This release fixes a database slowdown in v2.37.0 when using visitor-subscriber-rate-limiting with a user database: the subscriber activity of UnifiedPush topics was written far too often.

Bug fixes + maintenance:

• With visitor-subscriber-rate-limiting and a user database, write a UnifiedPush topic's subscriber activity every one to two hours instead of every 5 minutes, spread over time, and not at all when a poll or reconnect only repeats the same subscriber; on ntfy.sh, v2.37.0's writes of ~45k topics every 5 minutes, all due in the same minute, slowed down the database (#2151)

Source GitHub

This release makes UnifiedPush work across several servers: the subscriber who pays for a topic's pushes is shared through the database, and app servers are told with 410 Gone when a subscription has been abandoned for 4 days. It also adds Retry-After and the draft RateLimit headers to rate limit responses, and frees the memory of one-off visitors sooner.

Features:

• With visitor-subscriber-rate-limiting, the subscriber of a UnifiedPush topic (who pays for its pushes) is kept in the user database and shared by all servers, so a push to any server is billed to the subscriber instead of answered with 507 (#2136; see subscriber-based rate limiting)

• Send a Retry-After header with HTTP 429 responses that are caused by a rate limit with a known wait, e.g. the request, e-mail or daily message limits (#2142; see rate limiting)

• Send the IETF draft RateLimit-Policy and RateLimit headers with publish responses (and with every 429 caused by a limit with a quota), for the request and daily message limits (#2143; see rate limiting)

• New metric ntfy_topics_unifiedpush_total: the UnifiedPush topics whose subscriber state a server keeps in memory (#2136)

Behavior changes:

• With visitor-subscriber-rate-limiting, a UnifiedPush push to a topic that has had no subscriber (subscribe, poll or open stream) for 4 days is answered with 410 (error code 41002) instead of 507, so app servers like Mastodon remove the expired subscription (#664, #2136); a Matrix push to such a topic gets its pushkey rejected (before: after 12 hours without a subscriber on the server that got the push)

• With visitor-subscriber-rate-limiting, UnifiedPush messages are counted against the subscriber's account only while it has a tier, and against the subscriber's IP address otherwise (also after the account lost its tier or was deleted); a tier change applies to the next message (#2136)

• Ban feed: weights may be fractional (down to 0.001), auth failures (42909) now weigh 2 instead of 10, and a UnifiedPush push without a subscriber (50701) or to an abandoned topic (41002) weighs 0.05, so app servers pushing to many offline phones are not banned for it (#2147)

• The rate limit state of a visitor is forgotten about a minute after it has fully recovered (all buckets refilled) instead of after a day without use, which frees the memory of one-off visitors such as floods of new IPs. The visitors stat and the ntfy_visitors_total metric therefore count the visitors of roughly the last minute, not of the last day (#2126)

• Topics without subscribers are dropped from memory after 6 hours without use instead of 16; a publish to such a topic recreates it (and counts against visitor-topic-creation-limit-burst) (#2136)

Bug fixes + maintenance:

• With PostgreSQL and several servers, daily usage a server counted in the last seconds of a visitor's 24-hour period is no longer added to the next period (a double count); it is dropped instead (#2136)

• Cluster: a forwarded message for a topic without subscribers on the receiving node now counts as wasted (ntfy_cluster_messages_wasted_total) and no longer keeps that idle topic in memory (#2140)

Source GitHub

This release keeps the daily limits across restarts and, with PostgreSQL, shares them between servers, so a visitor gets one daily allowance in total. Each visitor's day now starts at its own time instead of midnight UTC. It also adds an experimental local admin socket.

Features:

• Daily limits (messages, e-mails, phone calls) are stored in the user database, so they survive restarts; with PostgreSQL, all servers share them. Each visitor's day starts at its own time instead of midnight UTC, and the account page and /v1/account (stats.reset_at) show when it resets (#2131, see message limits)

• Experimental local admin socket (experimental-listen-admin-unix, off by default) that serves the admin API without credentials to whoever can open it; the shipped systemd unit sets RuntimeDirectory=ntfy for it (see admin socket)

• Export ntfy_db_up per PostgreSQL pool, and health-check the primary like the replicas (#2133)

Upgrade notes:

• Everyone's daily counts start over at the upgrade: the stats_* columns of the user table are zeroed and no longer used

• Servers that share a PostgreSQL database must keep their clocks in sync (NTP)

• Visitors without a tier have a daily e-mail limit again (24h / visitor-email-limit-replenish)

• The whole server config is checked again when base-url or a message-size-limit above 4K is set, so an invalid config that used to start now fails at startup (#1969, thanks to @mikejgray for the contribution)

Bug fixes + maintenance:

• Web app: Messages replayed by a poll or a reconnect no longer bring back deleted notifications, lose their read state or notify again (#2098, #2090, thanks to @mattford63, @arminus and @tobykaspar79 for reporting)

• CLI: ntfy pub --wait-pid now waits for processes owned by other users instead of failing with "not running" (#1710, thanks to @bekoeppel for the contribution)

• Admin API (internal): manage other users' tokens, tiers and password reset links, return 4xx instead of 500 for invalid input, and remove a deleted user's web push subscriptions

Source GitHub