Add Webhook Hostname (#668)

cmd/otfd/main.go

@@ -79,6 +79,7 @@ func parseFlags(ctx context.Context, args []string, out io.Writer) error {
 	cmd.Flags().StringSliceVar(&cfg.SiteAdmins, "site-admins", nil, "Promote a list of users to site admin.")
 	cmd.Flags().BytesHexVar(&cfg.Secret, "secret", nil, "Hex-encoded 16 byte secret for cryptographic work. Required.")
 	cmd.Flags().Int64Var(&cfg.MaxConfigSize, "max-config-size", cfg.MaxConfigSize, "Maximum permitted configuration size in bytes.")
+	cmd.Flags().StringVar(&cfg.WebhookHost, "webhook-hostname", "", "External hostname for otf webhooks")
 
 	cmd.Flags().IntVar(&cfg.CacheConfig.Size, "cache-size", 0, "Maximum cache size in MB. 0 means unlimited size.")
 	cmd.Flags().DurationVar(&cfg.CacheConfig.TTL, "cache-expiry", internal.DefaultCacheTTL, "Cache entry TTL.")

docs/config/flags.md

@@ -107,6 +107,15 @@ Github pull request.
 
 It is highly advisable to set this flag in a production deployment.
 
+## `--webhook-hostname`
+
+* System: `otfd`
+* Default: `localhost:8080` or `--address` if specified.
+
+Sets the hostname that VCS providers can use to access the OTF webhooks.
+
+It is highly advisable to set this flag in a production deployment.
+
 ## `--log-format`
 
 * System: `otfd`, `otf-agent`

internal/daemon/config.go

@@ -28,6 +28,7 @@ type Config struct {
 	Secret                       []byte // 16-byte secret for signing URLs and encrypting payloads
 	SiteToken                    string
 	Host                         string
+	WebhookHost                  string
 	Address                      string
 	Database                     string
 	MaxConfigSize                int64

internal/daemon/daemon.go

@@ -93,6 +93,9 @@ func New(ctx context.Context, logger logr.Logger, cfg Config) (*Daemon, error) {
 	}
 
 	hostnameService := internal.NewHostnameService(cfg.Host)
+	if cfg.WebhookHost != "" {
+		hostnameService.SetWebhookHostname(cfg.WebhookHost)
+	}
 
 	renderer, err := html.NewRenderer(cfg.DevMode)
 	if err != nil {
@@ -454,7 +457,9 @@ func (d *Daemon) Start(ctx context.Context, started chan struct{}) error {
 		listenAddress := ln.Addr().(*net.TCPAddr)
 		d.System.SetHostname(internal.NormalizeAddress(listenAddress))
 	}
+
 	d.V(0).Info("set system hostname", "hostname", d.System.Hostname())
+	d.V(0).Info("set webhook hostname", "webhookHostname", d.System.WebhookHostname())
 
 	subsystems := []*Subsystem{
 		{

internal/hostname.go

@@ -8,15 +8,25 @@ import (
 )
 
 type HostnameService struct {
-	hostname string
+	hostname        string
+	webhookHostname string
 }
 
 func NewHostnameService(hostname string) *HostnameService {
-	return &HostnameService{hostname}
+	return &HostnameService{hostname, hostname}
 }
 
-func (s *HostnameService) Hostname() string            { return s.hostname }
+func (s *HostnameService) Hostname() string { return s.hostname }
+func (s *HostnameService) WebhookHostname() string {
+	if s.webhookHostname == "" {
+		return s.hostname
+	}
+	return s.webhookHostname
+}
 func (s *HostnameService) SetHostname(hostname string) { s.hostname = hostname }
+func (s *HostnameService) SetWebhookHostname(webhookHostname string) {
+	s.webhookHostname = webhookHostname
+}
 
 func (s *HostnameService) URL(path string) string {
 	u := url.URL{
@@ -27,6 +37,15 @@ func (s *HostnameService) URL(path string) string {
 	return u.String()
 }
 
+func (s *HostnameService) WebhookURL(path string) string {
+	u := url.URL{
+		Scheme: "https",
+		Host:   s.WebhookHostname(),
+		Path:   path,
+	}
+	return u.String()
+}
+
 // NormalizeAddress takes a host:port and converts it into a host:port
 // appropriate for setting as the addressable hostname of otfd, e.g. converting
 // 0.0.0.0 to 127.0.0.1.

internal/repohooks/repohook.go

@@ -63,7 +63,7 @@ func newRepohook(opts newRepohookOptions) (*hook, error) {
 		}
 		hook.secret = secret
 	}
-	hook.endpoint = opts.URL(path.Join(handlerPrefix, hook.id.String()))
+	hook.endpoint = opts.WebhookURL(path.Join(handlerPrefix, hook.id.String()))
 	return &hook, nil
 }