feat: Adds access control configuration for ntfy (#15932)
Co-authored-by: ilyam8 <ilya@netdata.cloud>
Mike Iversen committed
Sep 12, 2023 at 07:28 UTC
13e6354d3d803112beef003bf0a3210474b5dfdd
4 files changed
+77
health/notifications/alarm-notify.sh.in
+14
@@ -2450,9 +2450,23 @@ send_ntfy() {
2450
*) priority="default" ;;
2451
esac
2452
2453
+ # Adding ntfy header generation logic
2454
+ # Heavily inspired by https://github.com/nickexyz/ntfy-shellscripts/blob/main/sabnzbd.sh
2455
+ tmp_header=""
2456
+ if [[ -n "${NTFY_USERNAME}" ]] && [[ -n "${NTFY_PASSWORD}" ]]; then
2457
+ ntfy_base64=$( echo -n "$NTFY_USERNAME:$NTFY_PASSWORD" | base64 )
2458
+ tmp_header="Authorization: Basic ${ntfy_base64}"
2459
+ elif [ -n "${NTFY_ACCESS_TOKEN}" ]; then
2460
+ tmp_header="Authorization: Bearer ${NTFY_ACCESS_TOKEN}"
2461
+ fi
2462
+ ntfy_auth_header=()
2463
+ if [ -n "${tmp_header}" ]; then
2464
+ ntfy_auth_header=("-H" "${tmp_header}")
2465
+ fi
2466
for recipient in ${recipients}; do
2467
msg="${host} ${status_message}: ${alarm} - ${info}"
2468
httpcode=$(docurl -X POST \
2469
+ "${ntfy_auth_header[@]}" \
2470
-H "Icon: https://raw.githubusercontent.com/netdata/netdata/master/web/gui/dashboard/images/favicon-196x196.png" \
2471
-H "Title: ${host}: ${name//_/ }" \
2472
-H "Tags: ${emoji}" \
health/notifications/health_alarm_notify.conf
+9
@@ -860,6 +860,15 @@ DEFAULT_RECIPIENT_MATRIX=""
860
# enable/disable sending ntfy notifications
861
SEND_NTFY="YES"
862
863
+# optional NTFY username
864
+NTFY_USERNAME=""
865
+
866
+# optional NTFY password
867
+NTFY_PASSWORD=""
868
+
869
+# optional NTFY access token
870
+NTFY_ACCESS_TOKEN=""
871
+
872
# if a role's recipients are not configured, a notification will be sent to
873
# this ntfy server / topic combination (empty = do not send a notification for
874
# unconfigured roles).
health/notifications/ntfy/README.md
+33
@@ -17,6 +17,7 @@ This is what you will get:
17
You will need:
18
19
- (Optional) A [self-hosted ntfy server](https://docs.ntfy.sh/faq/#can-i-self-host-it), in case you don't want to use https://ntfy.sh
20
+- (Optional) [Credentials](https://docs.ntfy.sh/config/?h=token#access-control) to publish to a private topic
21
- A new [topic](https://ntfy.sh/#subscribe) for the notifications to be published to
22
- terminal access to the Agent you wish to configure
23
@@ -39,6 +40,38 @@ Edit `health_alarm_notify.conf`, changes to this file do not require restarting
40
You can define multiple recipient URLs like this: `https://SERVER1/TOPIC1 https://SERVER2/TOPIC2`
41
All roles will default to this variable if it is not configured.
42
43
+> ### Authentication
44
+> If you have access to a self hosted instance of ntfy, you can send notifications to private topics provided you have valid credentials to do so
45
+>
46
+
47
+An example of a working configuration utilizing username `netdata` and password `PASSWORD` and a private topic `netdata` on `YOUR_PRIVATE_INSTANCE` would be:
48
+
49
+```conf
50
+SEND_NFTY="YES"
51
+DEFAULT_RECIPIENT_NTFY="https://YOUR_PRIVATE_INSTANCE/netdata"
52
+NTFY_USERNAME="netdata"
53
+NTFY_PASSWORD="PASSWORD"
54
+```
55
+
56
+> ### Note
57
+> Be sure that user `netdata` has `rw` permissions for the topic `netdata`
58
+>
59
+
60
+An example of a working configuration utilizing token `f650986d-566b-45c0-9a63-5ca394dce359` geneated by ntfy for user `netdata` would be:
61
+
62
+```conf
63
+SEND_NFTY="YES"
64
+DEFAULT_RECIPIENT_NTFY="https://YOUR_PRIVATE_INSTANCE/netdata"
65
+NTFY_ACCESS_TOKEN="f650986d-566b-45c0-9a63-5ca394dce359"
66
+```
67
+
68
+> ### Note
69
+> Tokens are generated by ntfy. You will need to utilize a token provided by ntfy. **Do not specify a custom token here**
70
+>
71
+> Ensure the user `netdata` has `rw` permission for the topic `netdata`
72
+>
73
+> If a token and username/password credentials are provided, the token will be used as opposed to the username/password credentials
74
+
75
> ### Warning
76
> All topics published on https://ntfy.sh are public, so anyone can subscribe to them and follow your notifications. To avoid that, ensure the topic is unique enough using a long, randomly generated ID, like in the following examples.
77
>
health/notifications/ntfy/metadata.yaml
+21
@@ -53,6 +53,27 @@
53
role_recipients_ntfy[proxyadmin]="https://SERVER5/TOPIC5"
54
role_recipients_ntfy[sitemgr]="https://SERVER6/TOPIC6"
55
```
56
+ - name: 'NTFY_USERNAME'
57
+ default_value: ''
58
+ description: "The username for netdata to use to authenticate with an ntfy server."
59
+ required: false
60
+ detailed_description: |
61
+ Only useful on self-hosted ntfy instances. See [users and roles](https://docs.ntfy.sh/config/#users-and-roles) for details.
62
+ Ensure that your user has proper read/write access to the provided topic in `DEFAULT_RECIPIENT_NTFY`
63
+ - name: 'NTFY_PASSWORD'
64
+ default_value: ''
65
+ description: "The password for netdata to use to authenticate with an ntfy server."
66
+ required: false
67
+ detailed_description: |
68
+ Only useful on self-hosted ntfy instances. See [users and roles](https://docs.ntfy.sh/config/#users-and-roles) for details.
69
+ Ensure that your user has proper read/write access to the provided topic in `DEFAULT_RECIPIENT_NTFY`
70
+ - name: 'NTFY_ACCESS_TOKEN'
71
+ default_value: ''
72
+ description: "The access token for netdata to use to authenticate with an ntfy server."
73
+ required: false
74
+ detailed_description: |
75
+ This can be used in place of `NTFY_USERNAME` and `NTFY_PASSWORD` to authenticate with a self-hosted ntfy instance. See [access tokens](https://docs.ntfy.sh/config/?h=access+to#access-tokens) for details.
76
+ Ensure that the token user has proper read/write access to the provided topic in `DEFAULT_RECIPIENT_NTFY`
77
examples:
78
folding:
79
enabled: true