Push notifications not delivering on self-hosted Starter workspace with internal domain

Community Support Mobile Apps
1

Environment:

  • Rocket.Chat version: 8.2.0
  • Deployment: Self-hosted, Docker Compose on Ubuntu Server 24.04 LTS
  • Plan: Starter (free, self-managed)
  • MongoDB: 8.2.12
  • Reverse proxy: Nginx with self-signed TLS certificate
  • Domain: Internal only - not publicly reachable
  • Network: Internal LAN internet access available on the server

Issue:
Push notifications are not being delivered to iOS devices despite the following being correctly configured:

  • Push enabled in Admin → Push settings

  • Enable Gateway: ON

  • Gateway: https://gateway.rocket.chat

  • Production: ON

  • APN device token successfully registered (POST /api/v1/push.token returns 200)

  • “Send a test push to my user” returns “Your push was sent to 1 devices” — confirming the gateway accepts the request

  • No errors in Rocket.Chat logs related to push

  • iOS notification permissions granted on device

  • Workspace shows as registered in the Admin → Workspace UI with green checkmarks

    What we checked:

    • Device token confirmed stored in _raix_push_app_tokens collection with enabled: true
    • Cloud_Workspace_Registration_State in database shows not_registered despite UI showing “Workspace registered” — manually updated to registered via MongoDB, no change in push behavior
    • Sync license update performed from Subscription page — shows “Sync success” but database state reverts to not_registered
    • Server has outbound internet access — curl -I https://gateway.rocket.chat returns 200
    • No proxy between server and internet

    Observation:
    There appears to be a persistent mismatch between what the Admin UI shows (Workspace registered, green checkmarks) and what the database actually stores (not_registered). We suspect the gateway is silently rejecting push delivery because the workspace cannot be externally verified — our server is on an internal domain with a self-signed certificate, meaning Rocket.Chat’s cloud infrastructure cannot reach back to validate the workspace.

    Question:

    1. Does gateway.rocket.chat require the workspace to be reachable from the internet for push notifications to work? If so, is there a supported way to use the push gateway from an internal/air-gapped deployment on the Starter plan?
    2. Why does Cloud_Workspace_Registration_State revert to not_registered after sync even when the UI confirms registration and subscription sync succeeds?
    3. Is there a way to self-host the push notification gateway for internal deployments without upgrading to a paid plan?

    References:

    • Token registration log: POST /api/v1/push.token HTTP/1.1" 200 430
    • Test push log: “Your push was sent to 1 devices” (no errors)
    • Push logs: completely empty (no attempts logged after gateway accepts the push)
2

A good read in the docs will answer all this.

Yup.

I think you are permitted one airgapped server on Starter. But if you are truly airgapped, you can’t use push notifications.

You have a choice to make.

Read the docs on how to airgap. If the server gets one whiff of connectivity it breaks the airgap & licence.

Again, read the docs & dev docs on running your own push server.

You will have to build your own apps etc.