Ntfy notification auth: Google OAuth for client portal #199

New Issue

2026-06-06T17:25:46Z

jmiller commented

2026-06-06 17:25:46 +00:00

Parent Issue

Ref #192 — Expand MokoWaaS into full CRM offering

Summary

Set up unified Google OAuth sign-in for ntfy notifications across web and mobile. Ntfy will serve as the notification backbone for all MokoWaaS+ERP clients.

Decision Log

2026-06-06 — oauth2-proxy approach cancelled. oauth2-proxy works for the web UI but the ntfy mobile app only supports username/password and token auth — no OAuth flow. This breaks the user experience by requiring different auth methods on different platforms. Reverted all changes.

Google Cloud OAuth credentials exist in the moko-gitea (now git-mokoconsulting-tech) GCP project for ntfy.mokoconsulting.tech — keep them for future use.

Revised Plan

Defer ntfy OAuth integration to the MokoWaaS client portal (Phase 2 of #192). When the portal is built:

Build notifications into the MokoWaaS portal with native Google OAuth
Use ntfy as the backend delivery engine (API-only, service account tokens)
Client-facing notification subscriptions managed through the portal, not direct ntfy access
Consistent auth experience across web and mobile via the portal

Current State (unchanged)

ntfy uses built-in username/password + token auth
4 users: jmiller (admin), gitea-webhook, backup-agent, runner-agent
require-login: true, auth-default-access: deny-all
Restricted to known users only — no anonymous access

## Parent Issue Ref #192 — Expand MokoWaaS into full CRM offering ## Summary Set up unified Google OAuth sign-in for ntfy notifications across web and mobile. Ntfy will serve as the notification backbone for all MokoWaaS+ERP clients. ## Decision Log **2026-06-06 — oauth2-proxy approach cancelled.** oauth2-proxy works for the web UI but the ntfy mobile app only supports username/password and token auth — no OAuth flow. This breaks the user experience by requiring different auth methods on different platforms. Reverted all changes. **Google Cloud OAuth credentials exist** in the `moko-gitea` (now `git-mokoconsulting-tech`) GCP project for `ntfy.mokoconsulting.tech` — keep them for future use. ## Revised Plan Defer ntfy OAuth integration to the MokoWaaS client portal (Phase 2 of #192). When the portal is built: - [ ] Build notifications into the MokoWaaS portal with native Google OAuth - [ ] Use ntfy as the backend delivery engine (API-only, service account tokens) - [ ] Client-facing notification subscriptions managed through the portal, not direct ntfy access - [ ] Consistent auth experience across web and mobile via the portal ## Current State (unchanged) - ntfy uses built-in username/password + token auth - 4 users: `jmiller` (admin), `gitea-webhook`, `backup-agent`, `runner-agent` - `require-login: true`, `auth-default-access: deny-all` - Restricted to known users only — no anonymous access

jmiller added this to the v06.00.00 (CRM) milestone 2026-06-06 17:25:46 +00:00

jmiller changed title from ~~Google OAuth for ntfy + client notification integration~~ to Ntfy notification auth: Google OAuth for client portal

2026-06-06 17:49:38 +00:00

Sign in to join this conversation.

Priority Medium

Type Feature

Status —

Priority —

Type —

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoSuite#199