bastian/deploy_home
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SCRUM-45: Caddy carve-out for the EasyPost return webhook

Browse Source 
The Fulfillr host is IP-restricted, so EasyPost's servers can't reach it. Add a
narrow `handle /webhooks/easypost` before the IP restriction (handle blocks are
mutually exclusive, first match wins) for prod (:9054) and dev (:9055) so the
HMAC-verified tracker webhook is reachable while the rest of the host stays locked.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Bastian de Byl
2026-06-12 20:29:44 -04:00
parent 3b9c46a11b
commit c896f69ff9
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/roles/podman/templates/caddy/Caddyfile.j2
+16
View File
@@ -344,6 +344,15 @@
# Fulfillr - {{ fulfillr_server_name }} (Static + API with IP restrictions)
{{ fulfillr_server_name }} {
# Public EasyPost tracker webhook — HMAC-verified inside go-fulfillr. Placed
# before the IP restriction (handle blocks are mutually exclusive, first
# match wins) so EasyPost's servers can POST here while everything else on
# this host stays IP-restricted.
@easypost_webhook path /webhooks/easypost
handle @easypost_webhook {
reverse_proxy localhost:9054
}
{{ ip_restricted_site() }}
@api {
@@ -391,6 +400,13 @@
# Fulfillr DEV/staging - {{ fulfillr_dev_server_name }} (Static + API with IP restrictions)
{{ fulfillr_dev_server_name }} {
# Public EasyPost tracker webhook (test mode) — HMAC-verified inside
# go-fulfillr. Placed before the IP restriction so EasyPost can POST here.
@easypost_webhook path /webhooks/easypost
handle @easypost_webhook {
reverse_proxy localhost:9055
}
{{ ip_restricted_site() }}
@api {