NEEDS-KAMI: telegram is the only reach, and it depends on a socks relay that has failed before #196
Reference in New Issue
Block a user
Delete Branch "task/649-needs-kami-telegram-is-the-only-reach-an"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Closes Vikunja #649.
Acceptance criteria and quality gate are in
TASK.mdon this branch.Review the review, not the diff — leave comments and the agent will apply them via
task start 649.Telegram was the only way off this box, and it is not a direct path: it needs api.telegram.org, a socks relay on the host and a matching ufw rule. Each of those three has failed once, and when they do a sev4 nudge has nowhere to go. ntfy shares none of them. The spare is the smaller half of it. The routing table already sends sev3-away nudges and away reminders to ntfy and to nothing else, so with no block configured those two routes hit a nil sink in DispatchNudge and DispatchReminder and are skipped — no log line, no delivery_attempts row. An away reminder is worse than dropped: out stays empty, so MarkReminder never runs and it re-fires every tick without ever being delivered. Owner's call, 07-08-2026: ntfy.kvmx.ru, topic maven. The sink now takes a bearer token, which is what that server wants and what it could not do before. ntfy scopes a token to one topic and to write-only, so a popped sink can push to the maven topic and cannot read it back. Basic auth stays for a server with no tokens; configuring both is refused rather than resolved by guessing. Config keys got json tags. docs/operations.md has documented this block as base_url/topic since before it existed, and the untagged struct would only have answered to BaseURL/Topic — the documented config would have parsed into an empty one. The token is a ${NTFY_TOKEN} expansion from the gitignored deploy/telegram.env, beside the telegram secrets. TestDeployConfigLoads now fails if the block goes missing, because deleting it is how you turn the reach off and the two silent routes are what that costs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YMNNEkYx1mZFtHNrFk7uqb