Gotify Plain Go Setup with Nginx Reverse Proxy

This article describes step-by-step installation and configuration of Gotify using plain Go binaries (no Docker), including Nginx reverse proxy, database setup (SQLite or MariaDB), and troubleshooting tips based on real experience.

1. Download Gotify

Clone the server repository to a temporary directory:

git clone https://github.com/gotify/server.git ~/gotify

2. Build Gotify

Navigate to the Gotify directory:

cd ~/gotify

Build the binary:

make build

The resulting binary will be in `build/`. Copy it to your installation folder (example: `/opt/gotify`):

sudo cp build/gotify-linux-amd64 /opt/gotify/

3. Directory Layout

Installation: `/opt/gotify`
Data: `/opt/gotify/data`
Plugins: `/opt/gotify/plugins`
Public static files: `/opt/gotify/public`

4. Configuration

Create `/opt/gotify/config.yml` with the following example:

server:
  listenaddr: "0.0.0.0"
  port: 444
external-url: https://yourdomain.example.com/gotify
database:
  dialect: sqlite3
  connection: /opt/gotify/server.db

Notes:
- `listenaddr: 0.0.0.0` allows LAN and localhost access
- For MariaDB/MySQL, change `dialect: mysql` and provide a proper connection string

5. Nginx Reverse Proxy

Example `/etc/nginx/sites-available/gotify`:

    location /gotify/ {
        proxy_pass http://127.0.0.1:444/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";

If you like to add eg blocking mode Access control use:

    location /gotify/ {
        proxy_pass http://127.0.0.1:444/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";

        # Access control
        allow 127.0.0.1;        # Localhost (Nginx itself)
        allow 192.168.1.0/24;   # LAN subnet
        allow 92.32.0.0/14;     # Telenor public IP range
        allow 10.8.0.0/24;      # WireGuard subnet
        deny all;               # Deny everything else
    }

Notes:

WebSocket connections require correct `proxy_set_header` lines.
The trailing `/` in `proxy_pass` is important.
WebSocket support if needed if you want notifications in browser, else you will get websocket failed as a error message in web

6. Systemd Service

Create `/etc/systemd/system/gotify.service`:

[Unit]
Description=Gotify Server
After=network.target

[Service]
User=gotify
WorkingDirectory=/opt/gotify
ExecStart=/opt/gotify/gotify-linux-amd64
Restart=on-failure

[Install]
WantedBy=multi-user.target

Fix permission for binding to port 444 (else service may fail):

sudo setcap 'cap_net_bind_service=+ep' /opt/gotify/gotify-linux-amd64

7. Adding Admin User

Default login: `admin` / `admin`
To create a new admin user from the CLI:

Login to cli and go to <users> tab:

add a new user (slide the 'has administrator rights' )
check if you can login again with new user.
delete default admin user

sudo /opt/gotify/gotify-linux-amd64 user add --name "YourUser" --password "YourPassword" --admin

^

If experience unknown@unknown in cli ui up in the top-left corner. its because:

When you see username: unknown and version unknown@unknown

When you build Gotify yourself using Go and make:

The build metadata (like version, commit hash, and GitHub info) is usually injected at compile time via Go linker flags (-ldflags).

If you just run go build without setting these flags, the binary doesn’t know its version and CLI commands like --version or user add may misbehave or print unknown.

Specifically, Gotify’s user add command relies on the binary being properly built with CLI support, which includes linking in the metadata. Without it, some commands might default to starting the server instead of performing the action.

How to fix it

Option A: Rebuild Gotify with proper linker flags

Depending on where you put the build files

cd ~/gotify

then run:

VERSION=2.4.0  # or the version you want
COMMIT=$(git rev-parse HEAD)
DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')

go build -ldflags "-X main.version=$VERSION -X main.commit=$COMMIT -X main.buildDate=$DATE" -o gotify-linux-amd64

Clone the official Gotify repository (if you haven’t already):

8. Database Options

SQLite (default): stored at `/opt/gotify/server.db`
MariaDB/MySQL: configure `config.yml` like below.

# Database config for MariaDB/MySQL
database:
  dialect: "mysql"        # use mysql/mariadb
  connection: "gotifyuser:password@tcp(localhost:3306)/gotify?parseTime=true&charset=utf8mb4"

Create required tables in MariaDB:

CREATE DATABASE gotify;
USE gotify;
-- Gotify will auto-create tables on first startup

9. Network & Security Notes

Limit Gotify to local LAN, WireGuard, and your static IP using firewall rules. Example CIDR for Telenor ISP: `92.32.0.0/14`
Include localhost: `127.0.0.1`
Since Nginx handles SSL, Gotify can run on plain HTTP internally (`listenaddr: 0.0.0.0`, `port: 444`)

10. Troubleshooting

Port 444 in use / permission denied → use `sudo setcap 'cap_net_bind_service=+ep' /opt/gotify/gotify-linux-amd64`
WebSocket connection closed → check Nginx `proxy_pass` has a trailing `/`
Service fails to start → check logs with:

journalctl -u gotify.service -n 50 --no-pager

Admin user not created → login with default `admin/admin` and add a new user via frontend or CLI
Firewall / LAN access → ensure `listenaddr` is `0.0.0.0` and ports are open on local LAN, WireGuard, and your ISP CIDR