flake.lock: Update

Flake lock file updates:

• Updated input 'home-manager-unstable':
    'github:nix-community/home-manager/e1aec543f5caf643ca0d94b6a633101942fd065f?narHash=sha256-ZHFrGNWDDriZ4m8CA/5kDa250SG1LiiLPApv1p/JF0o%3D' (2024-10-14)
  → 'github:nix-community/home-manager/1e27f213d77fc842603628bcf2df6681d7d08f7e?narHash=sha256-gBOVJv%2Bq6Mx8jGvwX7cE6J8%2BsZmi1uxpRVsO7WxvVuQ%3D' (2024-10-20)
• Updated input 'impermanence':
    'github:nix-community/impermanence/d0b38e550039a72aff896ee65b0918e975e6d48e?narHash=sha256-FA53of86DjFdeQzRDVtvgWF9o52rWK70VHGx0Y8fElQ%3D' (2024-09-29)
  → 'github:nix-community/impermanence/e337457502571b23e449bf42153d7faa10c0a562?narHash=sha256-C2sGRJl1EmBq0nO98TNd4cbUy20ABSgnHWXLIJQWRFA%3D' (2024-10-16)
• Updated input 'nix-index-database':
    'github:nix-community/nix-index-database/5c54c33aa04df5dd4b0984b7eb861d1981009b22?narHash=sha256-grMdAd4KSU6uPqsfLzA1B/3pb9GtGI9o8qb0qFzEU/Y%3D' (2024-10-13)
  → 'github:nix-community/nix-index-database/04f8a11f247ba00263b060fbcdc95484fd046104?narHash=sha256-2ntUG%2BNJKdfhlrh/tF%2BjOU0fOesO7lm5ZZVSYitsvH8%3D' (2024-10-20)
• Updated input 'nixos-hardware':
    'github:NixOS/nixos-hardware/a8dd1b21995964b115b1e3ec639dd6ce24ab9806?narHash=sha256-oazkQ/z7r43YkDLLQdMg8oIB3CwWNb%2B2ZrYOxtLEWTQ%3D' (2024-10-12)
  → 'github:NixOS/nixos-hardware/cc2d3c0e060f981905d52337340ee6ec8b8eb037?narHash=sha256-8OHgqz%2BtFo21h3hg4/GHizFPws%2BMMzpEru/%2B62Z0E8c%3D' (2024-10-21)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/a3f9ad65a0bf298ed5847629a57808b97e6e8077?narHash=sha256-u%2BrxA79a0lyhG%2Bu%2BoPBRtTDtzz8kvkc9a6SWSt9ekVc%3D' (2024-10-12)
  → 'github:NixOS/nixpkgs/a9b86fc2290b69375c5542b622088eb6eca2a7c3?narHash=sha256-QUvb6epgKi9pCu9CttRQW4y5NqJ%2BsnKr1FZpG/x3Wtc%3D' (2024-10-19)
• Updated input 'nixpkgs-unstable':
    'github:NixOS/nixpkgs/5633bcff0c6162b9e4b5f1264264611e950c8ec7?narHash=sha256-9UTxR8eukdg%2BXZeHgxW5hQA9fIKHsKCdOIUycTryeVw%3D' (2024-10-09)
  → 'github:NixOS/nixpkgs/4c2fcb090b1f3e5b47eaa7bd33913b574a11e0a0?narHash=sha256-/uilDXvCIEs3C9l73JTACm4quuHUsIHcns1c%2BcHUJwA%3D' (2024-10-18)

flake.lock

@@ -85,11 +85,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1728903686,
+        "lastModified": 1729459288,
-        "narHash": "sha256-ZHFrGNWDDriZ4m8CA/5kDa250SG1LiiLPApv1p/JF0o=",
+        "narHash": "sha256-gBOVJv+q6Mx8jGvwX7cE6J8+sZmi1uxpRVsO7WxvVuQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e1aec543f5caf643ca0d94b6a633101942fd065f",
+        "rev": "1e27f213d77fc842603628bcf2df6681d7d08f7e",
         "type": "github"
       },
       "original": {
@@ -101,11 +101,11 @@
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1727649413,
+        "lastModified": 1729068498,
-        "narHash": "sha256-FA53of86DjFdeQzRDVtvgWF9o52rWK70VHGx0Y8fElQ=",
+        "narHash": "sha256-C2sGRJl1EmBq0nO98TNd4cbUy20ABSgnHWXLIJQWRFA=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "d0b38e550039a72aff896ee65b0918e975e6d48e",
+        "rev": "e337457502571b23e449bf42153d7faa10c0a562",
         "type": "github"
       },
       "original": {
@@ -121,11 +121,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1728790083,
+        "lastModified": 1729394935,
-        "narHash": "sha256-grMdAd4KSU6uPqsfLzA1B/3pb9GtGI9o8qb0qFzEU/Y=",
+        "narHash": "sha256-2ntUG+NJKdfhlrh/tF+jOU0fOesO7lm5ZZVSYitsvH8=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "5c54c33aa04df5dd4b0984b7eb861d1981009b22",
+        "rev": "04f8a11f247ba00263b060fbcdc95484fd046104",
         "type": "github"
       },
       "original": {
@@ -136,11 +136,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1728729581,
+        "lastModified": 1729509737,
-        "narHash": "sha256-oazkQ/z7r43YkDLLQdMg8oIB3CwWNb+2ZrYOxtLEWTQ=",
+        "narHash": "sha256-8OHgqz+tFo21h3hg4/GHizFPws+MMzpEru/+62Z0E8c=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a8dd1b21995964b115b1e3ec639dd6ce24ab9806",
+        "rev": "cc2d3c0e060f981905d52337340ee6ec8b8eb037",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1728740863,
+        "lastModified": 1729307008,
-        "narHash": "sha256-u+rxA79a0lyhG+u+oPBRtTDtzz8kvkc9a6SWSt9ekVc=",
+        "narHash": "sha256-QUvb6epgKi9pCu9CttRQW4y5NqJ+snKr1FZpG/x3Wtc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a3f9ad65a0bf298ed5847629a57808b97e6e8077",
+        "rev": "a9b86fc2290b69375c5542b622088eb6eca2a7c3",
         "type": "github"
       },
       "original": {
@@ -183,11 +183,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1728492678,
+        "lastModified": 1729256560,
-        "narHash": "sha256-9UTxR8eukdg+XZeHgxW5hQA9fIKHsKCdOIUycTryeVw=",
+        "narHash": "sha256-/uilDXvCIEs3C9l73JTACm4quuHUsIHcns1c+cHUJwA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5633bcff0c6162b9e4b5f1264264611e950c8ec7",
+        "rev": "4c2fcb090b1f3e5b47eaa7bd33913b574a11e0a0",
         "type": "github"
       },
       "original": {

hosts/sigma/default.nix

@@ -16,6 +16,7 @@
     ./matrix.nix
     ./memos.nix
     ./network.nix
+    ./ntfy.nix
     ./postgresql.nix
     ./samba.nix
     ./sonarr.nix

hosts/sigma/ntfy.nix

@@ -0,0 +1,48 @@
+{...}: {
+  # UnifiedPush lets the user choose how push notifications are delivered
+  # instead of relying on Google Firebase. It involves four components:
+  #  - Application Server (e.g. Matrix Synapse).
+  #  - UnifiedPush Server (e.g ntfy-sh).
+  #  - UnifiedPush Distributor Android App (e.g. ntfy).
+  #  - Android app (e.g. Matrix ElementX).
+  # Communication between the UnifiedPush Server and Distributor App is not
+  # part of the spec; we must use either e.g. ntfy-sh/ntfy or
+  # NextCloud/NextPush.
+  #
+  # For example, ElementX registers for notifications with the ntfy app, which
+  # provides ElementX with a webhook URL (topic) on the ntfy-sh server.
+  # ElementX tells Synapse to send notifications through the webhook. On new
+  # messages, Synapse makes a HTTP POST request to the ntfy-sh server, which
+  # contacts the ntfy app through its persistent websocket connection, which
+  # wakes up ElementX and tells it to fetch the notification contents from
+  # Synapse.
+  #
+  # Webhook (topics) are created on the fly by subscribing or publishing to
+  # them. By default, the ntfy-sh server allows anyone to use the server
+  # without authentication. Because of this, the webhook is essentially a
+  # password and should be kept secret. This is normally the case and therefore
+  # not a confidentiality issue, although it can be a availability concern if
+  # malicious actors abuse the service.
+  #
+  # NOTE: the ntfy app defaults to the centralised ntfy.sh server. Element does
+  # not seem to overwrite prior webhooks, but instead append new ones.
+  # Therefore, if it manages to register before the ntfy app's server is
+  # changed, Synapse will contact the ntfy.sh server forever. Check with:
+  # > sudo -u matrix-synapse psql -c 'select * from pushers;'
+  # https://unifiedpush.org/
+  # https://f-droid.org/2022/12/18/unifiedpush.html
+  # https://f-droid.org/en/packages/io.heckel.ntfy/
+  services.ntfy-sh = {
+    enable = true;
+    # https://docs.ntfy.sh/config/#config-options
+    settings = {
+      base-url = "https://ntfy.caspervk.net";
+      behind-proxy = true;
+      # Disable default centralised https://ntfy.sh server
+      # https://docs.ntfy.sh/config/#ios-instant-notifications
+      upstream-base-url = "";
+      # Disable web interface
+      web-root = "disable";
+    };
+  };
+}