[Gerrrt]

What changed

The three in-house ntfy topic names change shape: the channel's word, a dash, and twelve hex characters (alerts-…, urgent-…, security-…). This commit has the docs and example files. The operator's two commits put the new names in secrets/sensitive.sops.yaml (NTFY_TOPIC_*, edited on trinity) and in secrets/observability.sops.yaml (the three in-house ALERTMANAGER_*_WEBHOOK_URL keys). Each commit changes only those keys. A comparison that printed only true/false confirmed each topic matches its URL and has the word-dash-12-hex shape. The ntfy.sh pair don't change.

Why

The iOS ntfy app shows a subscription by its topic name and can't rename it (binwiederhier/ntfy#1314), so on the iPhone the three channels showed up as random strings. A bare word was ruled out: #136 keeps the names like a credential, and upstream-base-url sends ntfy.sh the SHA-256 of each topic URL, so …/urgent would let anyone watch when a page is sent. The changelog entry has the full reasoning.

Blast radius

trinity's ntfy access list and prometheus's Alertmanager receivers. If the two hosts disagree, warnings on the in-house channel are lost and AlertmanagerNotificationsFailing pages through ntfy.sh. Pages still arrive over the ntfy.sh copies the whole time.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• python3 scripts/check_docs.py: docs OK. ./scripts/lint.sh: every check PASS, none skipped. I didn't run the full make validate, because this commit is docs and example files only.

• Cutover, after the secrets commit, merged just after a :29 so the converge timer doesn't race it: silence AlertmanagerNotificationsFailing for 30 minutes, run make up STACK=sensitive on trinity, then on prometheus run make render and force-recreate Alertmanager. Resubscribe both phones, then run the test page and warning from verify-the-alert-path.md.

• make validate passes

• Deployed to the lab and confirmed working

• Docs updated (docs/, service README, or docs/roadmap.md)

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

The encrypted alert-path changes span two independently deployed hosts, requiring operator verification of the coordinated cutover, phone resubscriptions, and end-to-end delivery on both phones across all three channels.

No open issues 🎉

What changed in this PR

This PR gives the three in-house ntfy channels recognizable names on iOS while retaining random suffixes for privacy. It updates the encrypted topic settings and corresponding Alertmanager receiver URLs; the external ntfy.sh channels remain unchanged.

Changes:

• Adopt channel-prefixed topic names: alerts-…, urgent-…, and security-…, each with twelve random hex characters.
• Align example configuration and setup instructions with the new naming scheme.
• Document iOS naming limitations, Android display names, and the privacy rationale.

File	Description
stacks/​sensitive/​README.md	Clarifies topic names on iOS and display-name settings on Android.
secrets/​sensitive.sops.yaml	Updates the three encrypted in-house topic values.
secrets/​sensitive.example.yaml	Documents topic generation and updates placeholders.
secrets/​observability.sops.yaml	Updates the three encrypted in-house receiver URLs.
secrets/​observability.example.yaml	Aligns receiver URL placeholders with the topic examples.
docs/​runbooks/​build-the-sensitive-tier-host.md	Updates topic-generation instructions.
docs/​changelog.md	Records the rename, privacy rationale, and related alert silencing.

_{Review effort: Balanced}