diff --git a/configuration.nix b/configuration.nix
index fd649f8..16b7b19 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -52,6 +52,8 @@
     ./services/ssh.nix
 
     ./services/syncthing.nix
+
+    ./services/ntfy.nix
   ];
 
   services.kmscon.enable = true;
diff --git a/flake.nix b/flake.nix
index 3dff900..64d1cb8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -122,6 +122,7 @@
           matrix_federation = 8448;
           coturn = 3478;
           coturn_tls = 5349;
+          ntfy = 2586;
         };
 
         https = {
@@ -177,6 +178,10 @@
           domain = "matrix.${https.domain}";
         };
 
+        ntfy = {
+          domain = "ntfy.${https.domain}";
+        };
+
         syncthing = {
           dataDir = services_dir + "/syncthing";
           signalBackupDir = "/${zpool_ssds}/bak/signal";
diff --git a/services/ntfy.nix b/services/ntfy.nix
new file mode 100644
index 0000000..fbbb543
--- /dev/null
+++ b/services/ntfy.nix
@@ -0,0 +1,32 @@
+{
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "ntfy-sh" service_configs.zpool_ssds [
+      "/var/lib/ntfy-sh"
+    ])
+  ];
+
+  services.ntfy-sh = {
+    enable = true;
+
+    settings = {
+      base-url = "https://${service_configs.ntfy.domain}";
+      listen-http = "127.0.0.1:${builtins.toString service_configs.ports.ntfy}";
+      behind-proxy = true;
+      auth-default-access = "deny-all";
+    };
+  };
+
+  services.caddy.virtualHosts."${service_configs.ntfy.domain}".extraConfig = ''
+    reverse_proxy :${builtins.toString service_configs.ports.ntfy}
+  '';
+
+  systemd.tmpfiles.rules = [
+    "Z /var/lib/ntfy-sh 0700 ${config.services.ntfy-sh.user} ${config.services.ntfy-sh.group}"
+  ];
+}