version: "3.9"
services:
  ntfy:
    image: binwiederhier/ntfy
    command:
      - serve
    volumes:
      - /docker/conf/ntfy:/etc/ntfy
      - /docker/data/ntfy:/var/cache/ntfy
    environment:
      TZ: Europe/Moscow
    networks:
      - traefik-public
    healthcheck:
        test: ["CMD-SHELL", "wget -q --tries=1 http://localhost:80/v1/health -O - | grep -Eo '\"healthy\"\\s*:\\s*true' || exit 1"]
        interval: 60s
        timeout: 10s
        retries: 3
        start_period: 40s
    deploy:
      replicas: 1
      restart_policy:
        condition: any
        delay: 5s
        window: 120s
      update_config:
        parallelism: 1
        monitor: 60s
        failure_action: rollback
        order: start-first
      resources:
        limits:
          memory: "128M"
        reservations:
          memory: "64M"
      placement:
        constraints: [node.role == worker]
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.ntfy.rule=Host(`ntfy.example.ru`)"
        - "traefik.http.routers.ntfy.entrypoints=https"
        - "traefik.http.routers.ntfy.tls=true"
        - "traefik.http.routers.ntfy.middlewares=WhitelistHome,CORS@file"
        - "traefik.http.services.ntfy.loadbalancer.server.port=80"


networks:
  traefik-public:
    external: true

/ # ntfy user list
user * (role: anonymous, tier: none)
- no topic-specific permissions
- no access to any (other) topics (server config)
/ # ntfy access
user * (role: anonymous, tier: none)
- no topic-specific permissions
- no access to any (other) topics (server config)
/ # ntfy user add --role=admin daffin
user daffin added with role admin
/ #

/ # ntfy access
user daffin (role: admin, tier: none)
- read-write access to all topics (admin role)
user * (role: anonymous, tier: none)
- no topic-specific permissions
- no access to any (other) topics (server config)