
-func execUserHash(c *cli.Context) error {
-	password, err := readPasswordAndConfirm(c)
-	if err != nil {
-		return err
-	}
-	hash, err := user.HashPassword(password, user.DefaultUserPasswordBcryptCost)
-	if err != nil {
-		return fmt.Errorf("failed to hash password: %w", err)
-	}
-	fmt.Fprintln(c.App.Writer, hash)
-	return nil
-}
-
-func execUserChangeTier(c *cli.Context) error {
-	username := c.Args().Get(0)
-	tier := c.Args().Get(1)
-	if username == "" {
-		return errors.New("username and new tier expected, type 'ntfy user change-tier --help' for help")
-	} else if !user.AllowedTier(tier) && tier != tierReset {
-		return errors.New("invalid tier, must be tier code, or - to reset")
-	} else if username == userEveryone || username == user.Everyone {
-		return errors.New("username not allowed")
-	}
-	manager, err := createUserManager(c)
-	if err != nil {
-		return err
-	}
-	if _, err := manager.User(username); errors.Is(err, user.ErrUserNotFound) {
-		return fmt.Errorf("user %s does not exist", username)
-	}
-	if tier == tierReset {
-		if err := manager.ResetTier(username); err != nil {
-			return err
-		}
-		fmt.Fprintf(c.App.Writer, "removed tier from user %s\n", username)
-	} else {
-		if err := manager.ChangeTier(username, tier); err != nil {
-			return err
-		}
-		fmt.Fprintf(c.App.Writer, "changed tier for user %s to %s\n", username, tier)
-	}
+	fmt.Fprintf(c.App.ErrWriter, "changed role for user %s to %s\n", username, role)
 	return nil
 }
 
 func execUserList(c *cli.Context) error {
-	manager, err := createUserManager(c)
+	manager, err := createAuthManager(c)
 	if err != nil {
 		return err
 	}
@@ -449,35 +266,19 @@ func execUserList(c *cli.Context) error {
 	return showUsers(c, manager, users)
 }
 
-func createUserManager(c *cli.Context) (*user.Manager, error) {
+func createAuthManager(c *cli.Context) (auth.Manager, error) {
 	authFile := c.String("auth-file")
-	authStartupQueries := c.String("auth-startup-queries")
 	authDefaultAccess := c.String("auth-default-access")
-	databaseURL := c.String("database-url")
-	authDefault, err := user.ParsePermission(authDefaultAccess)
-	if err != nil {
-		return nil, errors.New("if set, auth-default-access must start set to 'read-write', 'read-only', 'write-only' or 'deny-all'")
+	if authFile == "" {
+		return nil, errors.New("option auth-file not set; auth is unconfigured for this server")
+	} else if !util.FileExists(authFile) {
+		return nil, errors.New("auth-file does not exist; please start the server at least once to create it")
+	} else if !util.Contains([]string{"read-write", "read-only", "write-only", "deny-all"}, authDefaultAccess) {
+		return nil, errors.New("if set, auth-default-access must start set to 'read-write', 'read-only' or 'deny-all'")
 	}
-	authConfig := &user.Config{
-		DefaultAccess:       authDefault,
-		ProvisionEnabled:    false, // Hack: Do not re-provision users on manager initialization
-		BcryptCost:          user.DefaultUserPasswordBcryptCost,
-		QueueWriterInterval: user.DefaultUserStatsQueueWriterInterval,
-		AccessCacheEnabled:  false, // Do not cache for CLI commands
-	}
-	if databaseURL != "" {
-		host, dbErr := pg.Open(databaseURL)
-		if dbErr != nil {
-			return nil, dbErr
-		}
-		return user.NewPostgresManager(db.New(host, nil), authConfig)
-	} else if authFile != "" {
-		if !util.FileExists(authFile) {
-			return nil, errors.New("auth-file does not exist; please start the server at least once to create it")
-		}
-		return user.NewSQLiteManager(authFile, authStartupQueries, authConfig)
-	}
-	return nil, errors.New("option database-url or auth-file not set; auth is unconfigured for this server")
+	authDefaultRead := authDefaultAccess == "read-write" || authDefaultAccess == "read-only"
+	authDefaultWrite := authDefaultAccess == "read-write" || authDefaultAccess == "write-only"
+	return auth.NewSQLiteAuth(authFile, authDefaultRead, authDefaultWrite)
 }
 
 func readPasswordAndConfirm(c *cli.Context) (string, error) {
@@ -485,8 +286,6 @@ func readPasswordAndConfirm(c *cli.Context) (string, error) {
 	password, err := util.ReadPassword(c.App.Reader)
 	if err != nil {
 		return "", err
-	} else if len(password) == 0 {
-		return "", errors.New("password cannot be empty")
 	}
 	fmt.Fprintf(c.App.ErrWriter, "\r%s\rconfirm: ", strings.Repeat(" ", 25))
 	confirm, err := util.ReadPassword(c.App.Reader)

cmd/user_test.go

@@ -1,35 +1,32 @@
 package cmd
 
 import (
-	"os"
-	"path/filepath"
-	"testing"
-
 	"github.com/stretchr/testify/require"
 	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/server"
-	"heckel.io/ntfy/v2/test"
-	"heckel.io/ntfy/v2/user"
+	"heckel.io/ntfy/server"
+	"heckel.io/ntfy/test"
+	"path/filepath"
+	"testing"
 )
 
 func TestCLI_User_Add(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
 	defer test.StopServer(t, s, port)
 
-	app, stdin, stdout, _ := newTestApp()
+	app, stdin, _, stderr := newTestApp()
 	stdin.WriteString("mypass\nmypass")
 	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role user")
+	require.Contains(t, stderr.String(), "user phil added with role user")
 }
 
 func TestCLI_User_Add_Exists(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
 	defer test.StopServer(t, s, port)
 
-	app, stdin, stdout, _ := newTestApp()
+	app, stdin, _, stderr := newTestApp()
 	stdin.WriteString("mypass\nmypass")
 	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role user")
+	require.Contains(t, stderr.String(), "user phil added with role user")
 
 	app, stdin, _, _ = newTestApp()
 	stdin.WriteString("mypass\nmypass")
@@ -42,10 +39,10 @@ func TestCLI_User_Add_Admin(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
 	defer test.StopServer(t, s, port)
 
-	app, stdin, stdout, _ := newTestApp()
+	app, stdin, _, stderr := newTestApp()
 	stdin.WriteString("mypass\nmypass")
 	require.Nil(t, runUserCommand(app, conf, "add", "--role=admin", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role admin")
+	require.Contains(t, stderr.String(), "user phil added with role admin")
 }
 
 func TestCLI_User_Add_Password_Mismatch(t *testing.T) {
@@ -61,27 +58,19 @@ func TestCLI_User_Add_Password_Mismatch(t *testing.T) {
 
 func TestCLI_User_ChangePass(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
-	conf.AuthUsers = []*user.User{
-		{Name: "philuser", Hash: "$2a$10$U4WSIYY6evyGmZaraavM2e2JeVG6EMGUKN1uUwufUeeRd4Jpg6cGC", Role: user.RoleUser}, // philuser:philpass
-	}
 	defer test.StopServer(t, s, port)
 
 	// Add user
-	app, stdin, stdout, _ := newTestApp()
+	app, stdin, _, stderr := newTestApp()
 	stdin.WriteString("mypass\nmypass")
 	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role user")
+	require.Contains(t, stderr.String(), "user phil added with role user")
 
 	// Change pass
-	app, stdin, stdout, _ = newTestApp()
+	app, stdin, _, stderr = newTestApp()
 	stdin.WriteString("newpass\nnewpass")
 	require.Nil(t, runUserCommand(app, conf, "change-pass", "phil"))
-	require.Contains(t, stdout.String(), "changed password for user phil")
-
-	// Cannot change provisioned user's pass
-	app, stdin, _, _ = newTestApp()
-	stdin.WriteString("newpass\nnewpass")
-	require.Error(t, runUserCommand(app, conf, "change-pass", "philuser"))
+	require.Contains(t, stderr.String(), "changed password for user phil")
 }
 
 func TestCLI_User_ChangeRole(t *testing.T) {
@@ -89,15 +78,15 @@ func TestCLI_User_ChangeRole(t *testing.T) {
 	defer test.StopServer(t, s, port)
 
 	// Add user
-	app, stdin, stdout, _ := newTestApp()
+	app, stdin, _, stderr := newTestApp()
 	stdin.WriteString("mypass\nmypass")
 	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role user")
+	require.Contains(t, stderr.String(), "user phil added with role user")
 
 	// Change role
-	app, _, stdout, _ = newTestApp()
+	app, _, _, stderr = newTestApp()
 	require.Nil(t, runUserCommand(app, conf, "change-role", "phil", "admin"))
-	require.Contains(t, stdout.String(), "changed role for user phil to admin")
+	require.Contains(t, stderr.String(), "changed role for user phil to admin")
 }
 
 func TestCLI_User_Delete(t *testing.T) {
@@ -105,15 +94,15 @@ func TestCLI_User_Delete(t *testing.T) {
 	defer test.StopServer(t, s, port)
 
 	// Add user
-	app, stdin, stdout, _ := newTestApp()
+	app, stdin, _, stderr := newTestApp()
 	stdin.WriteString("mypass\nmypass")
 	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-	require.Contains(t, stdout.String(), "user phil added with role user")
+	require.Contains(t, stderr.String(), "user phil added with role user")
 
 	// Delete user
-	app, _, stdout, _ = newTestApp()
+	app, _, _, stderr = newTestApp()
 	require.Nil(t, runUserCommand(app, conf, "del", "phil"))
-	require.Contains(t, stdout.String(), "user phil removed")
+	require.Contains(t, stderr.String(), "user phil removed")
 
 	// Delete user again (does not exist)
 	app, _, _, _ = newTestApp()
@@ -122,77 +111,11 @@ func TestCLI_User_Delete(t *testing.T) {
 	require.Contains(t, err.Error(), "user phil does not exist")
 }
 
-func TestCLI_User_ResetPass(t *testing.T) {
-	s, conf, port := newTestServerWithAuth(t)
-	defer test.StopServer(t, s, port)
-
-	app, stdin, _, _ := newTestApp()
-	stdin.WriteString("mypass\nmypass")
-	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-
-	// Prints a working-looking reset link when base-url is set
-	app, _, stdout, _ := newTestApp()
-	require.Nil(t, runUserCommand(app, conf, "--base-url=https://ntfy.example.com", "reset-pass", "phil"))
-	require.Contains(t, stdout.String(), "https://ntfy.example.com/account/password/reset/")
-}
-
-func TestCLI_User_ResetPass_NoBaseURL(t *testing.T) {
-	s, conf, port := newTestServerWithAuth(t)
-	defer test.StopServer(t, s, port)
-
-	app, stdin, _, _ := newTestApp()
-	stdin.WriteString("mypass\nmypass")
-	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-
-	app, _, _, _ = newTestApp()
-	err := runUserCommand(app, conf, "reset-pass", "phil")
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "base-url")
-}
-
-func TestCLI_User_ResetPass_SendEmailNoPrimary(t *testing.T) {
-	s, conf, port := newTestServerWithAuth(t)
-	defer test.StopServer(t, s, port)
-
-	app, stdin, _, _ := newTestApp()
-	stdin.WriteString("mypass\nmypass")
-	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
-
-	// --send-email requires a primary email; phil has none
-	app, _, _, _ = newTestApp()
-	err := runUserCommand(app, conf, "--base-url=https://ntfy.example.com", "reset-pass", "--send-email", "phil")
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "no primary email")
-}
-
-func TestCLI_User_ResetPass_ProvisionedRejected(t *testing.T) {
-	s, conf, port := newTestServerWithAuth(t)
-	defer test.StopServer(t, s, port)
-
-	// Seed a provisioned user into the auth database via config provisioning
-	m, err := user.NewSQLiteManager(conf.AuthFile, "", &user.Config{
-		ProvisionEnabled: true,
-		Users: []*user.User{
-			{Name: "provuser", Hash: "$2a$10$YLiO8U21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C", Role: user.RoleUser},
-		},
-	})
-	require.Nil(t, err)
-	require.Nil(t, m.Close())
-
-	app, _, _, _ := newTestApp()
-	err = runUserCommand(app, conf, "--base-url=https://ntfy.example.com", "reset-pass", "provuser")
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "provisioned")
-}
-
 func newTestServerWithAuth(t *testing.T) (s *server.Server, conf *server.Config, port int) {
-	configFile := filepath.Join(t.TempDir(), "server-dummy.yml")
-	require.Nil(t, os.WriteFile(configFile, []byte(""), 0600)) // Dummy config file to avoid lookup of real server.yml
 	conf = server.NewConfig()
-	conf.File = configFile
 	conf.AuthFile = filepath.Join(t.TempDir(), "user.db")
-	conf.AuthDefault = user.PermissionDenyAll
-	conf.AuthAccessCacheEnabled = false
+	conf.AuthDefaultRead = false
+	conf.AuthDefaultWrite = false
 	s, port = test.StartServerWithConfig(t, conf)
 	return
 }
@@ -200,11 +123,23 @@ func newTestServerWithAuth(t *testing.T) (s *server.Server, conf *server.Config,
 func runUserCommand(app *cli.App, conf *server.Config, args ...string) error {
 	userArgs := []string{
 		"ntfy",
-		"--log-level=ERROR",
 		"user",
-		"--config=" + conf.File, // Dummy config file to avoid lookups of real file
 		"--auth-file=" + conf.AuthFile,
-		"--auth-default-access=" + conf.AuthDefault.String(),
+		"--auth-default-access=" + confToDefaultAccess(conf),
 	}
 	return app.Run(append(userArgs, args...))
 }
+
+func confToDefaultAccess(conf *server.Config) string {
+	var defaultAccess string
+	if conf.AuthDefaultRead && conf.AuthDefaultWrite {
+		defaultAccess = "read-write"
+	} else if conf.AuthDefaultRead && !conf.AuthDefaultWrite {
+		defaultAccess = "read-only"
+	} else if !conf.AuthDefaultRead && conf.AuthDefaultWrite {
+		defaultAccess = "write-only"
+	} else if !conf.AuthDefaultRead && !conf.AuthDefaultWrite {
+		defaultAccess = "deny-all"
+	}
+	return defaultAccess
+}

cmd/webpush.go

@@ -1,69 +0,0 @@
-//go:build !noserver && !nowebpush
-
-package cmd
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/SherClockHolmes/webpush-go"
-	"github.com/urfave/cli/v2"
-	"github.com/urfave/cli/v2/altsrc"
-)
-
-var flagsWebPush = append(
-	[]cli.Flag{},
-	altsrc.NewStringFlag(&cli.StringFlag{Name: "output-file", Aliases: []string{"f"}, Usage: "write VAPID keys to this file"}),
-)
-
-func init() {
-	commands = append(commands, cmdWebPush)
-}
-
-var cmdWebPush = &cli.Command{
-	Name:      "webpush",
-	Usage:     "Generate keys, in the future manage web push subscriptions",
-	UsageText: "ntfy webpush [keys]",
-	Category:  categoryServer,
-
-	Subcommands: []*cli.Command{
-		{
-			Action:    generateWebPushKeys,
-			Name:      "keys",
-			Usage:     "Generate VAPID keys to enable browser background push notifications",
-			UsageText: "ntfy webpush keys",
-			Category:  categoryServer,
-			Flags:     flagsWebPush,
-		},
-	},
-}
-
-func generateWebPushKeys(c *cli.Context) error {
-	privateKey, publicKey, err := webpush.GenerateVAPIDKeys()
-	if err != nil {
-		return err
-	}
-
-	if outputFile := c.String("output-file"); outputFile != "" {
-		contents := fmt.Sprintf(`---
-web-push-public-key: %s
-web-push-private-key: %s
-`, publicKey, privateKey)
-		err = os.WriteFile(outputFile, []byte(contents), 0660)
-		if err != nil {
-			return err
-		}
-		_, err = fmt.Fprintf(c.App.Writer, "Web Push keys written to %s.\n", outputFile)
-	} else {
-		_, err = fmt.Fprintf(c.App.Writer, `Web Push keys generated. Add the following lines to your config file:
-
-web-push-public-key: %s
-web-push-private-key: %s
-web-push-file: /var/cache/ntfy/webpush.db # or similar
-web-push-email-address: <email address>
-
-See https://ntfy.sh/docs/config/#web-push for details.
-`, publicKey, privateKey)
-	}
-	return err
-}

cmd/webpush_test.go

@@ -1,34 +0,0 @@
-package cmd
-
-import (
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"github.com/urfave/cli/v2"
-	"heckel.io/ntfy/v2/server"
-)
-
-func TestCLI_WebPush_GenerateKeys(t *testing.T) {
-	app, _, stdout, _ := newTestApp()
-	require.Nil(t, runWebPushCommand(app, server.NewConfig(), "keys"))
-	require.Contains(t, stdout.String(), "Web Push keys generated.")
-}
-
-func TestCLI_WebPush_WriteKeysToFile(t *testing.T) {
-	tempDir := t.TempDir()
-	t.Chdir(tempDir)
-	app, _, stdout, _ := newTestApp()
-	require.Nil(t, runWebPushCommand(app, server.NewConfig(), "keys", "--output-file=key-file.yaml"))
-	require.Contains(t, stdout.String(), "Web Push keys written to key-file.yaml")
-	require.FileExists(t, filepath.Join(tempDir, "key-file.yaml"))
-}
-
-func runWebPushCommand(app *cli.App, conf *server.Config, args ...string) error {
-	webPushArgs := []string{
-		"ntfy",
-		"--log-level=ERROR",
-		"webpush",
-	}
-	return app.Run(append(webPushArgs, args...))
-}

crypto/crypto.go

@@ -0,0 +1,43 @@
+package crypto
+
+import (
+	"crypto/sha256"
+	"golang.org/x/crypto/pbkdf2"
+	"gopkg.in/square/go-jose.v2"
+)
+
+const (
+	jweEncryption = jose.A256GCM
+	jweAlgorithm  = jose.DIRECT
+	keyLenBytes   = 32 // 256-bit for AES-256
+	keyDerivIter  = 50000
+)
+
+func DeriveKey(password, topicURL string) []byte {
+	salt := sha256.Sum256([]byte(topicURL))
+	return pbkdf2.Key([]byte(password), salt[:], keyDerivIter, keyLenBytes, sha256.New)
+}
+
+func Encrypt(plaintext []byte, key []byte) (string, error) {
+	enc, err := jose.NewEncrypter(jweEncryption, jose.Recipient{Algorithm: jweAlgorithm, Key: key}, nil)
+	if err != nil {
+		return "", err
+	}
+	jwe, err := enc.Encrypt(plaintext)
+	if err != nil {
+		return "", err
+	}
+	return jwe.CompactSerialize()
+}
+
+func Decrypt(ciphertext string, key []byte) ([]byte, error) {
+	jwe, err := jose.ParseEncrypted(ciphertext)
+	if err != nil {
+		return nil, err
+	}
+	out, err := jwe.Decrypt(key)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}

crypto/crypto_test.go

@@ -0,0 +1,38 @@
+package crypto
+
+import (
+	"fmt"
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func TestDeriveKey(t *testing.T) {
+	key := DeriveKey("secr3t password", "https://ntfy.sh/mysecret")
+	require.Equal(t, "30b7e72f6273da6e59d2dec535466e548da3eafc98650c9664c06edab707fa25", fmt.Sprintf("%x", key))
+}
+
+func TestEncryptDecrypt(t *testing.T) {
+	message := "this is a message or is it?"
+	ciphertext, err := Encrypt([]byte(message), []byte("AES256Key-32Characters1234567890"))
+	require.Nil(t, err)
+	plaintext, err := Decrypt(ciphertext, []byte("AES256Key-32Characters1234567890"))
+	require.Nil(t, err)
+	require.Equal(t, message, string(plaintext))
+}
+
+func TestEncryptDecrypt_FromPHP(t *testing.T) {
+	ciphertext := "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..vbe1Qv_-mKYbUgce.EfmOUIUi7lxXZG_o4bqXZ9pmpr1Rzs4Y5QLE2XD2_aw_SQ.y2hadrN5b2LEw7_PJHhbcA"
+	key := DeriveKey("secr3t password", "https://ntfy.sh/mysecret")
+	fmt.Printf("%x", key)
+	plaintext, err := Decrypt(ciphertext, key)
+	require.Nil(t, err)
+	require.Equal(t, `{"message":"Secret!","priority":5}`, string(plaintext))
+}
+
+func TestEncryptDecrypt_FromPython(t *testing.T) {
+	ciphertext := "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..gSRYZeX6eBhlj13w.LOchcxFXwALXE2GqdoSwFJEXdMyEbLfLKV9geXr17WrAN-nH7ya1VQ_Y6ebT1w.2eyLaTUfc_rpKaZr4-5I1Q"
+	key := DeriveKey("secr3t password", "https://ntfy.sh/mysecret")
+	plaintext, err := Decrypt(ciphertext, key)
+	require.Nil(t, err)
+	require.Equal(t, `{"message":"Python says hi","tags":["secret"]}`, string(plaintext))
+}

db/db.go

@@ -1,146 +0,0 @@
-package db
-
-import (
-	"context"
-	"database/sql"
-	"sync/atomic"
-	"time"
-
-	"heckel.io/ntfy/v2/log"
-)
-
-const (
-	tag                            = "db"
-	replicaHealthCheckInitialDelay = 5 * time.Second
-	replicaHealthCheckInterval     = 30 * time.Second
-	replicaHealthCheckTimeout      = 10 * time.Second
-)
-
-// DB wraps a primary *sql.DB and optional read replicas. All standard query/exec methods
-// delegate to the primary. The ReadOnly() method returns a *sql.DB from a healthy replica
-// (round-robin), falling back to the primary if no replicas are configured or all are unhealthy.
-type DB struct {
-	primary  *Host
-	replicas []*Host
-	counter  atomic.Uint64
-	cancel   context.CancelFunc
-}
-
-// New creates a new DB that wraps the given primary and optional replica connections.
-// If replicas is nil or empty, ReadOnly() simply returns the primary.
-// Replicas start unhealthy and are checked immediately by a background goroutine.
-func New(primary *Host, replicas []*Host) *DB {
-	ctx, cancel := context.WithCancel(context.Background())
-	d := &DB{
-		primary:  primary,
-		replicas: replicas,
-		cancel:   cancel,
-	}
-	if len(d.replicas) > 0 {
-		go d.healthCheckLoop(ctx)
-	}
-	return d
-}
-
-// Query delegates to the primary database.
-func (d *DB) Query(query string, args ...any) (*sql.Rows, error) {
-	return d.primary.DB.Query(query, args...)
-}
-
-// QueryRow delegates to the primary database.
-func (d *DB) QueryRow(query string, args ...any) *sql.Row {
-	return d.primary.DB.QueryRow(query, args...)
-}
-
-// Exec delegates to the primary database.
-func (d *DB) Exec(query string, args ...any) (sql.Result, error) {
-	return d.primary.DB.Exec(query, args...)
-}
-
-// Begin delegates to the primary database.
-func (d *DB) Begin() (*sql.Tx, error) {
-	return d.primary.DB.Begin()
-}
-
-// Ping delegates to the primary database.
-func (d *DB) Ping() error {
-	return d.primary.DB.Ping()
-}
-
-// Primary returns the underlying primary *sql.DB. This is only intended for
-// one-time schema setup during store initialization, not for regular queries.
-func (d *DB) Primary() *sql.DB {
-	return d.primary.DB
-}
-
-// ReadOnly returns a *sql.DB suitable for read-only queries. It round-robins across healthy
-// replicas. If all replicas are unhealthy or none are configured, the primary is returned.
-func (d *DB) ReadOnly() *sql.DB {
-	if len(d.replicas) == 0 {
-		return d.primary.DB
-	}
-	n := len(d.replicas)
-	start := int(d.counter.Add(1) - 1)
-	for i := 0; i < n; i++ {
-		r := d.replicas[(start+i)%n]
-		if r.healthy.Load() {
-			return r.DB
-		}
-	}
-	return d.primary.DB
-}
-
-// MarkReplicasHealthyForTest immediately marks all configured replicas as healthy, bypassing the
-// async health-check loop's initial delay. It exists so tests can deterministically route
-// ReadOnly() to a replica without waiting; it is not used in production code.
-func (d *DB) MarkReplicasHealthyForTest() {
-	for _, r := range d.replicas {
-		r.healthy.Store(true)
-	}
-}
-
-// Close closes the primary database and all replicas, and stops the health-check goroutine.
-func (d *DB) Close() error {
-	d.cancel()
-	for _, r := range d.replicas {
-		r.DB.Close()
-	}
-	return d.primary.DB.Close()
-}
-
-// healthCheckLoop checks replicas immediately, then periodically on a ticker.
-func (d *DB) healthCheckLoop(ctx context.Context) {
-	select {
-	case <-ctx.Done():
-		return
-	case <-time.After(replicaHealthCheckInitialDelay):
-		d.checkReplicas(ctx)
-	}
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-time.After(replicaHealthCheckInterval):
-			d.checkReplicas(ctx)
-		}
-	}
-}
-
-// checkReplicas pings each replica with a timeout and updates its health status.
-func (d *DB) checkReplicas(ctx context.Context) {
-	for _, r := range d.replicas {
-		wasHealthy := r.healthy.Load()
-		pingCtx, cancel := context.WithTimeout(ctx, replicaHealthCheckTimeout)
-		err := r.DB.PingContext(pingCtx)
-		cancel()
-		if err != nil {
-			r.healthy.Store(false)
-			log.Tag(tag).Error("Database replica %s is unhealthy: %s", r.Addr, err)
-		} else {
-			r.healthy.Store(true)
-			if !wasHealthy {
-				log.Tag(tag).Info("Database replica %s is healthy", r.Addr)
-			}
-		}
-	}
-}

db/pg/leader.go

@@ -1,163 +0,0 @@
-package pg
-
-import (
-	"context"
-	"database/sql"
-	"sync"
-	"time"
-
-	"heckel.io/ntfy/v2/log"
-)
-
-const (
-	tagLeader = "leader"
-
-	tryAdvisoryLockQuery = `SELECT pg_try_advisory_lock($1)`
-	advisoryUnlockQuery  = `SELECT pg_advisory_unlock($1)`
-
-	defaultRenewInterval = 5 * time.Second
-	leaderMissedRenewals = 3
-	leaderHoldoffFactor  = 2
-)
-
-// Leader implements singleton-job leader election via a Postgres advisory lock held on a
-// pinned connection. The lock auto-releases when the holding connection dies, so a crashed
-// leader is replaced without manual fencing; distinct keys elect independently. The Leader
-// renews its lease on its own loop; callers only ask IsLeader and eventually Close.
-//
-// Holding the lock is not the same as believing to be the leader: IsLeader also requires a
-// recent renewal (lease duration) and a completed hold-off after winning the lock. The
-// hold-off outlasts the lease duration by construction, so on failover the old belief always
-// expires before the new one begins: a short no-leader gap, never two leaders. Defaults:
-// renew every 5s, lease duration 15s, hold-off 30s -> up to ~35s without a leader.
-type Leader struct {
-	db            *sql.DB
-	key           int64
-	renewInterval time.Duration
-	conn          *sql.Conn          // holds the advisory lock while this process is leader
-	acquiredAt    time.Time          // When the lock was won (this tenure), for the hold-off
-	renewedAt     time.Time          // Last successful renewal, for the lease duration; zero = lock not held
-	cancel        context.CancelFunc // Stops the renew loop and aborts its in-flight query on Close
-	closeOnce     sync.Once
-	wg            sync.WaitGroup
-	mu            sync.Mutex // Protects conn, acquiredAt and renewedAt
-}
-
-// NewLeader creates a Leader competing for the lock identified by key and starts its renew
-// loop. renewInterval is for tests; pass 0 for the default.
-func NewLeader(db *sql.DB, key int64, renewInterval time.Duration) *Leader {
-	if renewInterval <= 0 {
-		renewInterval = defaultRenewInterval
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	l := &Leader{
-		db:            db,
-		key:           key,
-		renewInterval: renewInterval,
-		cancel:        cancel,
-	}
-	l.wg.Add(1)
-	go l.runAcquireOrRenewLoop(ctx)
-	return l
-}
-
-// IsLeader reports whether this process should act as the leader: lock held, lease renewed
-// recently, hold-off elapsed (see the Leader doc comment).
-func (l *Leader) IsLeader() bool {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	leaseDuration := leaderMissedRenewals * l.renewInterval
-	holdoff := leaderHoldoffFactor * leaseDuration
-	return time.Since(l.renewedAt) < leaseDuration && time.Since(l.acquiredAt) >= holdoff
-}
-
-// Close stops competing for leadership and releases the lock. Idempotent.
-func (l *Leader) Close() {
-	l.closeOnce.Do(func() {
-		l.cancel() // Also aborts an in-flight renewal query
-		l.wg.Wait()
-		if l.IsLeader() {
-			log.Tag(tagLeader).Info("Lost leadership: closed (lock key %d)", l.key)
-		}
-		l.release()
-	})
-}
-
-// runAcquireOrRenewLoop acquires or renews the lock every renewInterval until ctx is canceled
-func (l *Leader) runAcquireOrRenewLoop(ctx context.Context) {
-	defer l.wg.Done()
-	ticker := time.NewTicker(l.renewInterval)
-	defer ticker.Stop()
-	wasLeader := false
-	for {
-		attemptCtx, cancel := context.WithTimeout(ctx, l.renewInterval)
-		l.tryAcquireOrRenew(attemptCtx)
-		cancel()
-		if isLeader := l.IsLeader(); isLeader != wasLeader {
-			wasLeader = isLeader
-			if isLeader {
-				log.Tag(tagLeader).Info("Became leader (lock key %d)", l.key)
-			} else {
-				log.Tag(tagLeader).Info("Lost leadership (lock key %d)", l.key)
-			}
-		}
-		select {
-		case <-ticker.C:
-		case <-ctx.Done():
-			return
-		}
-	}
-}
-
-// tryAcquireOrRenew renews the lock on a healthy leader (a cheap ping) or retries acquiring
-// it on a follower, on a pinned connection.
-func (l *Leader) tryAcquireOrRenew(ctx context.Context) {
-	l.mu.Lock()
-	conn := l.conn
-	l.mu.Unlock()
-	if conn != nil {
-		if conn.PingContext(ctx) == nil {
-			// Still holding the lock, connection healthy: renew the lease
-			l.mu.Lock()
-			l.renewedAt = time.Now()
-			l.mu.Unlock()
-			log.Tag(tagLeader).Trace("Renewed leader lease (lock key %d)", l.key)
-			return
-		}
-		log.Tag(tagLeader).Debug("Leader lock connection died, lock lost (lock key %d)", l.key)
-		l.release() // Connection died; the lock is already gone, re-acquire below
-	}
-	newConn, err := l.db.Conn(ctx)
-	if err != nil {
-		log.Tag(tagLeader).Debug("Cannot get connection to compete for leader lock (lock key %d): %s", l.key, err.Error())
-		return
-	}
-	var acquired bool
-	if err := newConn.QueryRowContext(ctx, tryAdvisoryLockQuery, l.key).Scan(&acquired); err != nil || !acquired {
-		newConn.Close()
-		log.Tag(tagLeader).Trace("Leader lock held elsewhere (lock key %d)", l.key)
-		return
-	}
-	log.Tag(tagLeader).Debug("Acquired leader lock (lock key %d); leadership after the hold-off", l.key)
-	l.mu.Lock()
-	l.conn = newConn
-	l.acquiredAt = time.Now()
-	l.renewedAt = l.acquiredAt
-	l.mu.Unlock()
-}
-
-// release unlocks the advisory lock and returns the pinned connection to the pool
-func (l *Leader) release() {
-	l.mu.Lock()
-	conn := l.conn
-	l.conn = nil
-	l.renewedAt = time.Time{} // Zero revokes belief; without it, IsLeader would linger a lease duration
-	l.mu.Unlock()
-	if conn != nil {
-		// Unlock explicitly: sql.Conn.Close() returns the connection to the pool, so the
-		// session-scoped lock would otherwise stay held
-		conn.ExecContext(context.Background(), advisoryUnlockQuery, l.key)
-		conn.Close()
-		log.Tag(tagLeader).Debug("Released leader lock (lock key %d)", l.key)
-	}
-}

db/pg/leader_internal_test.go

@@ -1,41 +0,0 @@
-package pg
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-// The lease logic is pure time arithmetic, so it is unit-tested here without a database; the
-// external leader tests cover the loop end to end.
-
-func TestLeader_Lease_HoldoffMeansNoLeaderRatherThanTwo(t *testing.T) {
-	// Freshly acquired lock: belief must wait out the hold-off
-	l := &Leader{renewInterval: 20 * time.Second} // Lease duration 1m, hold-off 2m
-	l.acquiredAt = time.Now()
-	l.renewedAt = l.acquiredAt
-	require.False(t, l.IsLeader())
-	// Once the hold-off has passed (and verification is fresh), belief begins
-	l.acquiredAt = time.Now().Add(-3 * time.Minute)
-	l.renewedAt = time.Now()
-	require.True(t, l.IsLeader())
-}
-
-func TestLeader_Lease_ExpiredLeaseRevokesLeadership(t *testing.T) {
-	// A leader that cannot renew its lease (wedged process, long GC pause) must stop
-	// believing once the lease expires, even though the lock may still be held
-	l := &Leader{renewInterval: 20 * time.Second} // Lease duration 1m, hold-off 2m
-	l.acquiredAt = time.Now().Add(-time.Hour)
-	l.renewedAt = time.Now().Add(-2 * time.Minute) // Lease expired
-	require.False(t, l.IsLeader())
-	l.renewedAt = time.Now() // Fresh renewal restores belief
-	require.True(t, l.IsLeader())
-}
-
-func TestLeader_Lease_ReleasedIsNeverLeader(t *testing.T) {
-	// release() zeroes renewedAt, which fails the lease check no matter how old the tenure
-	l := &Leader{renewInterval: 20 * time.Second} // Lease duration 1m, hold-off 2m
-	l.acquiredAt = time.Now().Add(-time.Hour)
-	require.False(t, l.IsLeader())
-}

db/pg/leader_test.go

@@ -1,90 +0,0 @@
-package pg_test
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/db/pg"
-	dbtest "heckel.io/ntfy/v2/db/test"
-)
-
-const testRenewInterval = 20 * time.Millisecond // Lease duration 60ms, hold-off 120ms
-
-func TestLeader_AcquireAndFailover(t *testing.T) {
-	testDB := dbtest.CreateTestPostgres(t) // skips if NTFY_TEST_DATABASE_URL is unset
-	const key = int64(42)
-	l1 := pg.NewLeader(testDB.Primary(), key, testRenewInterval)
-	defer l1.Close()
-	// Belief follows the hold-off, it is never instant
-	require.False(t, l1.IsLeader())
-	waitForLeader(t, l1)
-	// A competitor never becomes leader while the leader lives
-	l2 := pg.NewLeader(testDB.Primary(), key, testRenewInterval)
-	defer l2.Close()
-	time.Sleep(300 * time.Millisecond) // Several verification rounds
-	require.False(t, l2.IsLeader())
-	require.True(t, l1.IsLeader())
-	// Close -> the follower takes over
-	l1.Close()
-	require.False(t, l1.IsLeader())
-	waitForLeader(t, l2)
-	require.False(t, l1.IsLeader())
-}
-
-func TestLeader_ConnectionLossFailover(t *testing.T) {
-	// A crashed leader must not wedge the cluster: Postgres releases the session-scoped lock
-	// when the pinned connection dies (simulated by terminating the backend), and someone
-	// re-acquires. Either node may win; the invariant is one leader eventually, never two.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	hostA, err := pg.Open(schemaDSN)
-	require.Nil(t, err)
-	defer hostA.DB.Close()
-	hostB, err := pg.Open(schemaDSN)
-	require.Nil(t, err)
-	defer hostB.DB.Close()
-	const key = int64(43)
-	l1 := pg.NewLeader(hostA.DB, key, testRenewInterval)
-	defer l1.Close()
-	waitForLeader(t, l1)
-	l2 := pg.NewLeader(hostB.DB, key, testRenewInterval)
-	defer l2.Close()
-	// Kill the backend holding the lock (advisory lock keys map to classid/objid)
-	_, err = hostB.DB.Exec(`SELECT pg_terminate_backend(pid) FROM pg_locks WHERE locktype = 'advisory' AND objid = $1 AND granted`, key)
-	require.Nil(t, err)
-	// Eventually exactly one leader again, and never two along the way
-	deadline := time.Now().Add(5 * time.Second)
-	for time.Now().Before(deadline) {
-		leader1, leader2 := l1.IsLeader(), l2.IsLeader()
-		require.False(t, leader1 && leader2, "two leaders at once")
-		if leader1 != leader2 {
-			return
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-	t.Fatal("no leader re-emerged after connection loss")
-}
-
-func TestLeader_DistinctKeysAreIndependent(t *testing.T) {
-	testDB := dbtest.CreateTestPostgres(t)
-	l1 := pg.NewLeader(testDB.Primary(), 1, testRenewInterval)
-	defer l1.Close()
-	l2 := pg.NewLeader(testDB.Primary(), 2, testRenewInterval)
-	defer l2.Close()
-	// Different keys do not compete: both become effective leaders
-	waitForLeader(t, l1)
-	waitForLeader(t, l2)
-}
-
-// waitForLeader waits until the node believes it is the leader, or fails the test
-func waitForLeader(t *testing.T, l *pg.Leader) {
-	t.Helper()
-	deadline := time.Now().Add(5 * time.Second)
-	for time.Now().Before(deadline) {
-		if l.IsLeader() {
-			return
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-	t.Fatal("node never became effective leader")
-}

db/pg/pg.go

@@ -1,127 +0,0 @@
-package pg
-
-import (
-	"database/sql"
-	"fmt"
-	"net/url"
-	"strconv"
-	"strings"
-	"time"
-
-	_ "github.com/jackc/pgx/v5/stdlib" // PostgreSQL driver
-
-	"heckel.io/ntfy/v2/db"
-)
-
-// Advisory lock keys. PostgreSQL advisory locks share one database-wide key space, so every
-// ntfy key is defined here, following the "ntfy"+2586+letter scheme
-const (
-	SchemaLockKey = int64(0x6e7466792586a) // Schema setup serialization (transaction-scoped, see db/schema)
-	LeaderLockKey = int64(0x6e7466792586b) // Cluster singleton-job leader (session-scoped, held for process lifetime)
-)
-
-// Open opens a PostgreSQL connection pool for a primary database. It pings the database
-// to verify connectivity before returning.
-func Open(dsn string) (*db.Host, error) {
-	d, err := open(dsn)
-	if err != nil {
-		return nil, fmt.Errorf("failed to open database: %w", err)
-	}
-	if err := d.DB.Ping(); err != nil {
-		return nil, fmt.Errorf("database ping failed on %v: %w", d.Addr, err)
-	}
-	return d, nil
-}
-
-// OpenReplica opens a PostgreSQL connection pool for a read replica. Unlike Open, it does
-// not ping the database, since replicas are health-checked in the background by db.DB.
-func OpenReplica(dsn string) (*db.Host, error) {
-	return open(dsn)
-}
-
-// open opens a PostgreSQL database connection pool from a DSN string. It supports custom
-// query parameters for pool configuration: pool_max_conns (default 10), pool_max_idle_conns,
-// pool_conn_max_lifetime, and pool_conn_max_idle_time. These parameters are stripped from
-// the DSN before passing it to the driver.
-func open(dsn string) (*db.Host, error) {
-	u, err := url.Parse(dsn)
-	if err != nil {
-		return nil, fmt.Errorf("invalid database URL: %w", err)
-	}
-	switch u.Scheme {
-	case "postgres", "postgresql":
-		// OK
-	default:
-		return nil, fmt.Errorf("invalid database URL scheme %q, must be \"postgres\" or \"postgresql\" (URL: %s)", u.Scheme, censorPassword(u))
-	}
-	q := u.Query()
-	maxOpenConns, err := extractIntParam(q, "pool_max_conns", 10)
-	if err != nil {
-		return nil, err
-	}
-	maxIdleConns, err := extractIntParam(q, "pool_max_idle_conns", 0)
-	if err != nil {
-		return nil, err
-	}
-	connMaxLifetime, err := extractDurationParam(q, "pool_conn_max_lifetime", 0)
-	if err != nil {
-		return nil, err
-	}
-	connMaxIdleTime, err := extractDurationParam(q, "pool_conn_max_idle_time", 0)
-	if err != nil {
-		return nil, err
-	}
-	u.RawQuery = q.Encode()
-	d, err := sql.Open("pgx", u.String())
-	if err != nil {
-		return nil, err
-	}
-	d.SetMaxOpenConns(maxOpenConns)
-	if maxIdleConns > 0 {
-		d.SetMaxIdleConns(maxIdleConns)
-	}
-	if connMaxLifetime > 0 {
-		d.SetConnMaxLifetime(connMaxLifetime)
-	}
-	if connMaxIdleTime > 0 {
-		d.SetConnMaxIdleTime(connMaxIdleTime)
-	}
-	return &db.Host{
-		Addr: u.Host,
-		DB:   d,
-	}, nil
-}
-
-func extractIntParam(q url.Values, key string, defaultValue int) (int, error) {
-	s := q.Get(key)
-	if s == "" {
-		return defaultValue, nil
-	}
-	q.Del(key)
-	v, err := strconv.Atoi(s)
-	if err != nil {
-		return 0, fmt.Errorf("invalid %s value %q: %w", key, s, err)
-	}
-	return v, nil
-}
-
-// censorPassword returns a string representation of the URL with the password replaced by "*****".
-func censorPassword(u *url.URL) string {
-	if password, hasPassword := u.User.Password(); hasPassword {
-		return strings.Replace(u.String(), ":"+password+"@", ":*****@", 1)
-	}
-	return u.String()
-}
-
-func extractDurationParam(q url.Values, key string, defaultValue time.Duration) (time.Duration, error) {
-	s := q.Get(key)
-	if s == "" {
-		return defaultValue, nil
-	}
-	q.Del(key)
-	d, err := time.ParseDuration(s)
-	if err != nil {
-		return 0, fmt.Errorf("invalid %s value %q: %w", key, s, err)
-	}
-	return d, nil
-}

db/pg/pg_test.go

@@ -1,53 +0,0 @@
-package pg
-
-import (
-	"net/url"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestOpen_InvalidScheme(t *testing.T) {
-	_, err := Open("postgresql+psycopg2://user:pass@localhost/db")
-	require.Error(t, err)
-	require.Contains(t, err.Error(), `invalid database URL scheme "postgresql+psycopg2"`)
-	require.Contains(t, err.Error(), "*****")
-	require.NotContains(t, err.Error(), "pass")
-}
-
-func TestOpen_InvalidURL(t *testing.T) {
-	_, err := Open("not a valid url\x00")
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "invalid database URL")
-}
-
-func TestCensorPassword(t *testing.T) {
-	tests := []struct {
-		name     string
-		url      string
-		expected string
-	}{
-		{
-			name:     "with password",
-			url:      "postgres://user:secret@localhost/db",
-			expected: "postgres://user:*****@localhost/db",
-		},
-		{
-			name:     "without password",
-			url:      "postgres://localhost/db",
-			expected: "postgres://localhost/db",
-		},
-		{
-			name:     "user only",
-			url:      "postgres://user@localhost/db",
-			expected: "postgres://user@localhost/db",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			u, err := url.Parse(tt.url)
-			require.NoError(t, err)
-			require.Equal(t, tt.expected, censorPassword(u))
-		})
-	}
-}

db/schema/schema.go

@@ -1,111 +0,0 @@
-// Package schema tracks and migrates database schemas, and Migrate creates or upgrades a
-// store's schema inside a single transaction. On PostgreSQL, all stores share one database, so
-// versions live in a shared schema_version table keyed by store name. On SQLite, every store is
-// its own database file, so the version lives in the schemaVersion table keyed by id = 1.
-package schema
-
-import (
-	"database/sql"
-	"errors"
-	"fmt"
-
-	"heckel.io/ntfy/v2/db/pg"
-	"heckel.io/ntfy/v2/log"
-)
-
-const (
-	tag = "schema"
-)
-
-const (
-	sqliteCreateVersionTableQuery = `CREATE TABLE IF NOT EXISTS schemaVersion (id INT PRIMARY KEY, version INT NOT NULL)`
-	sqliteSelectVersionQuery      = `SELECT version FROM schemaVersion WHERE id = 1`
-	sqliteUpsertVersionQuery      = `INSERT INTO schemaVersion (id, version) VALUES (1, ?) ON CONFLICT (id) DO UPDATE SET version = excluded.version`
-
-	postgresCreateVersionTableQuery = `CREATE TABLE IF NOT EXISTS schema_version (store TEXT PRIMARY KEY, version INT NOT NULL)`
-	postgresSelectVersionQuery      = `SELECT version FROM schema_version WHERE store = $1`
-	postgresUpsertVersionQuery      = `INSERT INTO schema_version (store, version) VALUES ($1, $2) ON CONFLICT (store) DO UPDATE SET version = EXCLUDED.version`
-	postgresAdvisoryLockQuery       = `SELECT pg_advisory_xact_lock($1)` // Transaction-scoped lock to avoid migration races
-)
-
-// Migrate creates or upgrades the named store's schema to targetVersion in one transaction, or
-// creates a new database using the "create" function.
-func Migrate(db *sql.DB, dialect Dialect, store string, targetVersion int, create MigrateFunc, migrations map[int]MigrateFunc) error {
-	if dialect != Postgres && dialect != SQLite {
-		return fmt.Errorf("unsupported schema dialect %d", dialect)
-	}
-	tx, err := db.Begin()
-	if err != nil {
-		return fmt.Errorf("cannot begin %s schema transaction: %w", store, err)
-	}
-	defer tx.Rollback()
-	if dialect == Postgres {
-		// Serialize setup across nodes: CREATE TABLE IF NOT EXISTS is not atomic, and
-		// concurrently cold-booting nodes would otherwise race on DDL and crash
-		if _, err := tx.Exec(postgresAdvisoryLockQuery, pg.SchemaLockKey); err != nil {
-			return fmt.Errorf("cannot acquire %s schema advisory lock: %w", store, err)
-		}
-	}
-	if _, err := tx.Exec(createVersionTableQuery(dialect)); err != nil {
-		return fmt.Errorf("cannot create schema version table: %w", err)
-	}
-	version, err := readVersion(tx, dialect, store)
-	if errors.Is(err, sql.ErrNoRows) {
-		// Fresh database: create the store's tables at the target version
-		if err := create(tx); err != nil {
-			return fmt.Errorf("cannot create %s schema: %w", store, err)
-		}
-		if err := writeVersion(tx, dialect, store, targetVersion); err != nil {
-			return fmt.Errorf("cannot write %s schema version: %w", store, err)
-		}
-		return tx.Commit()
-	} else if err != nil {
-		return fmt.Errorf("cannot read %s schema version: %w", store, err)
-	}
-	if version == targetVersion {
-		return tx.Commit()
-	}
-	if version > targetVersion {
-		return fmt.Errorf("unexpected %s schema version %d, this version of ntfy supports up to %d", store, version, targetVersion)
-	}
-	for v := version; v < targetVersion; v++ {
-		migrate, ok := migrations[v]
-		if !ok {
-			return fmt.Errorf("cannot find %s migration step from version %d to %d", store, v, v+1)
-		}
-		log.Tag(tag).Info("Migrating %s database schema: from %d to %d", store, v, v+1)
-		if err := migrate(tx); err != nil {
-			return fmt.Errorf("%s migration step from version %d to %d failed: %w", store, v, v+1, err)
-		}
-	}
-	if err := writeVersion(tx, dialect, store, targetVersion); err != nil {
-		return fmt.Errorf("cannot write %s schema version: %w", store, err)
-	}
-	return tx.Commit()
-}
-
-func createVersionTableQuery(dialect Dialect) string {
-	if dialect == Postgres {
-		return postgresCreateVersionTableQuery
-	}
-	return sqliteCreateVersionTableQuery
-}
-
-func readVersion(tx *sql.Tx, dialect Dialect, store string) (version int, err error) {
-	if dialect == Postgres {
-		err = tx.QueryRow(postgresSelectVersionQuery, store).Scan(&version)
-	} else {
-		err = tx.QueryRow(sqliteSelectVersionQuery).Scan(&version)
-	}
-	return
-}
-
-func writeVersion(tx *sql.Tx, dialect Dialect, store string, version int) error {
-	var err error
-	if dialect == Postgres {
-		_, err = tx.Exec(postgresUpsertVersionQuery, store, version)
-	} else {
-		_, err = tx.Exec(sqliteUpsertVersionQuery, version)
-	}
-	return err
-}

db/schema/schema_test.go

@@ -1,192 +0,0 @@
-package schema_test
-
-import (
-	"database/sql"
-	"fmt"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/db/pg"
-	"heckel.io/ntfy/v2/db/schema"
-	dbtest "heckel.io/ntfy/v2/db/test"
-
-	_ "github.com/mattn/go-sqlite3"
-)
-
-const (
-	testCreateQuery = `CREATE TABLE IF NOT EXISTS things (id TEXT PRIMARY KEY, name TEXT NOT NULL)`
-)
-
-func testCreate(tx *sql.Tx) error {
-	_, err := tx.Exec(testCreateQuery)
-	return err
-}
-
-func openTestPostgres(t *testing.T) *sql.DB {
-	t.Helper()
-	host, err := pg.Open(dbtest.CreateTestPostgresSchema(t))
-	require.Nil(t, err)
-	t.Cleanup(func() { host.DB.Close() })
-	return host.DB
-}
-
-func openTestSQLite(t *testing.T) *sql.DB {
-	t.Helper()
-	d, err := sql.Open("sqlite3", filepath.Join(t.TempDir(), "test.db"))
-	require.Nil(t, err)
-	t.Cleanup(func() { d.Close() })
-	return d
-}
-
-func forEachDialect(t *testing.T, f func(t *testing.T, d *sql.DB, dialect schema.Dialect)) {
-	t.Run("postgres", func(t *testing.T) {
-		f(t, openTestPostgres(t), schema.Postgres)
-	})
-	t.Run("sqlite", func(t *testing.T) {
-		f(t, openTestSQLite(t), schema.SQLite)
-	})
-}
-
-func TestMigrate_FreshCreate(t *testing.T) {
-	forEachDialect(t, func(t *testing.T, d *sql.DB, dialect schema.Dialect) {
-		// A fresh database jumps straight to the target version; migration steps are not consulted
-		require.Nil(t, schema.Migrate(d, dialect, "things", 3, testCreate, nil))
-		_, err := d.Exec(`INSERT INTO things (id, name) VALUES ('a', 'thing a')`)
-		require.Nil(t, err)
-		require.Equal(t, 3, storeVersion(t, d, dialect, "things"))
-		// Idempotent: a second node boots against the migrated schema
-		require.Nil(t, schema.Migrate(d, dialect, "things", 3, testCreate, nil))
-	})
-}
-
-func TestMigrate_AppliesMigrationSteps(t *testing.T) {
-	forEachDialect(t, func(t *testing.T, d *sql.DB, dialect schema.Dialect) {
-		require.Nil(t, schema.Migrate(d, dialect, "things", 1, testCreate, nil))
-		// A newer version of the code migrates 1 -> 3 step by step, in order
-		migrations := map[int]schema.MigrateFunc{
-			1: func(tx *sql.Tx) error {
-				_, err := tx.Exec(`ALTER TABLE things ADD COLUMN color TEXT NOT NULL DEFAULT ''`)
-				return err
-			},
-			2: func(tx *sql.Tx) error {
-				_, err := tx.Exec(`ALTER TABLE things ADD COLUMN size INT NOT NULL DEFAULT 0`)
-				return err
-			},
-		}
-		require.Nil(t, schema.Migrate(d, dialect, "things", 3, testCreate, migrations))
-		_, err := d.Exec(`INSERT INTO things (id, name, color, size) VALUES ('b', 'thing b', 'red', 2)`)
-		require.Nil(t, err)
-		require.Equal(t, 3, storeVersion(t, d, dialect, "things"))
-	})
-}
-
-func TestMigrate_ClosureCarriesConfig(t *testing.T) {
-	// Migrations needing config take it via closure at map-construction time; there is no
-	// params plumbing in the framework itself
-	migrationsFor := func(defaultName string) map[int]schema.MigrateFunc {
-		return map[int]schema.MigrateFunc{
-			1: schema.AsMigrateFunc(fmt.Sprintf(`ALTER TABLE things ADD COLUMN nick TEXT NOT NULL DEFAULT '%s'`, defaultName)),
-		}
-	}
-	forEachDialect(t, func(t *testing.T, d *sql.DB, dialect schema.Dialect) {
-		require.Nil(t, schema.Migrate(d, dialect, "things", 1, testCreate, nil))
-		_, err := d.Exec(`INSERT INTO things (id, name) VALUES ('a', 'thing a')`)
-		require.Nil(t, err)
-		require.Nil(t, schema.Migrate(d, dialect, "things", 2, testCreate, migrationsFor("configured-default")))
-		var nick string
-		require.Nil(t, d.QueryRow(`SELECT nick FROM things WHERE id = 'a'`).Scan(&nick))
-		require.Equal(t, "configured-default", nick)
-	})
-}
-
-func TestMigrate_InvalidDialect(t *testing.T) {
-	d := openTestSQLite(t)
-	err := schema.Migrate(d, schema.Dialect(99), "things", 1, testCreate, nil)
-	require.Error(t, err)
-}
-
-func TestMigrate_RefusesFutureVersion(t *testing.T) {
-	forEachDialect(t, func(t *testing.T, d *sql.DB, dialect schema.Dialect) {
-		require.Nil(t, schema.Migrate(d, dialect, "things", 2, testCreate, map[int]schema.MigrateFunc{}))
-		err := schema.Migrate(d, dialect, "things", 1, testCreate, nil)
-		require.Error(t, err)
-	})
-}
-
-func TestMigrate_MissingStepFails(t *testing.T) {
-	forEachDialect(t, func(t *testing.T, d *sql.DB, dialect schema.Dialect) {
-		require.Nil(t, schema.Migrate(d, dialect, "things", 1, testCreate, nil))
-		err := schema.Migrate(d, dialect, "things", 3, testCreate, nil) // No step 1 -> 2 registered
-		require.Error(t, err)
-	})
-}
-
-func TestMigrate_StoresAreIndependent(t *testing.T) {
-	// Postgres only: stores share one database, tracked as rows in schema_version. On SQLite
-	// every store has its own database file, so independence is by file.
-	d := openTestPostgres(t)
-	require.Nil(t, schema.Migrate(d, schema.Postgres, "things", 1, testCreate, nil))
-	require.Nil(t, schema.Migrate(d, schema.Postgres, "gadgets", 4, func(tx *sql.Tx) error {
-		_, err := tx.Exec(`CREATE TABLE IF NOT EXISTS gadgets (id TEXT PRIMARY KEY)`)
-		return err
-	}, nil))
-	require.Equal(t, 1, storeVersion(t, d, schema.Postgres, "things"))
-	require.Equal(t, 4, storeVersion(t, d, schema.Postgres, "gadgets"))
-}
-
-func TestMigrate_SQLiteReadsExistingSchemaVersionTable(t *testing.T) {
-	// Existing ntfy SQLite databases (message, user, webpush) track their version in a
-	// schemaVersion (id, version) table keyed by id = 1; the framework uses that table as-is
-	// on SQLite, so existing databases migrate without any adoption step
-	d := openTestSQLite(t)
-	_, err := d.Exec(testCreateQuery)
-	require.Nil(t, err)
-	_, err = d.Exec(`CREATE TABLE schemaVersion (id INT PRIMARY KEY, version INT NOT NULL)`)
-	require.Nil(t, err)
-	_, err = d.Exec(`INSERT INTO schemaVersion VALUES (1, 1)`)
-	require.Nil(t, err)
-	migrations := map[int]schema.MigrateFunc{
-		1: func(tx *sql.Tx) error {
-			_, err := tx.Exec(`ALTER TABLE things ADD COLUMN color TEXT NOT NULL DEFAULT ''`)
-			return err
-		},
-	}
-	require.Nil(t, schema.Migrate(d, schema.SQLite, "things", 2, testCreate, migrations))
-	_, err = d.Exec(`INSERT INTO things (id, name, color) VALUES ('a', 'thing a', 'red')`)
-	require.Nil(t, err)
-	require.Equal(t, 2, storeVersion(t, d, schema.SQLite, "things"))
-}
-
-func TestMigrate_ConcurrentFreshCreate(t *testing.T) {
-	// Postgres only: concurrent cold-boots must not race on DDL (CREATE TABLE IF NOT EXISTS is
-	// not atomic); Migrate serializes via an advisory lock. SQLite has a single writer.
-	schemaDSN := dbtest.CreateTestPostgresSchema(t)
-	const n = 8
-	errs := make(chan error, n)
-	for i := 0; i < n; i++ {
-		go func() {
-			host, err := pg.Open(schemaDSN)
-			if err != nil {
-				errs <- err
-				return
-			}
-			defer host.DB.Close()
-			errs <- schema.Migrate(host.DB, schema.Postgres, "things", 1, testCreate, nil)
-		}()
-	}
-	for i := 0; i < n; i++ {
-		require.Nil(t, <-errs)
-	}
-}
-
-func storeVersion(t *testing.T, d *sql.DB, dialect schema.Dialect, store string) int {
-	t.Helper()
-	var version int
-	if dialect == schema.Postgres {
-		require.Nil(t, d.QueryRow(`SELECT version FROM schema_version WHERE store = $1`, store).Scan(&version), fmt.Sprintf("store %s", store))
-	} else {
-		require.Nil(t, d.QueryRow(`SELECT version FROM schemaVersion WHERE id = 1`).Scan(&version), fmt.Sprintf("store %s", store))
-	}
-	return version
-}

db/schema/types.go

@@ -1,31 +0,0 @@
-package schema
-
-import "database/sql"
-
-// Dialect selects the SQL flavor Migrate speaks to the version table.
-type Dialect int
-
-// Supported dialects; SQLite is the zero value
-const (
-	SQLite Dialect = iota
-	Postgres
-)
-
-// MigrateFunc applies one schema change inside the setup transaction: the initial creation of
-// a store's tables, or one step upgrading a store from version N to N+1. Migrations needing
-// config capture it via closure, e.g. func migrations(cacheDuration time.Duration) map[int]MigrateFunc.
-type MigrateFunc func(tx *sql.Tx) error
-
-// AsMigrateFunc converts a simple query to a migration function
-func AsMigrateFunc(query string) MigrateFunc {
-	return func(tx *sql.Tx) error {
-		_, err := tx.Exec(query)
-		return err
-	}
-}
-
-// NopMigrateFunc is a migration step that does nothing, for versions where a dialect has no
-// work to do (e.g. when only the other dialect's schema changed).
-func NopMigrateFunc(_ *sql.Tx) error {
-	return nil
-}

db/test/schema.go

@@ -1,185 +0,0 @@
-package dbtest
-
-import (
-	"database/sql"
-	"fmt"
-	"sort"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// Querier is the subset of *sql.DB / *db.DB needed to introspect a schema.
-type Querier interface {
-	Query(query string, args ...any) (*sql.Rows, error)
-}
-
-// SQLiteSchema returns a normalized, comparable description of the database schema: tables
-// with their columns, named indexes, and foreign keys. Column order, declared type spelling
-// (INT vs INTEGER) and default values are not part of the description, so the schema produced
-// by a migration chain can be compared to a freshly created one.
-func SQLiteSchema(t testing.TB, d Querier) string {
-	t.Helper()
-	lines := make([]string, 0)
-	for _, table := range sqliteTables(t, d) {
-		lines = append(lines, "table "+table)
-		lines = append(lines, sqliteColumns(t, d, table)...)
-		lines = append(lines, sqliteForeignKeys(t, d, table)...)
-		lines = append(lines, sqliteIndexes(t, d, table)...)
-	}
-	return strings.Join(lines, "\n")
-}
-
-// PostgresSchema is SQLiteSchema's PostgreSQL counterpart, describing the current schema's
-// tables, columns, constraints and indexes in a normalized, comparable way.
-func PostgresSchema(t testing.TB, d Querier) string {
-	t.Helper()
-	lines := make([]string, 0)
-	for _, table := range postgresTables(t, d) {
-		lines = append(lines, "table "+table)
-		lines = append(lines, postgresColumns(t, d, table)...)
-	}
-	lines = append(lines, postgresConstraints(t, d)...)
-	lines = append(lines, postgresIndexes(t, d)...)
-	return strings.Join(lines, "\n")
-}
-
-func sqliteTables(t testing.TB, d Querier) []string {
-	t.Helper()
-	return queryStrings(t, d, `SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name`)
-}
-
-func sqliteColumns(t testing.TB, d Querier, table string) []string {
-	t.Helper()
-	rows, err := d.Query(fmt.Sprintf(`PRAGMA table_info(%q)`, table))
-	require.Nil(t, err)
-	defer rows.Close()
-	lines := make([]string, 0)
-	for rows.Next() {
-		var cid, notNull, pk int
-		var name, typ string
-		var dflt sql.NullString
-		require.Nil(t, rows.Scan(&cid, &name, &typ, &notNull, &dflt, &pk))
-		typ = strings.ToUpper(typ)
-		if typ == "INT" { // INT and INTEGER are the same affinity; migrations spell them inconsistently
-			typ = "INTEGER"
-		}
-		lines = append(lines, fmt.Sprintf("  col %s %s notnull=%d pk=%d", name, typ, notNull, pk))
-	}
-	require.Nil(t, rows.Err())
-	sort.Strings(lines)
-	return lines
-}
-
-func sqliteForeignKeys(t testing.TB, d Querier, table string) []string {
-	t.Helper()
-	rows, err := d.Query(fmt.Sprintf(`PRAGMA foreign_key_list(%q)`, table))
-	require.Nil(t, err)
-	defer rows.Close()
-	lines := make([]string, 0)
-	for rows.Next() {
-		var id, seq int
-		var refTable, from, onUpdate, onDelete, match string
-		var to sql.NullString // NULL when referencing the parent's primary key implicitly
-		require.Nil(t, rows.Scan(&id, &seq, &refTable, &from, &to, &onUpdate, &onDelete, &match))
-		lines = append(lines, fmt.Sprintf("  fk %s -> %s(%s) on_delete=%s", from, refTable, to.String, onDelete))
-	}
-	require.Nil(t, rows.Err())
-	sort.Strings(lines)
-	return lines
-}
-
-func sqliteIndexes(t testing.TB, d Querier, table string) []string {
-	t.Helper()
-	rows, err := d.Query(fmt.Sprintf(`PRAGMA index_list(%q)`, table))
-	require.Nil(t, err)
-	type index struct {
-		name            string
-		unique, partial int
-	}
-	indexes := make([]index, 0)
-	for rows.Next() {
-		var seq, unique, partial int
-		var name, origin string
-		require.Nil(t, rows.Scan(&seq, &name, &unique, &origin, &partial))
-		// Skip auto-indexes backing PRIMARY KEY/UNIQUE table constraints; those are described
-		// by the column and constraint listings already
-		if strings.HasPrefix(name, "sqlite_autoindex_") {
-			continue
-		}
-		indexes = append(indexes, index{name, unique, partial})
-	}
-	require.Nil(t, rows.Err())
-	require.Nil(t, rows.Close())
-	lines := make([]string, 0, len(indexes))
-	for _, idx := range indexes {
-		cols := queryStrings(t, d, fmt.Sprintf(`SELECT name FROM pragma_index_info(%q) ORDER BY seqno`, idx.name))
-		lines = append(lines, fmt.Sprintf("  index %s unique=%d partial=%d cols=(%s)", idx.name, idx.unique, idx.partial, strings.Join(cols, ",")))
-	}
-	sort.Strings(lines)
-	return lines
-}
-
-func postgresTables(t testing.TB, d Querier) []string {
-	t.Helper()
-	return queryStrings(t, d, `SELECT table_name FROM information_schema.tables WHERE table_schema = current_schema() AND table_type = 'BASE TABLE' ORDER BY table_name`)
-}
-
-func postgresColumns(t testing.TB, d Querier, table string) []string {
-	t.Helper()
-	rows, err := d.Query(`SELECT column_name, data_type, is_nullable FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = $1 ORDER BY column_name`, table)
-	require.Nil(t, err)
-	defer rows.Close()
-	lines := make([]string, 0)
-	for rows.Next() {
-		var name, typ, nullable string
-		require.Nil(t, rows.Scan(&name, &typ, &nullable))
-		lines = append(lines, fmt.Sprintf("  col %s %s nullable=%s", name, typ, nullable))
-	}
-	require.Nil(t, rows.Err())
-	return lines
-}
-
-func postgresConstraints(t testing.TB, d Querier) []string {
-	t.Helper()
-	return queryStrings(t, d, `
-		SELECT 'constraint ' || conrelid::regclass::text || ': ' || pg_get_constraintdef(oid)
-		FROM pg_constraint
-		WHERE connamespace = current_schema()::regnamespace
-		ORDER BY 1
-	`)
-}
-
-func postgresIndexes(t testing.TB, d Querier) []string {
-	t.Helper()
-	rows, err := d.Query(`SELECT indexname, indexdef, schemaname FROM pg_indexes WHERE schemaname = current_schema() ORDER BY indexname`)
-	require.Nil(t, err)
-	defer rows.Close()
-	lines := make([]string, 0)
-	for rows.Next() {
-		var name, def, schema string
-		require.Nil(t, rows.Scan(&name, &def, &schema))
-		// The index definition qualifies the table with the (test-specific) schema name; strip
-		// it so snapshots from different test schemas compare equal
-		def = strings.ReplaceAll(def, schema+".", "")
-		lines = append(lines, "index "+def)
-	}
-	require.Nil(t, rows.Err())
-	return lines
-}
-
-func queryStrings(t testing.TB, d Querier, query string) []string {
-	t.Helper()
-	rows, err := d.Query(query)
-	require.Nil(t, err)
-	defer rows.Close()
-	values := make([]string, 0)
-	for rows.Next() {
-		var value string
-		require.Nil(t, rows.Scan(&value))
-		values = append(values, value)
-	}
-	require.Nil(t, rows.Err())
-	return values
-}

db/test/test.go

@@ -1,64 +0,0 @@
-package dbtest
-
-import (
-	"fmt"
-	"net/url"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/db"
-	"heckel.io/ntfy/v2/db/pg"
-	"heckel.io/ntfy/v2/util"
-)
-
-const testPoolMaxConns = "2"
-
-// CreateTestPostgresSchema creates a temporary PostgreSQL schema and returns the DSN pointing to it.
-// It registers a cleanup function to drop the schema when the test finishes.
-// If NTFY_TEST_DATABASE_URL is not set, the test is skipped.
-func CreateTestPostgresSchema(t testing.TB) string {
-	t.Helper()
-	dsn := os.Getenv("NTFY_TEST_DATABASE_URL")
-	if dsn == "" {
-		t.Skip("NTFY_TEST_DATABASE_URL not set")
-	}
-	schema := fmt.Sprintf("test_%s", util.RandomString(10))
-	u, err := url.Parse(dsn)
-	require.Nil(t, err)
-	q := u.Query()
-	q.Set("pool_max_conns", testPoolMaxConns)
-	u.RawQuery = q.Encode()
-	dsn = u.String()
-	setupHost, err := pg.Open(dsn)
-	require.Nil(t, err)
-	_, err = setupHost.DB.Exec(fmt.Sprintf("CREATE SCHEMA %s", schema))
-	require.Nil(t, err)
-	require.Nil(t, setupHost.DB.Close())
-	q.Set("search_path", schema)
-	u.RawQuery = q.Encode()
-	schemaDSN := u.String()
-	t.Cleanup(func() {
-		cleanHost, err := pg.Open(dsn)
-		if err == nil {
-			cleanHost.DB.Exec(fmt.Sprintf("DROP SCHEMA %s CASCADE", schema))
-			cleanHost.DB.Close()
-		}
-	})
-	return schemaDSN
-}
-
-// CreateTestPostgres creates a temporary PostgreSQL schema and returns an open *db.DB connection to it.
-// It registers cleanup functions to close the DB and drop the schema when the test finishes.
-// If NTFY_TEST_DATABASE_URL is not set, the test is skipped.
-func CreateTestPostgres(t testing.TB) *db.DB {
-	t.Helper()
-	schemaDSN := CreateTestPostgresSchema(t)
-	testHost, err := pg.Open(schemaDSN)
-	require.Nil(t, err)
-	d := db.New(testHost, nil)
-	t.Cleanup(func() {
-		d.Close()
-	})
-	return d
-}

db/types.go

@@ -1,25 +0,0 @@
-package db
-
-import (
-	"database/sql"
-	"sync/atomic"
-)
-
-// Beginner is an interface for types that can begin a database transaction.
-// Both *sql.DB and *DB implement this.
-type Beginner interface {
-	Begin() (*sql.Tx, error)
-}
-
-// Querier is an interface for types that can execute SQL queries.
-// *sql.DB, *sql.Tx, and *DB all implement this.
-type Querier interface {
-	Query(query string, args ...any) (*sql.Rows, error)
-}
-
-// Host pairs a *sql.DB with the host:port it was opened against.
-type Host struct {
-	Addr    string // "host:port"
-	DB      *sql.DB
-	healthy atomic.Bool
-}

db/util.go

@@ -1,36 +0,0 @@
-package db
-
-import "database/sql"
-
-// ExecTx executes a function within a database transaction. If the function returns an error,
-// the transaction is rolled back. Otherwise, the transaction is committed.
-func ExecTx(db Beginner, f func(tx *sql.Tx) error) error {
-	tx, err := db.Begin()
-	if err != nil {
-		return err
-	}
-	defer tx.Rollback()
-	if err := f(tx); err != nil {
-		return err
-	}
-	return tx.Commit()
-}
-
-// QueryTx executes a function within a database transaction and returns the result. If the function
-// returns an error, the transaction is rolled back. Otherwise, the transaction is committed.
-func QueryTx[T any](db Beginner, f func(tx *sql.Tx) (T, error)) (T, error) {
-	tx, err := db.Begin()
-	if err != nil {
-		var zero T
-		return zero, err
-	}
-	defer tx.Rollback()
-	t, err := f(tx)
-	if err != nil {
-		return t, err
-	}
-	if err := tx.Commit(); err != nil {
-		return t, err
-	}
-	return t, nil
-}

docker-compose.yml

@@ -1,3 +1,4 @@
+version: "2.1"
 services:
   ntfy:
     image: binwiederhier/ntfy
@@ -13,3 +14,4 @@ services:
     ports:
       - 80:80
     restart: unless-stopped
+

docs/_overrides/main.html

@@ -1,50 +0,0 @@
-{% extends "base.html" %}
-
-{% block announce %}
-<style>
-    div[data-md-component="announce"] {
-        z-index: 10;
-    }
-
-    div[data-md-component="announce"] a {
-        color: white;
-    }
-
-    div[data-md-component="announce"] a:hover, div[data-md-component="announce"] a:focus {
-        transition: ease-in 150ms;
-        color: #ccc;
-    }
-
-    div[data-md-component="announce"] .md-banner__button {
-        color: #ccc;
-    }
-
-    div[data-md-component="announce"] .md-banner.hidden {
-        display: none;
-    }
-
-    div[data-md-component="announce"] .twemoji {
-        margin-top: 2px;
-    }
-</style>
-<button id="announce-bar-close" class="md-banner__button md-icon" aria-label="Don't show this again">
-    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
-        <path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12 19 6.41Z"></path>
-    </svg>
-</button>
-If you like ntfy, please consider sponsoring me via <a target="_blank" href="https://github.com/sponsors/binwiederhier"><strong>GitHub Sponsors</strong></a>
-or <a target="_blank" href="https://en.liberapay.com/ntfy/"><strong>Liberapay</strong></a>
-<svg xmlns="http://www.w3.org/2000/svg" role="img" viewBox="0 0 36 36" class="twemoji md-footer-custom-text">
-    <path fill="#DD2E44" d="M35.885 11.833c0-5.45-4.418-9.868-9.867-9.868-3.308 0-6.227 1.633-8.018 4.129-1.791-2.496-4.71-4.129-8.017-4.129-5.45 0-9.868 4.417-9.868 9.868 0 .772.098 1.52.266 2.241C1.751 22.587 11.216 31.568 18 34.034c6.783-2.466 16.249-11.447 17.617-19.959.17-.721.268-1.469.268-2.242z"/>
-</svg>, or subscribing to <a target="_blank" href="https://ntfy.sh/app"><strong>ntfy Pro</strong></a>.
-<script>
-    announceBarKey = 'announce-bar-closed-sponsor';
-    document.getElementById('announce-bar-close').addEventListener('click', (e) => {
-        localStorage.setItem(announceBarKey, 'true');
-        document.querySelector('div[data-md-component="announce"] .md-banner').style.display = 'none';
-    });
-    if (localStorage.getItem(announceBarKey) === 'true') {
-        document.querySelector('div[data-md-component="announce"] .md-banner').style.display = 'none';
-    }
-</script>
-{% endblock %}