fix: ntfy listens on the Tailscale address; monitor publishes to it directly

The reverse proxy is a separate VPS on the tailnet, so a loopback-only
ntfy was unreachable from it. install_ntfy.sh now binds the host's Tailscale
IP (NTFY_LISTEN overrides). New NTFY_PUBLISH_URL: where the monitor POSTs,
separate from the public NTFY_SERVER subscribers see, so an alert never
waits on DNS or the proxy (first cycle logged 502s from Cloudflare while
the domain was not yet proxied).

scripts/install_ntfy.sh

@@ -7,22 +7,28 @@
 # What it does:
 #   - installs the ntfy .deb from the official GitHub release (single Go
 #     binary, ~30 MB RSS, sqlite message cache)
-#   - writes /etc/ntfy/server.yml: listens on 127.0.0.1:2586 only (put it
-#     behind your existing reverse proxy / Cloudflare tunnel), anonymous
-#     READ on all topics, WRITE only with a token
+#   - writes /etc/ntfy/server.yml: listens on the Tailscale address only
+#     (the reverse proxy is another VPS on the tailnet; nothing is exposed
+#     on a public interface), anonymous READ on all topics, WRITE only with
+#     a token. Override with NTFY_LISTEN=host:port.
 #   - creates the `monitor` publishing user + token, writes NTFY_SERVER /
 #     NTFY_TOKEN into /opt/thailand-water-monitor/.env if not present
 #
-# Reverse proxy: forward https://$NTFY_DOMAIN -> http://127.0.0.1:2586 with
-# websockets enabled and a long/no read timeout (subscribers hold the
-# connection open). Caddy: `reverse_proxy 127.0.0.1:2586`. Cloudflare
-# tunnel: add a public hostname pointing at http://127.0.0.1:2586.
+# Reverse proxy (on the Caddy VPS, over Tailscale):
+#     ntfy.buildfor.life {
+#         reverse_proxy <this host's tailscale ip>:2586
+#     }
+# Caddy passes websockets and keeps long-poll connections open by default;
+# subscribers hold one open. ntfy runs with behind-proxy: true so rate
+# limits key on X-Forwarded-For, not on the proxy's address.
 set -euo pipefail
 
 NTFY_DOMAIN="${NTFY_DOMAIN:?set NTFY_DOMAIN, e.g. ntfy.buildfor.life}"
 NTFY_VERSION="${NTFY_VERSION:-2.28.0}"
 MONITOR_DIR="${MONITOR_DIR:-/opt/thailand-water-monitor}"
-LISTEN="${NTFY_LISTEN:-127.0.0.1:2586}"
+TS_IP="$(tailscale ip -4 2>/dev/null | head -1 || true)"
+LISTEN="${NTFY_LISTEN:-${TS_IP:-127.0.0.1}:2586}"
+echo "ntfy will listen on ${LISTEN}"
 
 if ! command -v ntfy >/dev/null || [[ "$(ntfy --version 2>/dev/null | awk '{print $3}')" != "$NTFY_VERSION" ]]; then
     tmp=$(mktemp -d)
@@ -82,6 +88,7 @@ if [[ -f "$env_file" ]] && ! grep -q '^NTFY_SERVER=' "$env_file"; then
         echo ""
         echo "# ntfy public notifications (scripts/install_ntfy.sh)"
         echo "NTFY_SERVER=https://${NTFY_DOMAIN}"
+        echo "NTFY_PUBLISH_URL=http://${LISTEN}"
         echo "NTFY_TOPIC_PREFIX=ping"
         echo "NTFY_TOKEN=${token}"
     } >> "$env_file"