bketelsen / captainhook Goto Github PK

A generic webhook endpoint that runs scripts based on the URL called

License: MIT License

Go 82.45% Makefile 3.81% Dockerfile 2.56% Nix 11.19%

captainhook's Introduction

captainhook

A generic webhook endpoint that runs scripts based on the URL called

This tool was built as part of a CI orchestration process, to be called when Docker trusted builds finish. It explicitly ignores the posted data from the webhook because that would be insecure, which is bad.

Shoulders of Giants

Captainhook would not be possible if not for all of the great projects it depends on. Please see SHOULDERS.md to see a list of them.

Quick Start

Install captainhook

go get github.com/bketelsen/captainhook

Create the `configdir`

mkdir ~/captainhook

Add a script

{
    "scripts": [
        {
            "command": "ls",
            "args": [
                "-l",
                "-a"
            ]
        },
        {
            "command": "echo",
            "args": [
		    "hello"
		    ]
        }
    ]
}

Name this script endpoint1.json

Start the service

captainhook -configdir ~/captainhook

Test using curl

curl -X POST http://localhost:8080/endpoint1

Configure calling webhooks

Each script you create in the configdir will be executed when the corresponding endpoint is called.

If you have a script called deployBigApp.json you would trigger it by posting to http://your.captainhook.url/deployBigApp.

The scripts in the json file are executed sequentially, and the output is logged and returned to the caller in the response, which always has an HTTP status code of 200 (OK) even if your scripts didn't work. This is intentional, to avoid causing errors in external services like Docker or Github, which might not like you returning statuses other than 200 (OK).

Accessing the Request POST Body

You'll sometimes need to access the POST data of the request for information such as a callback URL. You can pass the raw POST data to a script by adding {{POST}} to the script arguments.

{
    "scripts": [
        {
            "command": "echo",
            "args": [
            "{{POST}}"
            ]
        }
    ]
}

Limiting access for webhooks

You can limit who can call your webhooks by specifying "allowedNetworks" in the json config.

{
    "scripts": [
        {
            "command": "echo"
        }
    ],
    "allowedNetworks": [
        "10.0.0.0/8",
        "127.0.0.1/32"
    ]
}

This would allow your hook to be called from the 10.0.0.0/8 network, or from localhost.

Supporting proxy headers for client IP

Only enable proxy support if you are on a trusted network behind a reverse proxy. End-users with direct network access can subvert the allowedNetworks restriction if proxy support is on.

captainhook -configdir ~/captainhook -enable-proxy -proxy-header X-Forwarded-For

Docker

docker pull bketelsen/captainhook
mkdir /some/local/config
$EDITOR /some/local/config/myhook.json
docker run -d -v /some/local/config:/config bketelsen/captainhook

Install

captainhook requires Go 1.13+ to build locally.

go get github.com/bketelsen/captainhook

Build

Download

mkdir -p $GOPATH/src/github.com/bketelsen
cd $GOPATH/src/github.com/bketelsen
git clone [email protected]:bketelsen/captainhook.git

go build .

To Do

more logs

captainhook's People

Contributors

Stargazers

Watchers

captainhook's Issues

Use a multi-stage dockerfile

Your current docker image is large-ish.

You could use docker 17.06's new feature: Multi-stage builds

I have an example here if it helps: https://github.com/docwhat/go-importd/blob/master/Dockerfile

Since people expect to be able to run scripts, etc. using ubuntu:16.04 as the base (with optionally adding the docker command line tool) would probably be a good idea.

bash: captainhook: command not found

Title says all. I assume it should be available after running go get github.com/bketelsen/captainhook, however this does not seem to be the case.

How to `cd` to some directory

I need to change the directory before executing script. I've found a solution, but I'm not sure that it is the best way to do it.

{
    "scripts": [
        {
            "command": "/bin/sh",
            "args": [
                "-c",
                "cd /Users/bessarabov/Desktop; pwd"
            ]
        }
    ]
}

Maybe you can recommend something?

documentation missing

-echo?

Is it -echo true/false? Or just -echo to enable it?

logging

logging needs to be added, completed, and configurable

Filters

Hi,

It would be great if we could set a filter to only execute the script if the branch name matched a certain pattern. I would also be great to have the scripts executed if the push was tagged with a version number.

runtime error: invalid memory address or nil pointer dereference

When the command in the json doesn't exist, I get:

2014/06/05 16:05:26 http: panic serving 127.0.0.1:58875: runtime error: invalid memory address or nil pointer dereference
goroutine 3 [running]:
net/http.func·009()
    /usr/lib/go/src/pkg/net/http/server.go:1093 +0xae
runtime.panic(0x65c840, 0x957c88)
    /usr/lib/go/src/pkg/runtime/panic.c:248 +0x106
os.(*ProcessState).Sys(0x0, 0x0, 0x0)
    /usr/lib/go/src/pkg/os/doc.go:76 +0x26
main.execScript(0xc21004a340, 0x35, 0x0, 0x0, 0x0, ...)
    /usr/share/go/src/github.com/bketelsen/captainhook/runbook.go:60 +0x169
main.(*runBook).execute(0xc210049840, 0x13, 0xc210049840, 0x0)
    /usr/share/go/src/github.com/bketelsen/captainhook/runbook.go:41 +0x113
main.hookHandler(0x7ffff7fc0818, 0xc21000f820, 0xc21005d000)
    /usr/share/go/src/github.com/bketelsen/captainhook/hook.go:21 +0x2f6
net/http.HandlerFunc.ServeHTTP(0x72ad28, 0x7ffff7fc0818, 0xc21000f820, 0xc21005d000)
    /usr/lib/go/src/pkg/net/http/server.go:1220 +0x40
github.com/gorilla/mux.(*Router).ServeHTTP(0xc21001f410, 0x7ffff7fc0818, 0xc21000f820, 0xc21005d000)
    /usr/share/go/src/github.com/gorilla/mux/mux.go:98 +0x21c
net/http.(*ServeMux).ServeHTTP(0xc21001e6c0, 0x7ffff7fc0818, 0xc21000f820, 0xc21005d000)
    /usr/lib/go/src/pkg/net/http/server.go:1496 +0x163
net/http.serverHandler.ServeHTTP(0xc21001f500, 0x7ffff7fc0818, 0xc21000f820, 0xc21005d000)
    /usr/lib/go/src/pkg/net/http/server.go:1597 +0x16e
net/http.(*conn).serve(0xc210058300)
    /usr/lib/go/src/pkg/net/http/server.go:1167 +0x7b7
created by net/http.(*Server).Serve
    /usr/lib/go/src/pkg/net/http/server.go:1644 +0x28b

deadlock?

2014/09/29 19:27:13 Listening on 127.0.0.1:666
fatal error: all goroutines are asleep - deadlock!

goroutine 1 [IO wait]:
net.runtime_pollWait(0x7fbe378d7618, 0x72, 0x0)
        /usr/lib/go/src/pkg/runtime/netpoll.goc:116 +0x6a
net.(*pollDesc).Wait(0xc2100537d0, 0x72, 0x7fbe378d60e8, 0xb)
        /usr/lib/go/src/pkg/net/fd_poll_runtime.go:81 +0x34
net.(*pollDesc).WaitRead(0xc2100537d0, 0xb, 0x7fbe378d60e8)
        /usr/lib/go/src/pkg/net/fd_poll_runtime.go:86 +0x30
net.(*netFD).accept(0xc210053770, 0x72cd18, 0x0, 0x7fbe378d60e8, 0xb)
        /usr/lib/go/src/pkg/net/fd_unix.go:382 +0x2c2
net.(*TCPListener).AcceptTCP(0xc210000250, 0x18, 0xc21000b810, 0x44c713)
        /usr/lib/go/src/pkg/net/tcpsock_posix.go:233 +0x47
net.(*TCPListener).Accept(0xc210000250, 0x7fbe378d65f8, 0xc21001ec00, 0x0, 0x0)
        /usr/lib/go/src/pkg/net/tcpsock_posix.go:243 +0x27
net/http.(*Server).Serve(0xc21001f500, 0x7fbe378d6650, 0xc210000250, 0x0, 0x0)
        /usr/lib/go/src/pkg/net/http/server.go:1622 +0x91
net/http.(*Server).ListenAndServe(0xc21001f500, 0xc21001f500, 0x1b)
        /usr/lib/go/src/pkg/net/http/server.go:1612 +0xa0
net/http.ListenAndServe(0x7fffe4217d5c, 0xd, 0x0, 0x0, 0x1, ...)
        /usr/lib/go/src/pkg/net/http/server.go:1677 +0x6d
main.main()
        /usr/share/go/src/github.com/bketelsen/captainhook/main.go:34 +0x321
2014/09/29 19:27:13 Listening on 127.0.0.1:667

What happens if a second webhook comes in while the first is running?

I want to use this script to deploy ansible playbooks, but I wonder if it would cause duplicate deployments. Does the script check and only allow things to run if another deployment isn't already running?

Make post data available

Write it to /tmp and use {{ postBodyFileName }} in the script? One can then eg use http://stedolan.github.io/jq/ to read it in?

Add queues/locking for non parallel jobs

I have a build job that currently does not support running in parallel since it's last step is to output it's build artifacts to one and the same download folder..
For my specific case I can just implement a lock in my builder shell script, most kinds of jobs of should of course be able run parallel so this is maybe a non issue?

I guess a related feature would also be to support for terminating a process to start a new one if the nature of the job isn't parallel and a trigger is received while already executing.