allow bearer auth for signal notifications

[babeuloula]

📑 I have found these related issues/pull requests

.

🏷️ Feature Request Type

Settings

🔖 Feature description

Hello,

I'm using Signal and I've blocked the endpoint though a basic auth. I can't use the Signal notification because I can't setting up an authentification system.

✔️ Solution

I think it would be great if we can setting up an auth system for notification provider.

❓ Alternatives

No response

📝 Additional Context

No response

[101br03k]

uptime-kuma uses apprise as an notification system. Please check there documentation for how to use Signal using an API: https://github.com/caronc/apprise/wiki/Notify_signal

[babeuloula]

uptime-kuma uses apprise as an notification system. Please check there documentation for how to use Signal using an API: Wiki: Notify_signal (caronc/apprise)

I've already tried this.

But signal:// is not a valid protocol:

And if I use https://, I can't setting up my password because it contain special chars. I've also tried with a base64 encoded password. I've always an error 401.

[101br03k]

Ah yes, because it already asks you to select the type in the notifications section it is not needed to specify any fearther.
Do you have a signal client with REST API?
For example https://github.com/bbernhard/signal-cli-rest-api

[babeuloula]

Yes of course I have a signal client with REST API. But I don't understand how to settting up my basic auth.

[101br03k]

You don't need basic auth, at http://IP:PORT/v1/qrcodelink?device_name=signal-api you can connect your phone to the container, then using a configuration comparable to this it works for me.

[babeuloula]

No I need a basic auth because my endpoint is protected by a basic auth. I don't want to expose the signal API to anyone.

[101br03k]

What do you mean with "my endpoint"?
https://github.com/bbernhard/signal-cli-rest-api or another rest api?
Quickly looking trough the docs of the mentiond repository I do not see any option for this. Are you using a reverse proxy or something similar?

[babeuloula]

Yes I use a nginx reverse proxy to serve the REST API

[damitti444]

I don't know if this is supported by uptime-kuma but have you tried passing credentials in the URL like this?
https://user:pass123@example.com/.....
source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication#access_using_credentials_in_the_url
also consider the security implications if you use this, i.e. password visible in logs

[babeuloula]

I don't know if this is supported by uptime-kuma but have you tried passing credentials in the URL like this? user:pass123@example.com..... source: developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication#access_using_credentials_in_the_url also consider the security implications if you use this, i.e. password visible in logs

Hello, Yes I've tried this and also with a base64 encoded password but I've got an error 401.

[FoxOps]

Yes I use a nginx reverse proxy to serve the REST API

Hello,

I don't think this is a Kuma problem, perse. More like a configuration on the reverse proxy side but a better management of auth on kuma side is always welcomed.

If you use nginx as a reverse proxy, there is another way to protect your signal API from unwanted traffic.

You can use "deny" and "allow" in nginx like this:

    location / {
        error_page 403 /error/error403.html; # If you want a custom error page
        error_page 404 /error/error.404html; # If you want a custom error page
        allow 192.168.0.1; # Your UptimeKuma IP v4 
	allow 3f8a:7c1d:4e2b:9a05:11f3:fd17:7e84:c484; # Your UptimeKuma IP v6
        deny all;
       # Whatever your reverse proxy settings are
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:123456/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
    location /error {
        alias /var/www/html/error/;
        internal;
    }

This should help you.

[babeuloula]

@FoxOps Thanks for the suggestion but unfortunately I can't set up IP filtering, I have several services accessing this service and I have dynamic IPs in particular.