Skip to content

Operations

How the instance is secured, how to manage Gotify, and how to back up, update and get help.

Security model

  • Loopback only. HTTPS on 127.0.0.1:8443 and the HTTP redirect on 127.0.0.1:8080. Nothing listens on a public interface.
  • Per-instance secrets. First boot creates the TLS key and the admin password on the instance. They are not in the image.
  • File permissions. The password file and private key are owned by root, group gotify, mode 0640. The ubuntu user cannot read them.
  • Locked-down defaults. Registration, plugins, OIDC and Let's Encrypt are off.
  • Dedicated user. Gotify runs as the gotify system user and can write only to /var/lib/gotify.
  • SSH. Password login and root login are disabled. Use Session Manager, or SSH with a key pair from your administrative network only.
  • No AWS permissions needed. The image does not call AWS APIs.

Services

Unit What it does
sushi-gotify-firstboot.service Creates the TLS material, password, directories and settings file. Runs before Gotify.
gotify.service Gotify itself 
systemctl status gotify
sudo systemctl restart gotify

Health and version

curl --cacert /etc/gotify/tls/cert.pem https://127.0.0.1:8443/health
curl --cacert /etc/gotify/tls/cert.pem https://127.0.0.1:8443/version

Logs

sudo journalctl -u gotify -n 100 --no-pager

Message history

Gotify keeps every message until you delete it. The image does not purge old messages. Delete them in the web UI, or one at a time with DELETE /message/{id}.

Backups

Back up /var/lib/gotify/ and /etc/gotify/ together. Stop Gotify first for a consistent copy of the database:

sudo systemctl stop gotify
sudo tar -czf /var/backups/gotify-backup.tar.gz /var/lib/gotify /etc/gotify
sudo systemctl start gotify

Updates

  • Ubuntu security updates install automatically through unattended upgrades.
  • Gotify stays on the version in the image. New versions ship as new image versions.

A new image version does not update a running instance. To move to it, launch the new version, copy the settings file, TLS files, password file and database across with Gotify stopped, then point your clients at the new instance. Gotify applies its own schema migrations when it opens the database. Try the move on a test instance first.

Support

Software Sushi provides packaging and setup guidance for this image. Email info@softwaresushi.com with your instance ID and a description of the problem. Do not send passwords, tokens or private keys. This offer does not include Gotify project support.