ntfy — push notifications

ntfy is the rack's self-hosted push-notification channel — the second alert path besides email, independent of Telegram and of any third party. Installed 2026-08-16 as part of the admin wave, primarily as the notification target of Healthchecks.

Guest	srv-ntfy — unprivileged LXC, CT 116 on rumba, 192.168.88.167, 1 core / 512 MB / 4 GB local-lvm, nesting=1
URL	http://srv-ntfy.isc3/ — VPN/LAN only, ntfy listens on 80 itself (no Caddy), not published through srv-web01. Phones must be on the VPN to receive
Auth	deny-all — the VPN also carries students, so nothing is anonymous. Two accounts (passwords in secretzone/rumba.md): publisher (write any topic — used by Healthchecks and scripts), reader (read any topic — phone subscriptions)
Managed from	provisioning/ntfy/ — deploy-ntfy.sh (idempotent; re-run upgrades to the latest release)

Publishing from a script:

curl -u "publisher:<password>" -H "Title: PBS sync failed" -d "details…" http://srv-ntfy.isc3/rack-alerts

Subscribing on a phone: install the ntfy app, add the server http://srv-ntfy.isc3 with the reader account, subscribe to rack-alerts (topics are created on first use; use one topic per concern rather than one big topic).