Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Send a GitHub webhook to a private URL

github.com

Post reply on HN
Print view View original

11–20 of 23 posts

Re: Show HN: Send a GitHub webhook to a private URL

#11

Post by caseysoftware »

Have you considered ngrok? You can open up a private tunnel from your local environment (local machine, container, device, whatever) to the public internet in seconds. Then you can layer on IP restrictions and even webhook verification to block any traffic not from your provider of choice. It's as simple as:

ngrok http 80 --verify-webhook=slack --verify-webhook-secret=[secret]

with a ton of providers out of the box: https://ngrok.com/docs/cloud-edge#webhook-verification

Also, we recently launched https://webhooks.fyi/ to serve as a community resource to capture patterns & practices around webhook implementations. That's a github pages site so pull requests welcome!

Disclosure: I work at ngrok and helped create webhooks.fyi :)

Re: Show HN: Send a GitHub webhook to a private URL

#12

Post by ChicagoBoy11 »

caseysoftware wrote: post #11

Have you considered ngrok? You can open up a private tunnel from your local environment (local machine, container, device, whatever) to the public internet in seconds. Then you can layer on IP restrictions and even webhook verification to block any traffic not from your provider of choice. It's as simple as: ngrok http 80 --verify-webhook=slack --verify-webhook-secret=[secret] with a ton of providers out of the box:…

Disclosure: I have never paid for ngrok but have used it sporadically for many years for some quick tunneling use-cases. It feels... magical, and a joy to use. OP, if it fits your use-case, would recommend giving them a try!

Re: Show HN: Send a GitHub webhook to a private URL

#13

Post by gz5 »

caseysoftware wrote: post #11

Have you considered ngrok? You can open up a private tunnel from your local environment (local machine, container, device, whatever) to the public internet in seconds. Then you can layer on IP restrictions and even webhook verification to block any traffic not from your provider of choice. It's as simple as: ngrok http 80 --verify-webhook=slack --verify-webhook-secret=[secret] with a ton of providers out of the box:…

ngrok free is great for smaller scale, as you describe.

openziti simplifies scale:

+ mTLS

+ zero trust w/ inbound firewall rule of deny-all (rather than ACLs)

+ private DNS w/ wildcard domains

note: mTLS, wildcard domains etc are in ngrok $900/user annual plan but these are free for foss like the OpenZiti solution used by OP (and maybe free for other solutions too?)

Re: Show HN: Send a GitHub webhook to a private URL

#14

Post by qrkourier »

caseysoftware wrote: post #11

Have you considered ngrok? You can open up a private tunnel from your local environment (local machine, container, device, whatever) to the public internet in seconds. Then you can layer on IP restrictions and even webhook verification to block any traffic not from your provider of choice. It's as simple as: ngrok http 80 --verify-webhook=slack --verify-webhook-secret=[secret] with a ton of providers out of the box:…

That's useful that ngrok has centralized webhook verification! It's meaningful security for the first hop from GitHub to ngrok.

Re: Show HN: Send a GitHub webhook to a private URL

#15

Post by qrkourier »

scottydelta wrote: post #9
qrkourier wrote: post #5

Earlier quoted context omitted.

Did you find a way to auto-update your firewall from the dynamic allow list in the GitHub API?

Github rarely changes it's hooks IPs. The current list has 4 IPv4 IP range and upon checking my server firewall(last updated 3 years ago), I can see I have the first 3 entries in there. So in the last 3 years, Github has added 1 new IP range which is missing from my server but even then, no webhook call has ever failed to my CI server. As a precaution I just updated my server firewall right now. You could of course w…

Glad you got it updated before you missed an event! That's the worry that made me look for something flexible and software-defined that I could run in GitHub Actions.

Re: Show HN: Send a GitHub webhook to a private URL

#16

Post by scottydelta »

qrkourier wrote: post #15
scottydelta wrote: post #9

Earlier quoted context omitted.

Github rarely changes it's hooks IPs. The current list has 4 IPv4 IP range and upon checking my server firewall(last updated 3 years ago), I can see I have the first 3 entries in there. So in the last 3 years, Github has added 1 new IP range which is missing from my server but even then, no webhook call has ever failed to my CI server. As a precaution I just updated my server firewall right now. You could of course w…

Glad you got it updated before you missed an event! That's the worry that made me look for something flexible and software-defined that I could run in GitHub Actions.

from my previous comment:

> You could of course write a cron script to regularly check Github hooks IPs and update firewall if Github changes it's webhooks IPs.

This is way easier and simpler than any other solution. It will be a mere 6 line script.

Re: Show HN: Send a GitHub webhook to a private URL

#17

Post by Yeroc »

qrkourier wrote: post #15
scottydelta wrote: post #9

Earlier quoted context omitted.

Github rarely changes it's hooks IPs. The current list has 4 IPv4 IP range and upon checking my server firewall(last updated 3 years ago), I can see I have the first 3 entries in there. So in the last 3 years, Github has added 1 new IP range which is missing from my server but even then, no webhook call has ever failed to my CI server. As a precaution I just updated my server firewall right now. You could of course w…

Glad you got it updated before you missed an event! That's the worry that made me look for something flexible and software-defined that I could run in GitHub Actions.

The bigger worry would be if they removed some IP addresses from their list. Those IP addresses would be juicy targets for hackers to scoop up and attempt an attack knowing that people have whitelisted them and that they allow access to what is likely relatively poorly protected infrastructure.

Re: Show HN: Send a GitHub webhook to a private URL

#18

Post by hangonhn »

We ended up implementing an API Gateway in AWS that just proxies the request to our CI server after a simple authentication (and also checking the signature of the request as suggested by GH).

Another related option is that you can run GitHub Runners in your own environment and they will connect to GitHub to accept "jobs" from GitHub Actions. This is another thing we've started doing as we look to pare down our self managed CI. This is a very solid choice I think. In case anyone is interested: https://docs.github.com/en/actions/hosting-your-own-runners/...

Re: Show HN: Send a GitHub webhook to a private URL

#19

Post by 0xbadcafebee »

Hi @qrkourier, you mention using the Python SDK, but it is not shown in the list of SDKs here, FYI: https://openziti.github.io/ And also there's only a couple listed here: https://openziti.github.io/api/index.html I therefore assumed there was no Python SDK...

Re: Show HN: Send a GitHub webhook to a private URL

#20

Post by Spivak »

qrkourier wrote: post #5
scottydelta wrote: post #4

> but I don't want to expose my server to the internet with open ports. One simple approach I take to solve this issue is by whitelisting (using ufw/VPS firewall) Github's webhook IPs listed at https://api.github.com/meta This works flawlessly while keeping your CI server secure.

Did you find a way to auto-update your firewall from the dynamic allow list in the GitHub API?

It's totally trivial in almost all setups. Here's Linux.

    ipset create ghwebhooks hash:net
    iptables -A INPUT -m set --match-set ghwebhooks src -m tcp --dport 443 -j ALLOW

    # in /etc/cron.daily
    ipset add ...
    ipset del ...
    ipset list ...
    ipset save >/etc/ipset.conf
Post reply on HN