Protected Persistent Store Endpoints out of the box

[and-win]

:question: Question Hello, Is there a way to protect Persistent Store Endpoints with a secret token? The idea is share apprise between several teams. Each team should be able to create one or several personal configurations (persistent store) and communicate with it through light-weight API calls. For example, the Devops team creates a "devops" key and sets up the appropriate notification channels. Team "Dev" creates a key "dev" and so on. Team Devops should be able to communicate ("get", "del", "notify", etc.) only with it's own key "devops" and should have no access to key "dev" and vice versa.

[caronc]

See the APPRISE_CONFIG_LOCK documented in the README.md file.

This pairs with the apprise:// which i think gets you what you want?

[and-win]

Hello, Chris

Thank you for the response! APPRISE_CONFIG_LOCK looks like what I need to protect configuration. I will check documentation more detailed. But, it's not clear for me how to use apprise://. I need just one instance of apprise and ability to communicate with it through REST API. For example a micro-service use curl to notify a team about something like: curl -X POST -d "body=notify team, tag=devops, token=xxxx" https://my_apprise_url/{key} Where token is a secret used to access {key} of the team.

Could you please also clarify the way to combine tags with each other?

For example:

devops=slack://{tokenA}...
dev=slack://{tokenA}
pm=slack://{tokenA}
tech=[devops,dev] # tech should include devops and dev tags.

[caronc]

The config would look like:

tech,devops=slack://{tokenA}...
tech,dev=slack://{tokenA}
pm=slack://{tokenA}

The above tags your urls so that you can access them individually, or group the first 2 as tech

You're Apprise configuration needs to just point to your API;

# just notify the tech group:
apprise -vvv -t title -b body "apprise://your.apprise.api/token?tags=tech"

You could also make a ~./apprise file (on your local pc) that looks like:

# local configuration 
dev=apprise://your.apprise.api/token?tags=dev
tech=apprise://your.apprise.api/token?tags=tech
dev=apprise://your.apprise.api/token?tags=dev
pm=apprise://your.apprise.api/token?tags=pm

Then you can just run:

apprise -vvv -t title -b body -g tech

It's a bit counter intuitive, but prevents exposing your credentials to users.

If you don't use the APPRISE_CONFIG_LOCK, you're local Apprise configuration file (~./apprise) just becomes:

# local configuration 
include http://your.apprise.api:8000/get/token

[and-win]

Chris, thank very much!

In your example I need two instances of apprise: an API server and apprise client on the sender's side, correct?

# just notify the tech group:
apprise -vvv -t title -b body "apprise://your.apprise.api/token?tags=tech"

I consider Apprise like a notification gateway. I need just one Apprise API server, which is accessible for clients through REST API. And looking for a solution to protect endpoints URLs by some secret token. On the side of Apprise API server I have several preconfigured keys according to each team: apprise.api:8000/teamDevops apprise.api:8000/teamSecurity The goal is protect team's endpoint from each other. Team Devops has access to key 'apprise.api:8000/teamDevops', but does not have access to apprise.api:8000/teamSecurity. Is there a way to protect teams endpoints without additional wrappers like Nginx?

[caronc]

Just focus on the api part of my response and i think it will achieve what you want 🙂🚀

[and-win]

Will try, thank you for your work and responses!