homepage: ntfy widget 401/403 -- token is not the one ntfy knows #56

New issue

Open

opened 2026-10-04 13:11:02 +00:00 by lab · 0 comments

lab commented

2026-10-04 13:11:02 +00:00

Owner

The ntfy widget has never worked. Homepage logs 401/403 on every long-poll.

Root cause

It is not just "use a read token" -- two separate things are wrong.

ntfy runs with auth-default-access: deny-all and require-login: true.
Probing from inside the pod with the current token:

request	result
`Authorization: Bearer <token>`	`401 unauthorized`
`Authorization: token <token>`	`403 forbidden`
no auth	`403 forbidden`

The token in homepage-secrets (HOMEPAGE_VAR_NTFY_TOKEN) is a user
access token created in the ntfy web UI. It is a different value from the
static token ntfy actually has configured -- the ntfy-auth secret defines
a static token named lab, and the two do not match.
Because auth-default-access: deny-all, a user access token grants nothing
on its own. The user behind it needs read access to the
homelab-deploys topic. Until that grant exists every read 403s,
regardless of the token's own permission scope.

Steps

Pick an owner for the topic:
- grant the ntfy user read access to homelab-deploys, then issue an
  access token for it, or
- widen the static lab token's topic grant to cover homelab-deploys
  and use that value.

Patch the live secret -- never secret.yaml, it holds placeholders only:

kubectl -n homepage patch secret homepage-secrets --type merge \
  -p '{"stringData":{"HOMEPAGE_VAR_NTFY_TOKEN":"<token>"}}'
kubectl -n homepage rollout restart deploy homepage

Verify history renders. The deploy workflow publishes to
homelab-deploys, so a working token shows messages immediately.

The ntfy widget has never worked. Homepage logs 401/403 on every long-poll. ## Root cause It is **not** just "use a read token" -- two separate things are wrong. `ntfy` runs with `auth-default-access: deny-all` and `require-login: true`. Probing from inside the pod with the current token: | request | result | | --- | --- | | `Authorization: Bearer <token>` | `401 unauthorized` | | `Authorization: token <token>` | `403 forbidden` | | no auth | `403 forbidden` | 1. The token in `homepage-secrets` (`HOMEPAGE_VAR_NTFY_TOKEN`) is a **user access token created in the ntfy web UI**. It is a different value from the static token ntfy actually has configured -- the `ntfy-auth` secret defines a static token named `lab`, and the two do not match. 2. Because `auth-default-access: deny-all`, a user access token grants nothing on its own. The **user** behind it needs read access to the `homelab-deploys` topic. Until that grant exists every read 403s, regardless of the token's own permission scope. ## Steps 1. Pick an owner for the topic: - grant the ntfy user read access to `homelab-deploys`, then issue an access token for it, or - widen the static `lab` token's topic grant to cover `homelab-deploys` and use that value. 2. Patch the live secret -- never `secret.yaml`, it holds placeholders only: ```bash kubectl -n homepage patch secret homepage-secrets --type merge \ -p '{"stringData":{"HOMEPAGE_VAR_NTFY_TOKEN":"<token>"}}' kubectl -n homepage rollout restart deploy homepage ``` 3. Verify history renders. The deploy workflow publishes to `homelab-deploys`, so a working token shows messages immediately.