Module webhook 

SSRF-guarded JSON webhook delivery (used by seer watch --webhook).

Watch mode can notify an operator-supplied HTTP endpoint when a watched domain changes state. That URL is user configuration, which makes this an outbound-request primitive — so it gets the same SSRF envelope as every other outbound leg of seer (RDAP, WHOIS, status):

• Only http/https URLs with a host are accepted.
• The host resolves through crate::net::resolve_public_host — the single source of truth for reserved-range policy — and every resolved address must be public. Loopback, RFC1918, link-local (incl. the cloud metadata endpoint), CGNAT, NAT64/6to4 encodings, etc. are refused before any connect.
• The validated addresses are pinned on the HTTP client via resolve_to_addrs, closing the TOCTOU window between validation and connect (DNS-rebinding defense). Pinning is a builder-time decision that depends on the resolved addresses, which is why the reqwest client is built per delivery instead of stored on the struct.
• Redirects are disabled: a 3xx Location is a fresh, unvalidated URL, so following it would bypass the guard entirely (redirect-based SSRF). A redirecting webhook endpoint surfaces as a failed delivery instead.

Deliveries are single-attempt and timeout-bounded; retry/backoff policy belongs to the caller (watch mode), matching the status module’s stance on not masking flakiness. A non-2xx response surfaces as an error carrying only the HTTP status — never the response body, which is untrusted remote content and must not leak into logs or terminal output.

Structs

WebhookClient

SSRF-guarded HTTP client that POSTs JSON payloads to a webhook URL.

WebhookDelivery

Outcome of a successful webhook delivery.