feat(notifications): Web Push delivers notifications to every device, even with TREK closed

A fourth built-in channel next to email, webhook and ntfy. Browsers
register per device, the server encrypts per RFC 8291 and signs per RFC
8292 with node:crypto and sends only to known push services through the
SSRF guard. The event matrix decides per category what arrives by push;
admins switch the channel on under Notifications.

VAPID keys come from the environment or are generated once, only while
neither stored row exists, and kept encrypted. A pair that does not
decrypt or match is never overwritten and never swapped for another one:
push stays off with an error in the log and every device stays
registered until the key is fixed. The subject is VAPID_SUBJECT, then an
https APP_URL, then the project URL.

Only chat messages collapse into one notification per trip, and a
replacement still alerts. A 403 removes a device only after three
failures in a row; 404 and 410 remove it at once. Password change, reset
and an admin setting a password drop the user's devices with the other
credentials. The request log redacts subscriptions and endpoints, boot
errors print *** for every secret variable, and logout forgets the
device with a plain fetch so an expired session cannot redirect midway.

Addresses discussion #894.

charts/README.md

@@ -53,4 +53,5 @@ See `values.yaml` for more options.
 - `FORCE_HTTPS` is optional. Set `env.FORCE_HTTPS: "true"` only when ingress (or another proxy) terminates TLS. It enables HTTPS redirects, HSTS, CSP `upgrade-insecure-requests`, and forces the session cookie `secure` flag. Requires `TRUST_PROXY` to be set.
 - Set `env.TRUST_PROXY: "1"` (or the number of proxy hops) when running behind ingress or a load balancer. Required for `FORCE_HTTPS` to detect the forwarded protocol correctly. In production it defaults to `1` automatically.
 - `COOKIE_SECURE` is auto-derived (on when `NODE_ENV=production` or `FORCE_HTTPS=true`). Set `env.COOKIE_SECURE: "false"` only during local testing without TLS. **Not recommended for production.**
+- Web Push needs no chart settings: TREK generates its key pair on first start and keeps it in the database on the data PVC. To bring your own pair, set `env.VAPID_PUBLIC_KEY` and `secretEnv.VAPID_PRIVATE_KEY` together (and optionally `env.VAPID_SUBJECT`); changing the pair later means every device has to turn push on again.
 - Set `env.OIDC_DISCOVERY_URL` to override the auto-constructed OIDC discovery endpoint. Required for providers (e.g. Authentik) that expose it at a non-standard path.

charts/trek/templates/configmap.yaml

@@ -97,3 +97,9 @@ data:
   {{- if .Values.env.AMAP_API_BASE }}
   AMAP_API_BASE: {{ .Values.env.AMAP_API_BASE | quote }}
   {{- end }}
+  {{- if .Values.env.VAPID_PUBLIC_KEY }}
+  VAPID_PUBLIC_KEY: {{ .Values.env.VAPID_PUBLIC_KEY | quote }}
+  {{- end }}
+  {{- if .Values.env.VAPID_SUBJECT }}
+  VAPID_SUBJECT: {{ .Values.env.VAPID_SUBJECT | quote }}
+  {{- end }}

charts/trek/templates/deployment.yaml

@@ -93,6 +93,12 @@ spec:
                   name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
                   key: AMAP_API_SECRET
                   optional: true
+            - name: VAPID_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
+                  key: VAPID_PRIVATE_KEY
+                  optional: true
           volumeMounts:
             - name: data
               mountPath: /app/data

charts/trek/templates/secret.yaml

@@ -29,6 +29,9 @@ data:
   {{- if .Values.secretEnv.AMAP_API_SECRET }}
   AMAP_API_SECRET: {{ .Values.secretEnv.AMAP_API_SECRET | b64enc | quote }}
   {{- end }}
+  {{- if .Values.secretEnv.VAPID_PRIVATE_KEY }}
+  VAPID_PRIVATE_KEY: {{ .Values.secretEnv.VAPID_PRIVATE_KEY | b64enc | quote }}
+  {{- end }}
 {{- end }}
 
 {{- if and (not .Values.existingSecret) (.Values.generateEncryptionKey) }}
@@ -68,4 +71,7 @@ stringData:
   {{- if .Values.secretEnv.AMAP_API_SECRET }}
   AMAP_API_SECRET: {{ .Values.secretEnv.AMAP_API_SECRET }}
   {{- end }}
+  {{- if .Values.secretEnv.VAPID_PRIVATE_KEY }}
+  VAPID_PRIVATE_KEY: {{ .Values.secretEnv.VAPID_PRIVATE_KEY }}
+  {{- end }}
 {{- end }}

charts/trek/values.yaml

@@ -108,6 +108,15 @@ env:
   # Send the Amap (高德地图) calls through an egress proxy, a cache or a gateway that speaks the same API instead of
   # restapi.amap.com directly. The key itself is a credential and goes under secretEnv.AMAP_API_KEY, or into
   # Admin > Settings > API Keys. Defaults to https://restapi.amap.com.
+  # VAPID_PUBLIC_KEY: ""
+  # Web Push key pair, public half (base64url, 65 bytes). Leave both halves empty and TREK generates a pair on
+  # first start and keeps it in the database, so it travels with backups. To use your own pair, set this and
+  # secretEnv.VAPID_PRIVATE_KEY together, e.g. from `npx web-push generate-vapid-keys`. Changing the pair later
+  # means every device has to turn push on again.
+  # VAPID_SUBJECT: ""
+  # The contact push services see with every Web Push message: a mailto: address or an https:// URL. Defaults to
+  # APP_URL when it is an https:// address other than localhost, else https://github.com/liketrek/TREK. No email
+  # address is sent unless you set one here.
 
 
 # Secret environment variables stored in a Kubernetes Secret.
@@ -147,6 +156,11 @@ secretEnv:
   # with signing enabled, because such a key rejects every unsigned request. Leave empty
   # otherwise. The endpoint itself is not a secret and is set under env.AMAP_API_BASE.
   AMAP_API_SECRET: ""
+  # Optional Web Push key pair, private half (base64url, 32 bytes). Only used together with
+  # env.VAPID_PUBLIC_KEY; a pair whose halves do not belong together, or only one half, turns
+  # push off with an error in the log until it is fixed, and every device stays registered.
+  # Leave both empty to let TREK keep a generated pair in its database.
+  VAPID_PRIVATE_KEY: ""
 
 # If true, a random ENCRYPTION_KEY is generated at install and preserved across upgrades
 generateEncryptionKey: false