diff --git a/ntfy/hooks/init b/ntfy/hooks/init
new file mode 100755
index 0000000..92e7d91
--- /dev/null
+++ b/ntfy/hooks/init
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+. lib/common
+
+set -e
+
+ntfy:init
+ntfy:config '.auth-file = "/var/lib/ntfy/user.db"'
+
+
+init-config-add "\
+$SERVICE_NAME:
+  volumes:
+    - $SERVICE_CONFIGSTORE/etc/ntfy:/etc/ntfy:ro
+"
+
diff --git a/ntfy/hooks/web_proxy-relation-joined b/ntfy/hooks/web_proxy-relation-joined
new file mode 100755
index 0000000..3d12827
--- /dev/null
+++ b/ntfy/hooks/web_proxy-relation-joined
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+. lib/common
+
+set -e
+
+ntfy:config '.behind-proxy = true'
diff --git a/ntfy/lib/common b/ntfy/lib/common
new file mode 100644
index 0000000..497212a
--- /dev/null
+++ b/ntfy/lib/common
@@ -0,0 +1,14 @@
+# -*- mode: shell-script -*-
+
+NTFY_CONFIGFILE="$SERVICE_CONFIGSTORE/etc/ntfy/server.yml"
+
+ntfy:init() {
+    service_def=$(get_compose_service_def "$SERVICE_NAME")
+    mkdir -p "${NTFY_CONFIGFILE%/*}" &&
+        e "$service_def" | yq e '.options' - > "$NTFY_CONFIGFILE"
+}
+
+ntfy:config() {
+    local cmd="$1"
+    yq e "$1" -i "$NTFY_CONFIGFILE"
+}
\ No newline at end of file
diff --git a/ntfy/metadata.yml b/ntfy/metadata.yml
new file mode 100644
index 0000000..3117c99
--- /dev/null
+++ b/ntfy/metadata.yml
@@ -0,0 +1,55 @@
+docker-image: docker.0k.io/ntfy:2.8.0  ## from: binwiederhier/ntfy:v2.8.0
+data-resources:
+  - /var/cache/ntfy
+  - /var/lib/ntfy
+
+docker-compose:
+  command:
+    - serve
+
+default-options:
+  auth-default-access: deny-all
+  enable-signup: false
+  enable-login: true
+  enable-reservations: true
+
+uses:
+  web-proxy:
+    #constraint: required | recommended | optional
+    #auto: pair | summon | none ## default: pair
+    constraint: recommended
+    auto: pair
+    solves:
+      proxy: "Public access"
+    default-options:
+      target: !var-expand ${MASTER_BASE_SERVICE_NAME}:80
+      apache-custom-rules:
+        - !var-expand |
+
+          ProxyPass /ws ws://${MASTER_BASE_SERVICE_NAME}:80/ws"
+          ProxyPassReverse /ws ws://${MASTER_BASE_SERVICE_NAME}:80/ws"
+
+          <If "%{REQUEST_METHOD} == 'GET' && %{HTTPS} == 'off'">
+            RedirectMatch permanent "^/([-_A-Za-z0-9]{0,64})$" "https://%{SERVER_NAME}/$1"
+          </If>
+
+          SetEnv proxy-nokeepalive 1
+          SetEnv proxy-sendchunked 1
+
+          # Higher than the max message size of 4096 bytes
+          LimitRequestBody 102400
+
+  backup:
+    constraint: recommended
+    auto: pair
+    solves:
+      backup: "Automatic regular backup"
+    default-options:
+      ## First pattern matching wins, no pattern matching includes.
+      ## include-patterns are checked first, then exclude-patterns
+      ## Patterns rules:
+      ##  - ending / for directory
+      ##  - '*' authorized
+      ##  - must start with a '/', will start from $SERVICE_DATASTORE
+      exclude-patterns:
+        - "/var/cache/ntfy/"