79a29873e3
Both webhook registrations (knowledge push + config-PR pull_request) now
use the public hive domain instead of loopback:
https://<HYPERHIVE_HIVE_DOMAIN>/webhook/{knowledge,config-pr}
This routes deliveries through the gateway, bypassing the Forgejo SSRF
guard that blocked loopback delivery and silently broke the config-PR
merge flow since launch.
Changes:
- webhook_secret: new module — auto-generate + persist a 32-byte HMAC
secret to STATE_ROOT/webhook-secret on first startup; verify
X-Hub-Signature-256 on every incoming webhook POST (HMAC-SHA256).
- forge/mod.rs: ensure_config_pr_webhook now takes hive_domain +
webhook_secret; sets secret in Forgejo hook config.
- workers/knowledge.rs: ensure_webhook same update.
- dashboard/webhook.rs: both handlers read raw Bytes first, verify HMAC,
then parse JSON. Returns 401 on signature mismatch.
- dashboard/mod.rs: AppState carries webhook_secret; serve() takes it.
- main.rs: load/generate secret at startup; pass to registration tasks
+ dashboard; add 5-minute config-PR polling fallback task.
- forge/config_pr_poll.rs: new — scan agent-configs/* for open PRs with
no pending MergeConfigPr approval; queue them. Idempotent.
- stores/approvals.rs: has_pending_merge_config_pr() for poll dedup.
- nix/modules/hive-gateway.nix: remove dashboardAuth from /webhook/
location (HMAC replaces basic auth for webhook endpoints; Forgejo
cannot send HTTP Basic credentials with webhook deliveries).
37 lines
837 B
TOML
37 lines
837 B
TOML
[package]
|
|
name = "hive-c0re"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow.workspace = true
|
|
axum.workspace = true
|
|
chrono.workspace = true
|
|
base64.workspace = true
|
|
bcrypt.workspace = true
|
|
reqwest.workspace = true
|
|
forgejo-api.workspace = true
|
|
url.workspace = true
|
|
clap.workspace = true
|
|
clap_complete.workspace = true
|
|
clap-markdown = "0.1"
|
|
indicatif.workspace = true
|
|
hive-sh4re.workspace = true
|
|
libc.workspace = true
|
|
listenfd = "1"
|
|
petgraph.workspace = true
|
|
hmac.workspace = true
|
|
sha2.workspace = true
|
|
rusqlite.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
tokio.workspace = true
|
|
tokio-stream.workspace = true
|
|
tracing.workspace = true
|
|
tracing-subscriber.workspace = true
|
|
problem_details = { version = "0.9.0", features = ["axum"] }
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|