Issue with webhook to ntfy on selfhosted vikunja

Support
1

Hi,

i have issues setting up a webhook, that fires against my self-hosted ntfy instance. I’ve setup a webhook (with the trigger: task.created) towards my ntfy-instance, but within the vikunja logs i see a strange error:

snippet:

dial tcp 192.168.2.1:443: prohibited IP address: 192.168.2.1

full log message (i added some newlines for better readability)

ERROR msg="Error while handling message 6ba64cc9-52a8-454b-bacd-9d95422999d6,
subscriber_poisoned=gochannel.GoChannel, 
reason_poisoned=Post "https://ntfy.mydomain.com/organisation?auth=redacted": dial tcp 192.168.2.1:443: prohibited IP address: 192.168.2.1 is not a permitted destination (denied by: 192.168.0.0/16), topic_poisoned=webhook.delivery, 
handler_poisoned=webhook.delivery.webhook.delivery.listener,  
payload={"webhook_id":4,"payload":{"event_name":"task.created","time":"2026-06-29T11:53:46.116019646Z","data":{"doer":{"id":1,"name":"Michael Freudenberg","username":"michael","created":"2026-04-12T19:38:31Z","updated":"2026-06-29T09:18:45Z"},"project":{"id":2,"title":"MyProject","description":"","identifier":"MP","hex_color":"1973ff","parent_project_id":0,"owner":{"id":1,"name":"Michael Freudenberg","username":"michael","created":"2026-04-12T19:38:31Z","updated":"2026-06-29T09:18:45Z"},"is_archived":false,"background_information":null,"background_blur_hash":"","is_favorite":false,"position":131072,"views":[{"id":28,"title":"Heute","project_id":2,"view_kind":"list","filter":{"s":"","sort_by":null,"order_by":null,"filter":"done = false \\u0026\\u0026 due_date \\u003e= now/d","filter_include_nulls":false},"position":50,"bucket_configuration_mode":"none","bucket_configuration":[],"default_bucket_id":0,"done_bucket_id":0,"updated":"2026-06-10T07:58:11Z","created":"2026-06-10T07:53:50Z"},{"id":5,"title":"Liste","project_id":2,"view_kind":"list","filter":{"s":"","sort_by":null,"order_by":null,"filter":"done = false \\u0026\\u0026 labels not in 2","filter_include_nulls":false},"position":100,"bucket_configuration_mode":"none","bucket_configuration":[],"default_bucket_id":0,"done_bucket_id":0,"updated":"2026-06-16T09:47:21Z","created":"2026-04-12T19:45:07Z"},{"id":6,"title":"Gantt","project_id":2,"view_kind":"gantt","filter":null,"position":200,"bucket_configuration_mode":"none","bucket_configuration":null,"default_bucket_id":0,"done_bucket_id":0,"updated":"2026-04-12T19:45:07Z","created":"2026-04-12T19:45:07Z"},{"id":7,"title":"Table","project_id":2,"view_kind":"table","filter":null,"position":300,"bucket_configuration_mode":"none","bucket_configuration":null,"default_bucket_id":0,"done_bucket_id":0,"updated":"2026-04-12T19:45:07Z","created":"2026-04-12T19:45:07Z"},{"id":8,"title":"Kanban","project_id":2,"view_kind":"kanban","filter":{"s":"","sort_by":null,"order_by":null,"filter":"labels not in 2","filter_include_nulls":false},"position":400,"bucket_configuration_mode":"manual","bucket_configuration":[],"default_bucket_id":4,"done_bucket_id":6,"updated":"2026-06-16T09:48:04Z","created":"2026-04-12T19:45:07Z"}],"max_permission":0,"created":"2026-04-12T19:45:07Z","updated":"2026-06-29T11:53:46Z"},"task":{"id":85,"title":"testaufgabe 5","description":"","done":false,"done_at":"0001-01-01T00:00:00Z","due_date":"0001-01-01T00:00:00Z","reminders":null,"project_id":2,"repeat_after":0,"repeat_mode":0,"priority":0,"start_date":"0001-01-01T00:00:00Z","end_date":"0001-01-01T00:00:00Z","assignees":null,"labels":null,"hex_color":"","percent_done":0,"identifier":"FX-51","index":51,"related_tasks":{},"attachments":null,"cover_image_attachment_id":0,"is_favorite":false,"created":"2026-06-29T11:53:46Z","updated":"2026-06-29T11:53:46Z","bucket_id":0,"buckets":[{"id":4,"title":"To-Do","project_view_id":8,"limit":0,"count":0,"position":100,"created":"2026-04-12T19:45:07Z","updated":"2026-04-12T19:45:07Z","created_by":null}],"position":0,"reactions":null,"created_by":{"id":1,"name":"Michael Freudenberg","username":"michael","created":"2026-04-12T19:38:31Z","updated":"2026-06-29T09:18:45Z"}}}}}"

Here is the info about my infrastructure:

  • I am using a caddy reverse proxy running on vm-caddy that terminates all traffic from vikunja and ntfy
  • Vikunja is running on a machine vm-docker-02 via docker-compose
  • ntfy is running on a machine vm-docker-01
  • Both vm’s are in the same VLAN
  • The caddy reverse-proxy uses Geoblocking with ip-range blocking ( see also the “observations”)
    • IP’s are only allowed from the range 192.168.0.0/16

Observations

  • I don’t see any logs in ntfy docker container when the webhook is fired
  • I don’t see any ntfy-logs in caddy when the webhook is fired
  • I don’t see any related vikunja logs in caddy when the webhook is fired
  • I don’t see any blocked logs in my opn-sense firewall (the ports are open)
  • I couldn’t find any related log info in the vikunja source code

Could this be some kind of exception, that is generated by the go framework?

Am i possibly missing some settings in my vikunja-instance?

services:
  vikunja:
    image: vikunja/vikunja:latest
    container_name: vikunja
    user: "0:0"
    environment:
      VIKUNJA_SERVICE_PUBLICURL: https://vik.mydomain.com
      VIKUNJA_DATABASE_HOST: db
      VIKUNJA_DATABASE_PASSWORD: ***
      VIKUNJA_DATABASE_TYPE: mysql
      VIKUNJA_DATABASE_USER: vikunja
      VIKUNJA_DATABASE_DATABASE: vikunja
      VIKUNJA_MAILER_ENABLED: true
      VIKUNJA_MAILER_HOST: smtp.mydomain.com
      VIKUNJA_MAILER_PORT: 465
      VIKUNJA_MAILER_AUTHTYPE: plain
      VIKUNJA_MAILER_USERNAME: webmaster@mydomain.com
      VIKUNJA_MAILER_PASSWORD: ***
      VIKUNJA_MAILER_FROMEMAIL: noreply@mydomain.com
      VIKUNJA_MAILER_FORCESSL: true
      VIKUNJA_CORS_ENABLE: "true"
      VIKUNJA_CORS_ORIGINS: "*"
      VIKUNJA_SERVICE_ENABLEREGISTRATION: true
      VIKUNJA_WEBHOOKS_ENABLED: true
      VIKUNJA_SERVICE_IPEXTRACTIONMETHOD: realip
      VIKUNJA_SERVICE_TRUSTEDPROXIES: 192.168.0.0/16

       # OIDC CONFIG
      VIKUNJA_AUTH_LOCAL_ENABLED: "false"
      VIKUNJA_AUTH_OPENID_ENABLED: "true"
      VIKUNJA_AUTH_OPENID_PROVIDERS_0_NAME: "mydomain.com"
      VIKUNJA_AUTH_OPENID_PROVIDERS_0_AUTHURL: https://kc.mydomain.com/realms/mydomain.com
      VIKUNJA_AUTH_OPENID_PROVIDERS_0_LOGOUTURL: https://kc.mydomain.com/realms/mydomain.com/protocol/openid-connect/logout
      VIKUNJA_AUTH_OPENID_PROVIDERS_0_CLIENTID: vikunja
      VIKUNJA_AUTH_OPENID_PROVIDERS_0_CLIENTSECRET: ***

    ports:
      - 33456:3456
    volumes:
      - files:/app/vikunja/files
    depends_on:
      db:
        condition: service_healthy
    restart: unless-stopped
    

  db:
    image: mariadb:10
    container_name: db
    command: --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
    environment:
      MYSQL_ROOT_PASSWORD: ***
      MYSQL_USER: vikunja
      MYSQL_PASSWORD: ***
      MYSQL_DATABASE: vikunja
    volumes:
      - db:/var/lib/mysql
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h localhost -u $$MYSQL_USER --password=$$MYSQL_PASSWORD"]
      interval: 2s
      start_period: 30s

volumes:
  db:
  files: