{ config, pkgs, ... }:

{
  services.ntfy-sh = {
    enable = true;
    settings = {
      base-url = "https://ntfy.extremist.software";
      listen-http = ":2586";
      behind-proxy = true;
      auth-file = "/var/lib/ntfy-sh/user.db";
      auth-default-access = "deny-all";
      enable-login = true;
      auth-users = [
        "jet:${config.mySecrets.ntfyAdminHash}:admin"
      ];
      auth-access = [
        "*:up*:write-only"
      ];
    };
  };
}