From 1c3b609799adba7e2fc40a227469397cbb53d669 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 28 Jul 2026 16:37:17 +0300 Subject: [PATCH] Add changelog entry about ntfy users now being declared with hashed passwords --- CHANGELOG.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 99899d7c8..2996cd8f7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,33 @@ +# 2026-07-28 + +## (Backward Compatibility Break) ntfy users are now declared with hashed passwords + +This only affects you if you have enabled authentication for [ntfy](docs/configuring-playbook-ntfy.md) via `ntfy_credentials`. + +The ntfy role used to create users by invoking `ntfy user` commands against the running container. Since v2.14.0, ntfy can provision users and access-control entries from its own configuration file, so the role now does that instead. Besides being a lot simpler, this fixes passwords containing spaces never arriving intact. + +Replace `ntfy_credentials` with `ntfy_auth_users_custom`, which takes bcrypt password hashes rather than plaintext passwords: + +```yaml +ntfy_auth_users_custom: + - username: alice + password_hash: $2a$10$YLiO8U21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C + role: admin +``` + +Generate a hash for each of your passwords by running the following command on any machine which has Docker installed. It asks for the password and prints its hash: + +```sh +docker run --rm -it docker.io/binwiederhier/ntfy:latest user hash +``` + +The playbook will let you know if your configuration still uses `ntfy_credentials`. + +Your existing ntfy users are left alone and keep working until you declare them again this way. Note that ntfy manages declared users and access-control entries declaratively, so removing one from your configuration later deletes it from ntfy's user database. + +Users with the `admin` role get access to all topics. Others start with no access at all, and can be granted access to specific topics via `ntfy_auth_access_custom`. It is also now possible to control what unauthenticated visitors may do (`ntfy_auth_default_access`) and whether users may log in at all (`ntfy_enable_login`, which follows your authentication setup by default). See the role's [documentation on access control](https://github.com/mother-of-all-self-hosting/ansible-role-ntfy/blob/main/docs/configuring-ntfy.md#enable-access-control-with-authentication-optional) for details. + + # 2026-07-19 ## Tuwunel now exposes its administration and /_tuwunel API paths