Private server: messages are not delivered in real time when outbound internet is restricted (FCM relay unreachable)

[baymyradow]

I am running SMS Gateway in private server mode on my own infrastructure, exposed via a custom domain with SSL (e.g. https://sms.example.com).
The Android app is installed and successfully registered using a valid private_token.
Important context:
The server is running in a restricted network environment with limited outbound internet access.
Outbound connections to external services are blocked by default, including api.sms-gate.app.

[capcom6]

Hello!

Currently, SMSGate heavily relies on FCM, and push notifications can only be sent through api.sms-gate.app. Without a connection to the public cloud server, the app cannot receive enqueued messages in real time.

However, the app includes a fallback for devices without Google Play Services, which uses a direct server connection via SSE. Unfortunately, there is no way to force SSE when Play Services are available on the device. I plan to introduce an option to select the notification method on the device, but I cannot provide a timeline at the moment.

[baymyradow]

Thanks for your answer!
Should I to try setup Custom Gateway Setup?

[capcom6]

If the connection to Firebase is also restricted, then no. The device will still rely on waiting for an FCM notification.

[baymyradow]

Firebase is not restricted in my internet only api.sms-gate.app. blocked. Do you recommend to setup Custom Gateway Setup?

[capcom6]

In that case, it should work as expected.

[baymyradow]

Hi @capcom6.
Does Custom Gateway Setup still has security risks like the current version of the backend is designed for public use. There are some publicly available endpoints that are inappropriate for private use. For example, anyone who knows your server address can register the app on the server.

[capcom6]

The server built from the source code will function identically to the prebuilt version. This means that when running the server in public mode, it will expose the same public endpoints as the server at api.sms-gate.app.

Please note that I don't provide support for custom builds.

[baymyradow]

Do you say I need to run server in public mode to setup Custom Gateway?
Is there any ways to securely setup Custom Gateway setup without exposing public endpoints or securing endpoints with authentication?
In Custom Gateway setup you mentioned private backend configuration like

internal/sms-gateway/modules/push/upstream/client.go
- const BASE_URL = "https://api.sms-gate.app/upstream/v1"
+ const BASE_URL = "https://your-main-server.com/upstream/v1"

is this keep my gateway secure by eliminating exposing public endpoints?

This is my last question. Big Thanks for your support and this awesome project!

[capcom6]

Unfortunately, this is not a simple question.

The short answer is that you cannot run the server without a dependency on api.sms-gate.app and without public endpoints at the same time - unless you make deep modifications to the code or implement protection at the reverse-proxy level.

Changing the BASE_URL is necessary only if you are running both a public and a private server simultaneously. In that case, you would point your private server to your own public server. These could be within the same private network without exposing the public server, but I believe this is an overly complicated solution for most use cases.

By the way, it might be more reliable to solve the problem of restricting the connection to api.sms-gate.app. Could you contact me via support@sms-gate.app and share the reason why the public server is blocked in your infrastructure while Firebase is not? This information could help explore potential solutions.