Skip to content

Release v1.3.0 — Secure REST API & Service Plugin Architecture

Choose a tag to compare

View all tags
@jonhowe jonhowe released this 02 Mar 21:06
· 35 commits to main since this release
1.3
a60c721
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Notes

🚀 New Feature: Secure Outbound REST API

This release introduces a secure REST API that allows trusted external systems to send Signal messages through the agent.

New Endpoints

  • GET /health
  • POST /api/v1/send

Example:

{
  "to": "+19193280766",
  "message": "Hello from REST"
}

🔐 Security-First Design

The REST API is built with strong safety controls:

  • Bearer token authentication via token_file
  • Destination allowlist (allowed_destinations) — deny-by-default if empty
  • Optional client IP allowlist
  • Rate limiting (max_requests_per_minute)
  • Request size limits
  • Message length limits
  • Optional message chunking
  • Strict token file permission enforcement (chmod 600)

The API is disabled by default and must be explicitly enabled in rules.yaml.

🧩 Plugin Architecture Enhancement

This release introduces support for multiple plugin types:

1️⃣ Rule Plugins (existing behavior)

  • Triggered by message rules
  • Execute commands or integrations
  • Continue working unchanged

2️⃣ Service Plugins (new)

  • Long-running background services
  • Start at agent initialization
  • Example: REST API server

This separation improves maintainability and allows future extensions such as:

  • Logging sinks
  • Metrics exporters
  • Webhook emitters
  • Event bus integrations

🛠 Improvements & Fixes

  • Enforced allowed_services validation for home_assistant_service
  • Fixed incorrect config key usage for plugin_http.allowed_hosts
  • Improved redirect validation against host allowlists
  • Structured REST API error responses (400/401/403/413/429)
  • Thread-safe message dispatch from REST thread to GLib main loop

⚙️ New Configuration Block

Add to globals:

rest_api:
  enabled: true
  bind_host: "127.0.0.1"
  bind_port: 8787

  token_file: "/path/to/rest_api_token"
  require_private_token_file: true

  allowed_destinations:
    - "+19193280766"

  allowed_client_ips: ["127.0.0.1"]

  max_request_bytes: 32768
  max_message_chars: 3500
  max_recipients_per_request: 1

  split_long_messages: true
  chunk_size: 1400
  numbered_chunks: true

  max_requests_per_minute: 60

🔄 Backward Compatibility

  • No breaking changes to existing rules
  • No changes required to existing rules.d/ configurations
  • REST API is opt-in and disabled by default

📌 Summary

This release adds a production-ready, secure REST API for outbound messaging and establishes a scalable service plugin architecture for future integrations.

The agent is now ready for controlled external automation and expansion beyond rule-triggered workflows.

Assets 2
Loading