Add Signal notifier auth (Bearer token / HTTP Basic)

Author: brvier

CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to Gjallar are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.9.0] - 2026-08-20
+
+### Added
+
+- Signal notifier authentication: optional `token` (Bearer) or `user`/`pass`
+  (HTTP Basic) for gateways that require auth.
+
 ## [0.8.1] - 2026-07-06
 
 ### Changed

README.md

@@ -27,7 +27,8 @@ Rules: `> N`, `>= N`, `< N`, `<= N`, `== x`, `!= x`, `~ regex`, `rows > 0` (row
   Discord, Slack, Gotify, Pushover, generic webhooks, ...
 - Free Mobile SMS API (`type: freemobile`).
 - Signal via a [signal-cli-rest-api](https://github.com/bbernhard/signal-cli-rest-api)
-  gateway (`type: signal`: `url` to `/v2/send`, sender `number`, `recipients`).
+  gateway (`type: signal`: `url` to `/v2/send`, sender `number`, `recipients`;
+  optional `token` for Bearer auth or `user`/`pass` for HTTP Basic).
 
 A monitor alerts after `failure_threshold` consecutive failures (no flapping noise),
 and again on recovery. Open incidents survive restarts: no duplicate alerts.

gjallar.example.yaml

@@ -38,6 +38,10 @@ alerts:
     url: "https://signal-api.example.com/v2/send"
     number: "+33600000000"              # sender registered on the gateway
     recipients: ["+33611111111", "+33622222222"]
+    # If the gateway is protected, set ONE of:
+    # token: "${SIGNAL_TOKEN}"          # Bearer token
+    # user: "gjallar"                   # or HTTP Basic
+    # pass: "${SIGNAL_PASS}"
 
 monitors:
   # --- HTTP/HTTPS: status code, body regex, TLS certificate expiry ---

internal/alert/notifiers.go

@@ -21,7 +21,7 @@ func BuildNotifiers(alerts map[string]config.Alert) (map[string]Notifier, error)
 		case "freemobile":
 			out[name] = NewFreeMobile(a.User, a.Pass)
 		case "signal":
-			out[name] = NewSignal(a.URL, a.Number, a.Recipients)
+			out[name] = NewSignal(a.URL, a.Number, a.Recipients, a.Token, a.User, a.Pass)
 		default:
 			return nil, fmt.Errorf("alert %q: unknown type %q", name, a.Type)
 		}

internal/alert/signal.go

@@ -10,16 +10,22 @@ import (
 )
 
 // Signal sends messages through a signal-cli-rest-api compatible gateway
-// (POST {url} with {"message", "number", "recipients"}).
+// (POST {url} with {"message", "number", "recipients"}). The gateway may be
+// protected: set Token for Bearer auth, or User/Pass for HTTP Basic.
 type Signal struct {
 	URL        string // full /v2/send endpoint
 	Number     string // sender number registered on the gateway
 	Recipients []string
+	Token      string // optional Bearer token
+	User, Pass string // optional HTTP Basic credentials
 	Client     *http.Client
 }
 
-func NewSignal(url, number string, recipients []string) *Signal {
-	return &Signal{URL: url, Number: number, Recipients: recipients, Client: &http.Client{}}
+func NewSignal(url, number string, recipients []string, token, user, pass string) *Signal {
+	return &Signal{
+		URL: url, Number: number, Recipients: recipients,
+		Token: token, User: user, Pass: pass, Client: &http.Client{},
+	}
 }
 
 func (s *Signal) Send(ctx context.Context, title, message string) error {
@@ -36,6 +42,11 @@ func (s *Signal) Send(ctx context.Context, title, message string) error {
 		return err
 	}
 	req.Header.Set("Content-Type", "application/json")
+	if s.Token != "" {
+		req.Header.Set("Authorization", "Bearer "+s.Token)
+	} else if s.User != "" || s.Pass != "" {
+		req.SetBasicAuth(s.User, s.Pass)
+	}
 
 	resp, err := s.Client.Do(req)
 	if err != nil {

internal/alert/signal_test.go

@@ -23,7 +23,7 @@ func TestSignal(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	s := NewSignal(srv.URL, "+33616400522", []string{"+33689816957", "+33616400522"})
+	s := NewSignal(srv.URL, "+33616400522", []string{"+33689816957", "+33616400522"}, "", "", "")
 	if err := s.Send(context.Background(), "[Gjallar] DOWN: web", "web — boom"); err != nil {
 		t.Fatal(err)
 	}
@@ -43,6 +43,36 @@ func TestSignal(t *testing.T) {
 	}
 }
 
+func TestSignalAuth(t *testing.T) {
+	var auth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		auth = r.Header.Get("Authorization")
+		w.WriteHeader(201)
+	}))
+	defer srv.Close()
+
+	// Bearer takes precedence.
+	s := NewSignal(srv.URL, "+336", []string{"+337"}, "tok123", "u", "p")
+	s.Send(context.Background(), "t", "m")
+	if auth != "Bearer tok123" {
+		t.Errorf("bearer: got %q", auth)
+	}
+
+	// Basic when no token.
+	s = NewSignal(srv.URL, "+336", []string{"+337"}, "", "user", "pass")
+	s.Send(context.Background(), "t", "m")
+	if !strings.HasPrefix(auth, "Basic ") {
+		t.Errorf("basic: got %q", auth)
+	}
+
+	// No auth when nothing configured.
+	s = NewSignal(srv.URL, "+336", []string{"+337"}, "", "", "")
+	s.Send(context.Background(), "t", "m")
+	if auth != "" {
+		t.Errorf("no-auth: got %q", auth)
+	}
+}
+
 func TestBuildNotifiersSignal(t *testing.T) {
 	ns, err := BuildNotifiers(map[string]config.Alert{
 		"sig": {Type: "signal", URL: "http://h/v2/send", Number: "+336", Recipients: []string{"+337"}},

internal/config/config.go

@@ -56,6 +56,7 @@ type Alert struct {
 	// signal
 	Number     string   `yaml:"number"`     // sender number registered on the gateway
 	Recipients []string `yaml:"recipients"` // destination numbers
+	Token      string   `yaml:"token"`      // optional Bearer token for a protected gateway
 }
 
 type Monitor struct {