Infrastructure & Operations / Built / deployed
Private Alert Delivery
Self-hosted ntfy alert path from Alertmanager to a private Tailscale HTTPS endpoint with isolated publisher/subscriber identities and no public push dependency.
OVERVIEW
What I built.
Self-hosted ntfy alert path from Alertmanager to a private Tailscale HTTPS endpoint with isolated publisher/subscriber identities and no public push dependency.
Built a self-hosted ntfy notification path for infrastructure alerts.
Created separate write-only alert publisher and read-only client identities.
Kept delivery private over Tailscale HTTPS with no dependency on ntfy.sh, public Funnel, Telegram or SMTP.
SYSTEM ARCHITECTURE
How the system is divided.
Prometheus -> Alertmanager -> private ntfy -> Tailscale Serve HTTPS -> phone/client.
Persistent auth/cache state remains local and is included only in encrypted DR.
Alert severity maps to ntfy priority while firing/resolved states remain visible.
NETWORK / DATA FLOW
What talks to what.
TECHNOLOGY STACK
The technical surface.
IMPLEMENTATION
How it works in practice.
- 01
Prometheus -> Alertmanager -> private ntfy -> Tailscale Serve HTTPS -> phone/client.
- 02
Persistent auth/cache state remains local and is included only in encrypted DR.
- 03
Alert severity maps to ntfy priority while firing/resolved states remain visible.
TESTING & VALIDATION
How I know it works.
ntfy health
Publisher/subscriber ACL behavior
Alertmanager delivery
Firing/resolved formatting
Tailscale private HTTPS path
LAN fallback health
EXTERNAL SERVICES & DEPENDENCIES
What sits outside the core.
ENGINEERING EVIDENCE
Artifacts behind the claims.
BOUNDARIES / CONSTRAINTS
What the project does not pretend to solve.
—No anonymous access
—No ntfy.sh/APNS upstream
—Funnel remains disabled
—Auth/cache database is treated as sensitive state
RESULT / CURRENT STATE
What this produced.
A private mobile alert channel that remains under local operational control.