Start an ntfy server with deny-all access and a planned token model
Start an ntfy server with deny-all access and a planned token model Self-hosted notification services often begin as a simple way to send a message. The deployment later holds deployment alerts, backup status, security
Start an ntfy server with deny-all access and a planned token model
Self-hosted notification services often begin as a simple way to send a message. The deployment later holds deployment alerts, backup status, security events, and mobile push credentials. An ntfy server that still treats topic names as secrets is not ready for that role.
ntfy supports user and admin roles plus per-topic read and write permissions. Its documentation describes an access control list, access tokens, and a configuration option for a default access policy. The strongest starting point is auth-default-access: deny-all, followed by explicit user and topic entries. An allow-by-default server asks every topic owner to remember a setting, which is difficult to audit as the number of integrations grows.
Treat a topic as a resource
A topic name is not a password in a deny-all design. It identifies a publish and subscribe resource. The ACL should state which identity may read it, which identity may write it, and whether an anonymous sender is allowed. For a production alert channel, anonymous write access lets anyone with the URL inject false alerts or fill a notification queue. Anonymous read access can disclose operational details embedded in the message body.
Use separate topics for different trust boundaries. A backup agent does not need access to a security incident topic simply because both run in the same environment. A monitoring system may need write access to several topics and read access to none. A mobile client may need read access to one topic and no ability to publish. Model those relationships directly instead of creating a shared administrator token.
Plan token creation and retirement
ntfy tokens can be created through the command line or the web interface and can also be provisioned in server configuration. A token label should identify the workload or person, not a shared team name that survives staff changes. Keep a record of the issuing user, intended topic, permission set, creation date, owner, and retirement condition.
Prefer separate tokens for separate automation. If an agent token is copied into a chat message or included in a support bundle, the response can revoke one path without breaking every notifier. Set a review interval even if the server does not enforce expiry. A token with no known owner is a credential without an accountable custodian.
The server configuration may contain token values. Protect that file like any other secret store. Do not put it in a repository with broad developer access or print it in diagnostics. If tokens are provisioned declaratively, ensure the deployment pipeline uses encrypted secrets and limits who can read the rendered configuration.
Test from outside the trusted path
Use a signed-out or unprivileged client to attempt all four actions: publish to a protected topic, subscribe to it, publish to an unrelated topic, and read an administrative route. Record the expected denial. Then repeat with an authorized token for the specific topic and confirm that the scope is narrow.
Test the reverse proxy and TLS path separately. ntfy may be healthy on localhost while an upstream proxy adds a path prefix, forwards an administrator header, or exposes a metrics route. The application ACL does not compensate for a network device that bypasses it.
Review browser clients and mobile clients for cached messages. A revoked token stops new subscriptions, but it may not clear content already stored on a device. If a topic carried sensitive alert data, the incident response should include client-side data removal and an assessment of notification previews.
Make the default obvious
Configuration management should show the default access policy, the user list, and the ACL table in a reviewable diff. A temporary allow rule should include an expiry date and a change ticket. When an integration is removed, delete its token and its ACL entry. Leaving a dormant rule is how a simple notification service becomes an unmanaged message bus.
Alerting systems are part of the security control plane. A false message can trigger a destructive runbook, and a missing message can hide an outage. The practical standard is an explicit identity, an explicit topic, an explicit direction of access, and a known owner. That is more work than typing a memorable topic name. It also gives the team a defensible answer when someone asks who can read an incident channel.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.