Setup and configuration
Network requirements for push notification
To send push notifications, Notification Service must be able to send HTTPS requests to the endpoints of the according provider. Following domains must be accessible by the Notification Service Backend.
| Browser | Addresses |
|---|---|
Google Chrome |
https://fcm.googleapis.com https://mtalk.google.com |
Apple Safari |
https://*.push.apple.com |
Mozilla Firefox |
https://updates.push.services.mozilla.com |
Microsoft Edge |
https://*.notify.windows.com |
-
If the proxy setting is not specified via the proxyEnabledServices global environment variable, the proxy configuration can be established in the Helm configuration in the following manner:
######### Optional: Notification service proxy for web push and email notifications in the Helm chart ########
notification:
deployments:
notification-service:
env:
HTTP_PROXY: "http://your-proxy.com:8080"
HTTPS_PROXY: "http://your-proxy.com:8080"
NO_PROXY: "localhost,127.0.0.1, domain-of-the-notification-service.com"
######### End of Notification Service Proxy for Web Push ########The NO_PROXY environment variable is used to exclude the Notification Service from the proxy. This is necessary to avoid routing the requests to the proxy, which might result in a loop or additional latency. Ensure that the domain of the system and its IP addresses are included in the NO_PROXY list.
Similar applies to the client side (Browsers on the client devices). Strict firewall or proxy configurations may block the incoming web push notifications. In case of issues, please check the browser vendor documentation about communication requirements.
Web Push VAPID configuration
Web Push notifications require a VAPID (Voluntary Application Server Identification) keypair that authenticates this Notification Service to push services. As an operator you must:
-
Generate one VAPID keypair per environment (e.g., separate pairs for dev, staging, production). Keys must not be shared across environments.
-
Keep the keys stable for the lifetime of the environment. Rotating the public key invalidates every existing push subscription — browsers must re-subscribe.
-
Provide the keypair plus a contact subject via the Helm variables
webPushPublicKey,webPushPrivateKey, andwebPushConfigurationSubject(see Helm variable configuration). Without these values the service refuses to start. -
Keep
webPushPrivateKeysecret. Source it from your secrets management; never commit it to version control.
Role assignment
After deploying the Notification Service, ensure that the appropriate roles are assigned in the Multitenant Access Control module:
-
Operator — Assign to administrators who manage event types, subscriptions, and recipients.
-
User — Assign to all end users who should be able to view and adjust their personal notification settings (e.g., disabling email notifications for specific topics). This role is required for users to access the Notification Settings page in the portal.
| The User role should be assigned to every user by default to enable self-service notification management. |