personal_infra/ansible/services/ntfy/deploy_ntfy_playbook.yml

- name: Deploy ntfy and configure Caddy reverse proxy
  hosts: observability
  become: yes
  vars_files:
    - ./ntfy_vars.yml
  vars:
    ntfy_subdomain: "{{ subdomains.ntfy }}"
    ntfy_domain: "{{ ntfy_subdomain }}.{{ root_domain }}"

  tasks:
    - name: Ensure /etc/apt/keyrings exists
      file:
        path: /etc/apt/keyrings
        state: directory
        mode: '0755'

    - name: Download and dearmor ntfy GPG key
      shell: curl -fsSL https://archive.heckel.io/apt/pubkey.txt | gpg --dearmor -o /etc/apt/keyrings/archive.heckel.io.gpg
      args:
        creates: /etc/apt/keyrings/archive.heckel.io.gpg

    - name: Add ntfy APT repository
      copy:
        dest: /etc/apt/sources.list.d/archive.heckel.io.list
        content: |
          deb [arch=amd64 signed-by=/etc/apt/keyrings/archive.heckel.io.gpg] https://archive.heckel.io/apt debian main
        mode: '0644'

    - name: Update APT cache
      apt:
        update_cache: yes

    - name: Install ntfy
      apt:
        name: ntfy
        state: present

    - name: Ensure ntfy cache directories exist
      file:
        path: "{{ item }}"
        state: directory
        owner: ntfy
        group: ntfy
        mode: '0755'
      loop:
        - /var/cache/ntfy
        - /var/cache/ntfy/attachments

    - name: Deploy ntfy configuration file
      copy:
        dest: /etc/ntfy/server.yml
        content: |
          base-url: "http://{{ ntfy_domain }}"
          listen-http: ":{{ ntfy_port }}"
          cache-file: "/var/cache/ntfy/cache.db"
          attachment-cache-dir: "/var/cache/ntfy/attachments"
          behind-proxy: true
          auth-file: "/var/lib/ntfy/user.db"
          auth-default-access: "deny-all"
        owner: root
        group: root
        mode: '0644'
      notify: Restart ntfy

    - name: Enable and start ntfy service
      systemd:
        name: ntfy
        enabled: yes
        state: started
    
    - name: Create ntfy admin user
      shell: |
        (echo "{{ ntfy_password }}"; echo "{{ ntfy_password }}") | ntfy user add --role=admin "{{ ntfy_username }}"

    - name: Publish ntfy through Caddy
      ansible.builtin.include_role:
        name: caddy_site
      vars:
        caddy_site_name: ntfy
        caddy_site_domain: "{{ ntfy_domain }}, http://{{ ntfy_domain }}"
        # Raw body: ntfy needs a plain-HTTP listener for its CLI/app clients,
        # with only GETs to the docs and topic paths redirected to HTTPS.
        caddy_site_body: |
          reverse_proxy 127.0.0.1:{{ ntfy_port }}

          @httpget {
              protocol http
              method GET
              path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
          }
          redir @httpget https://{host}{uri}

  handlers:
    - name: Restart ntfy
      systemd:
        name: ntfy
        state: restarted