Show HN: Send a GitHub webhook to a private URL • Hacker News Board

Re: Show HN: Send a GitHub webhook to a private URL

#21

Post by qrkourier » Wed, Sep 21, 2022, 4:18 PM UTC

hangonhn wrote: post #18

We ended up implementing an API Gateway in AWS that just proxies the request to our CI server after a simple authentication (and also checking the signature of the request as suggested by GH). Another related option is that you can run GitHub Runners in your own environment and they will connect to GitHub to accept "jobs" from GitHub Actions. This is another thing we've started doing as we look to pare down our self…

That's a neat angle. I reckon you could position the self-hosted runner network-adjacent a private CI server and poke it directly from behind the firewall with a GitHub Actions job.

Re: Show HN: Send a GitHub webhook to a private URL

#22

Post by qrkourier » Wed, Sep 21, 2022, 4:22 PM UTC

0xbadcafebee wrote: post #19

Hi @qrkourier, you mention using the Python SDK, but it is not shown in the list of SDKs here, FYI: https://openziti.github.io/ And also there's only a couple listed here: https://openziti.github.io/api/index.html I therefore assumed there was no Python SDK...

I see what you mean. I'll make sure to suggest adding it in those places, then! There's another post about the Python SDK in https://news.ycombinator.com/item?id=32923851 and the repo is https://github.com/openziti/ziti-sdk-py/#readme

Re: Show HN: Send a GitHub webhook to a private URL

#23

Post by linsomniac » Wed, Sep 21, 2022, 9:57 PM UTC

qrkourier wrote: post #5

scottydelta wrote: post #4

> but I don't want to expose my server to the internet with open ports. One simple approach I take to solve this issue is by whitelisting (using ufw/VPS firewall) Github's webhook IPs listed at https://api.github.com/meta This works flawlessly while keeping your CI server secure.

Did you find a way to auto-update your firewall from the dynamic allow list in the GitHub API?

I do something similar for AWS IPs in our iptables firewalls. I create an ipset for "aws", and then create rules that match that ipset. I then have a script that runs periodically and downloads the set of AWS IPs (AWS publishes that) and writes then runs the script that creates the ipset.