1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
//! Outgoing webhooks as a service
//!
//! Customers register HTTP endpoints; your systems publish events; this service
//! delivers every event to each subscribed endpoint with a signed request,
//! retrying failures with exponential backoff, honouring `Retry-After`, parking
//! hopeless deliveries in a dead-letter list for the operator, disabling
//! endpoints that keep failing, and surviving restarts (queue and endpoints are
//! saved to disk). Targets are vetted against SSRF at registration and again at
//! every delivery.
//!
//! Configuration (environment):
//! PORT listen port (default 3000)
//! WEBHOOKS_API_KEY key for the management API (required unless DEV=1)
//! DATA_DIR where endpoints and the queue are saved (default ./webhooks-data)
//! ALLOW_PRIVATE_TARGETS 1 to deliver to loopback/private addresses
//! DEV 1 = demo key, private targets allowed
//!
//! Run: DEV=1 cargo run --example webhooks
//! Try: curl -s -X POST localhost:3000/api/endpoints -H 'x-api-key: dev-webhooks-key-dev-key' \
//! -H 'content-type: application/json' -d '{"url":"http://127.0.0.1:9000/hook","events":["order.created"]}'
//! curl -s -X POST localhost:3000/api/events -H 'x-api-key: dev-webhooks-key-dev-key' \
//! -H 'idempotency-key: order-17-created' -H 'content-type: application/json' \
//! -d '{"type":"order.created","data":{"order_id":17}}'
//!
//! Receivers verify `X-Webhook-Signature` with `app::verify_signature`.
async