Run your own ntfy server

The short version

Run the standard, unmodified ntfy server and add one line to its config:

upstream-base-url: "https://ntfy-me.com"

That's the only NTFY me-specific part. Everything else is a normal ntfy install. Already running ntfy? Jump to Switch an existing server.

How instant notifications work

iPhones only accept push notifications from Apple, and Apple only delivers them for the app's own push service. Your server can't reach your phone directly, so it sends a tiny "wake up" signal through ntfy-me.com:

The message itself never leaves your server except to go straight to your phone. This is the same mechanism the official ntfy app uses with ntfy.sh, pointed at ntfy-me.com because NTFY me has its own push channel.

Without the upstream-base-url line, NTFY me still works with your server, but messages show up only when you open the app.

What you need

• A computer that stays on: a home server, NAS, Raspberry Pi or a small VPS, with Docker installed.
• An address your phone can reach, ideally a domain with HTTPS, such as https://ntfy.example.com. A VPN address (Tailscale, WireGuard) works too, as long as your phone is connected to it when messages arrive.
• Outgoing internet access from the server to https://ntfy-me.com.

Install with Docker

Replace ntfy.example.com with your own domain everywhere below.

1. Create a folder and a compose.yml file.

   mkdir ntfy && cd ntfy

   Put this in compose.yml:

   services:
     ntfy:
       image: binwiederhier/ntfy
       container_name: ntfy
       command: serve
       environment:
         NTFY_BASE_URL: https://ntfy.example.com
         NTFY_UPSTREAM_BASE_URL: https://ntfy-me.com
         NTFY_CACHE_FILE: /var/lib/ntfy/cache.db
         NTFY_AUTH_FILE: /var/lib/ntfy/auth.db
         NTFY_ATTACHMENT_CACHE_DIR: /var/lib/ntfy/attachments
         NTFY_BEHIND_PROXY: "true"
       volumes:
         - ./ntfy-data:/var/lib/ntfy
       ports:
         - 127.0.0.1:8080:80
       restart: unless-stopped

   NTFY_BASE_URL must be exactly the address you'll type into the app, with the same https://, the same host name and no trailing slash. The push signal is matched on it, so a mismatch is the most common reason notifications don't arrive instantly.

   Prefer a config file? Every variable has a server.yml equivalent: base-url, upstream-base-url, cache-file and so on. See the ntfy config reference.

2. Start it.

   docker compose up -d

   Messages, logins and attachments are stored in the ntfy-data folder next to the file.

3. Put HTTPS in front of it. The server listens on 127.0.0.1:8080. Any reverse proxy works. With Caddy, which gets a certificate for you, the whole Caddyfile is:

   ntfy.example.com {
       reverse_proxy localhost:8080
   }

   Using nginx, Traefik or Cloudflare Tunnel instead? Point it at http://localhost:8080. The ntfy config reference has nginx and Apache examples.

4. Check it from outside.

   curl https://ntfy.example.com/v1/health

   You should see {"healthy":true}.

5. Subscribe in NTFY me. Tap +, turn on Use another server, enter https://ntfy.example.com and a topic name. To make your server the default for every new topic, set it in Settings → Default server instead.

6. Send a test.

   curl -d "Hello from my own server" https://ntfy.example.com/your-topic

   A banner should appear within a second or two, even with the app closed.

Updating later: docker compose pull && docker compose up -d.

Optional: require a login

By default anyone who knows a topic name can use your server. To lock it down:

1. Deny anonymous access. Add this line under environment: in compose.yml, then run docker compose up -d again:

         NTFY_AUTH_DEFAULT_ACCESS: deny-all

2. Create a user. It asks for a password.

   docker exec -it ntfy ntfy user add --role=admin alice

   Admins can use every topic. For per-topic permissions, create a normal user and grant access with ntfy access; see access control.

3. Sign in from the app. In NTFY me, open Settings → Users → Add user and enter your server address, username and password. The app uses that login for every topic on that server, including when it fetches a message after a push.

4. Send with credentials. Either a password:

   curl -u alice:your-password -d "Backup finished" https://ntfy.example.com/backups

   or, better for scripts, an access token you can revoke:

   docker exec ntfy ntfy token add alice
   curl -H "Authorization: Bearer tk_..." -d "Backup finished" https://ntfy.example.com/backups

Behind Cloudflare Access or another login proxy? Add its headers in Settings → Server headers. They are stored in the Keychain and only sent to that server.

Switch an existing server

If your server already has upstream-base-url: "https://ntfy.sh" for the official ntfy iOS app, change it to ntfy-me.com:

# server.yml
upstream-base-url: "https://ntfy-me.com"

# or, with Docker environment variables
NTFY_UPSTREAM_BASE_URL: https://ntfy-me.com

Restart the server. Nothing else changes: topics, users, tokens, URLs and your scripts all stay the same.

Then add your topics in NTFY me (+ → Use another server) and your login (Settings → Users). The migration guide has a checklist.

Troubleshooting

What ntfy-me.com sees

For each message on your server, ntfy-me.com receives only:

• a SHA-256 hash of the topic address (not the topic name or server address),
• the message ID, and
• your server's IP address and the time, which are used for rate limiting.

It never receives the title, message, tags or attachments. The same goes for Apple and Google, which carry the push. Full details: Privacy Policy.