This Docker Compose configuration sets up ntfy with Tailscale as a sidecar container to securely deliver push notifications over a private Tailscale network. By integrating Tailscale in a sidecar configuration, you enhance the privacy and security of your ntfy instance, ensuring it is only accessible within your Tailscale network.
ntfy is a simple HTTP-based pub/sub notification service for sending push notifications to your devices and services. It supports sending messages via simple HTTP requests, with clients available for many platforms. By pairing ntfy with Tailscale, your notification broker becomes securely reachable through a zero-config mesh VPN, preventing unauthorized access over the public internet while keeping delivery fast and reliable.
In this setup, the tailscale-ntfy service runs the Tailscale daemon to provide secure, private networking. The ntfy service is configured to use Tailscale’s network stack via Docker’s network_mode: service: syntax. This binds ntfy’s network interface to the Tailscale container, making the HTTP API available only through your Tailscale network (or locally, if needed).
This architecture is ideal for self-hosters who want to send and receive notifications from anywhere without exposing the ntfy broker to the internet, maintaining both ease of access and strict privacy controls.