From bebc4a8acfdc9cb7d8430af8a05186afbc1aa37a Mon Sep 17 00:00:00 2001
From: Dennis Schmidt <de-es@users.noreply.github.com>
Date: Wed, 29 Oct 2025 13:18:13 +0100
Subject: [PATCH 1/2] Add ntfy push notifications action

---
 ChangeLog                 |  1 +
 config/action.d/ntfy.conf | 83 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 84 insertions(+)
 create mode 100644 config/action.d/ntfy.conf

diff --git a/ChangeLog b/ChangeLog
index d6588117..80cec9eb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -99,6 +99,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
 * `action.d/nftables.conf` (gh-3291):
   - new parameter `addr_options` for addr-set (default `flags interval\;`, allows to store CIDR or address ranges);
     can be set to empty value to create simple addresses set (restore previous behavior).
+* `action.d/ntfy.conf` - new action for sending push notifications with ntfy.sh
 * `action.d/firewallcmd-rich-*.conf` - fixed incorrect quoting, disabling port variable expansion
   by substitution of rich rule (gh-3815)
 * `filter.d/dovecot.conf`:
diff --git a/config/action.d/ntfy.conf b/config/action.d/ntfy.conf
new file mode 100644
index 00000000..1397714e
--- /dev/null
+++ b/config/action.d/ntfy.conf
@@ -0,0 +1,83 @@
+# Fail2Ban configuration file
+#
+# Action to send push notifications with ntfy via ntfy.sh or your own ntfy server
+#
+# Author: Dennis Schmidt
+#
+# Example (ban & notify):
+#
+#    action = %(action_)s
+#             ntfy[ntfyurl="%(ntfyurl)s", ntfytopic="%(ntfytopic)s", ntfytoken="%(ntfytoken)s", ntfypriority="%(ntfypriority)s"]
+#
+
+[Definition]
+
+# bypass ban/unban for restored tickets
+norestored = 1
+
+# Option:  actionstart
+# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Values:  CMD
+#
+actionstart = curl -f -s \
+              -H 'Authorization: Bearer <ntfytoken>' \
+              -H 'Tags: information_source' \
+              -H 'Title: Fail2Ban - <fq-hostname>' \
+              -d 'The jail <name> has been started successfully.' \
+              <ntfyurl>/<ntfytopic>
+
+# Option:  actionstop
+# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Values:  CMD
+#
+actionstop = curl -f -s \
+             -H 'Authorization: Bearer <ntfytoken>' \
+             -H 'Tags: information_source' \
+             -H 'Title: Fail2Ban - <fq-hostname>' \
+             -d 'The jail <name> has been stopped.' \
+             <ntfyurl>/<ntfytopic>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck =
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Values:  CMD
+#
+actionban = curl -f -s \
+            -H 'Authorization: Bearer <ntfytoken>' \
+            -H "Priority: <ntfypriority>" \
+            -H 'Tags: no_entry_sign' \
+            -H 'Title: Fail2Ban - <fq-hostname>' \
+            -d 'The IP <ip> has just been banned after <failures> attempts against <name>.' \
+            <ntfyurl>/<ntfytopic>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Values:  CMD
+#
+actionunban =
+
+[Init]
+
+# ntfy server url
+#
+ntfyurl = https://ntfy.sh
+
+# ntfy topic
+#
+ntfytopic = alerts
+
+# ntfy token
+#
+ntfytoken = tk_00000000000000000000000000000
+
+# ntfy ban notification priority
+# Options: max, high, default, low, min
+#
+ntfypriority = default

From 10a347efd88bfdfc44efb78c523d134d2c366f7b Mon Sep 17 00:00:00 2001
From: Dennis Schmidt <de-es@users.noreply.github.com>
Date: Sun, 9 Nov 2025 18:36:44 +0100
Subject: [PATCH 2/2] Make token optional

---
 config/action.d/ntfy.conf | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/action.d/ntfy.conf b/config/action.d/ntfy.conf
index 1397714e..b06c11d0 100644
--- a/config/action.d/ntfy.conf
+++ b/config/action.d/ntfy.conf
@@ -74,8 +74,9 @@ ntfyurl = https://ntfy.sh
 ntfytopic = alerts
 
 # ntfy token
+# Use access token or leave empty if authentication not required
 #
-ntfytoken = tk_00000000000000000000000000000
+ntfytoken =
 
 # ntfy ban notification priority
 # Options: max, high, default, low, min