Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Send a GitHub webhook to a private URL

github.com

Post reply on HN
Print view View original

1–10 of 23 posts

Show HN: Send a GitHub webhook to a private URL

#1

Post by qrkourier »

I work on the OpenZiti project and I have a CI server that accepts GitHub webhooks, but I don't want to expose my server to the internet with open ports. I used the Python SDK for OpenZiti (overlay networking platform) to create a GitHub Action that sends the webhook to my private server via overlay instead of via the open internet.

This GitHub repo is a template that I made to show you how it all works. You can use it right away to run the sample server (httpbin-go) and see the GitHub Action in...action. Relevant threads include https://news.ycombinator.com/item?id=32596212 .

Show HN: Send a GitHub webhook to a private URL
github.com

Re: Show HN: Send a GitHub webhook to a private URL

#4

Post by scottydelta »

> but I don't want to expose my server to the internet with open ports.

One simple approach I take to solve this issue is by whitelisting (using ufw/VPS firewall) Github's webhook IPs listed at https://api.github.com/meta

This works flawlessly while keeping your CI server secure.

Re: Show HN: Send a GitHub webhook to a private URL

#5

Post by qrkourier »

scottydelta wrote: post #4

> but I don't want to expose my server to the internet with open ports. One simple approach I take to solve this issue is by whitelisting (using ufw/VPS firewall) Github's webhook IPs listed at https://api.github.com/meta This works flawlessly while keeping your CI server secure.

Did you find a way to auto-update your firewall from the dynamic allow list in the GitHub API?

Re: Show HN: Send a GitHub webhook to a private URL

#6

Post by corytheboyd »

qrkourier wrote: post #5
scottydelta wrote: post #4

> but I don't want to expose my server to the internet with open ports. One simple approach I take to solve this issue is by whitelisting (using ufw/VPS firewall) Github's webhook IPs listed at https://api.github.com/meta This works flawlessly while keeping your CI server secure.

Did you find a way to auto-update your firewall from the dynamic allow list in the GitHub API?

I was doing this with Cloudflare IPs, and iptables as the firewall. Pretty simple bash script scheduled with crontab worked just fine. Was doing this on a DD-WRT flashed netgear router. There's probably something similar that can be done here

Re: Show HN: Send a GitHub webhook to a private URL

#7

Post by ethomson »

Neat stuff - certainly this problem crops up quite a lot where an internal server needs to get GitHub webhook data.

In the past, I've had good luck using a webhook proxy. I've mostly just used https://smee.io/ which is simple and lightweight although seems to be mostly abandonware at this point. I dockerized it so that it could be used in a Kubernetes cluster, which was very useful for my GitHub Actions build cluster: https://github.com/ethomson/smee-client

There's also Hookdeck, which I haven't used in production, but have played around with, and it seems conceptually the same, but can be made more Enterprisey. Whether that's a bug or a feature is probably up to you.

Re: Show HN: Send a GitHub webhook to a private URL

#8

Post by qrkourier »

ethomson wrote: post #7

Neat stuff - certainly this problem crops up quite a lot where an internal server needs to get GitHub webhook data. In the past, I've had good luck using a webhook proxy. I've mostly just used https://smee.io/ which is simple and lightweight although seems to be mostly abandonware at this point. I dockerized it so that it could be used in a Kubernetes cluster, which was very useful for my GitHub Actions build cluster…

The proxy idea is interesting too. Does a webhook proxy entail a polling model for events? That is, does the private server have to poll the proxy to receive the webhook? I wanted the GitHub event to push to trigger actions on the private server.

Re: Show HN: Send a GitHub webhook to a private URL

#9

Post by scottydelta »

qrkourier wrote: post #5
scottydelta wrote: post #4

> but I don't want to expose my server to the internet with open ports. One simple approach I take to solve this issue is by whitelisting (using ufw/VPS firewall) Github's webhook IPs listed at https://api.github.com/meta This works flawlessly while keeping your CI server secure.

Did you find a way to auto-update your firewall from the dynamic allow list in the GitHub API?

Github rarely changes it's hooks IPs.

The current list has 4 IPv4 IP range and upon checking my server firewall(last updated 3 years ago), I can see I have the first 3 entries in there.

So in the last 3 years, Github has added 1 new IP range which is missing from my server but even then, no webhook call has ever failed to my CI server.

As a precaution I just updated my server firewall right now.

You could of course write a cron script to regularly check Github hooks IPs and update firewall if Github changes it's webhooks IPs.

Re: Show HN: Send a GitHub webhook to a private URL

#10

Post by ethomson »

qrkourier wrote: post #8
ethomson wrote: post #7

Neat stuff - certainly this problem crops up quite a lot where an internal server needs to get GitHub webhook data. In the past, I've had good luck using a webhook proxy. I've mostly just used https://smee.io/ which is simple and lightweight although seems to be mostly abandonware at this point. I dockerized it so that it could be used in a Kubernetes cluster, which was very useful for my GitHub Actions build cluster…

The proxy idea is interesting too. Does a webhook proxy entail a polling model for events? That is, does the private server have to poll the proxy to receive the webhook? I wanted the GitHub event to push to trigger actions on the private server.

No - your local server will still listen for webhooks, but they'll come from the proxy's client software.

Basically, you set up your GitHub webhook URL as the proxy server (for example, smee.io). Then you run a client on your local machine that connects to the proxy server. When a webhook is fired, it will be sent to the proxy, then delivered to the connected client, which will then pass it along as a webhook to whatever machine you've configured.

There's disadvantages to having all this stuff running, of course, so I think that handling this at the networking layer instead of putting a proxy just for webhooks into place is an interesting strategy. Certainly, it sounds like the right solution if you're already using OpenZiti.

Post reply on HN