NG

Notification Gateway

Sign in to administer routes and providers.

First install? Run ./dev.sh init to create a one-time password.

NG
Notification GatewaySelf-hosted control plane
CONTROL CENTER V0.3.0

Overview

Delivery activity and system status.

Mode

Operations and provider health

Only normalized attempts and queue state are shown; no messages or recipient identities.

Recent activity

Metadata only. Payloads are not shown.

Gateway statusProvider acceptance is not the same as recipient delivery. Unknown outcomes are held for review, not automatically escalated.

Each public URL has its own isolated API credentials and server-controlled routing.

New endpoint

No destination details are exposed in the public URL.

Delivery destinations

Every destination receives its own delivery attempt. A confirmed failure triggers only that destination's fallback.

Shared emergency fallback

Triggered once only when every selected destination and its individual fallback has definitively failed. Never on unknown/partial outcomes.

Changes affect new deliveries.

Credentials:

Credentials apply only to this endpoint. A token appears once after creation.

Copy this key now — it will not be shown again.

Event and attempt log

Only status, timestamps and normalized error codes are stored.

Reusable SMTP mailers and outgoing HTTPS webhooks. Credentials are encrypted and never displayed after saving.

Add integration

Secrets are write-only. Leave the secret empty when editing to retain the existing one.

Test an integration only when you intend to contact the external service.

Define a destination once, then reuse it in many endpoints. New events resolve current settings; queued jobs retain the original route.

Saved destination

Reusable message formatting using only {{title}}, {{message}} and {{severity}} placeholders. No code execution.

Message template

Styled text uses **bold**, *italic*, ~strikethrough~, `code` and HTTPS links. Email is automatically rendered as safely escaped HTML plus plain text; Signal uses its original styling where enabled. Spoilers are visible in email. Webhook JSON placeholders are substituted safely.

Internal Signal adapterThe upstream REST API is not published to the internet. Use the optional sidecar for real account operations.

Connect a Signal account

Use Signal on your phone → Settings → Linked devices → Link new device.

Signal linking QR code

A new QR is generated on each request. Refresh if it expires.

Connected accounts

Not queried yet.

Group discovery

List real names and identifiers, then use a group's ID as a notification destination.

Create a group

Authenticator MFA (TOTP)

For internet-facing systems also restrict this administration API at your VPN/reverse proxy. Save your single-use recovery codes offline and separate from the encrypted backup passphrase.

Copy these one-time recovery codes now. They will not be shown again.
Add this secret manually to your authenticator, or open the provided URI in a compatible app. It is displayed once.
Administrator password
Change the bootstrap password before exposing the dashboard beyond localhost.
Portable server settings
Export an encrypted configuration bundle for a clean server. Keeps endpoint URLs/API-key hashes, integration credentials, routes and templates. It does NOT include Signal device registration, notification history or admin accounts.
Keep the export passphrase separately from the encrypted file. On the destination, save it in a protected 0600 file and set NG_SETTINGS_PASSPHRASE_FILE before running ./gateway.sh settings-import FILE on the stopped, fresh installation. This does not export Signal registration, administrator accounts, server-host paths or TLS certificates.
Retention and configuration
Payload lifetime, metadata retention and rate limits are configured on each endpoint. SMTP profiles, outgoing webhooks, reusable destinations, and templates can now be configured under their own navigation tabs. Existing legacy SMTP .env configuration continues to work; new integrations use separately encrypted, write-only secrets.
See docs/SECURITY.md and docs/DEPLOYMENT.md for deployment hardening.