diff --git a/docs/Hook-Examples.md b/docs/Hook-Examples.md index 308c8e3..aedba52 100644 --- a/docs/Hook-Examples.md +++ b/docs/Hook-Examples.md @@ -281,3 +281,44 @@ or in a single line, using https://github.com/jpmens/jo to generate the JSON cod jo binary=%filename.zip | curl -H "Content-Type:application/json" -X POST -d @- \ http://localhost:9000/hooks/test-file-webhook + + +## Incoming Scalr Webhook +[Guide by @hassanbabaie] +Scalr makes webhook calls based on an event to a configured webhook endpoint (for example Host Down, Host Up). Webhook endpoints are URLs where Scalr will deliver Webhook notifications. +Scalr assigns a unique signing key for every configured webhook endpoint. +Refer to this URL for information on how to setup the webhook call on the Scalr side: [Scalr Wiki Webhooks](https://scalr-wiki.atlassian.net/wiki/spaces/docs/pages/6193173/Webhooks) +In order to leverage the Signing Key for addtional authentication/security you must configure the trigger rule with a match type of "scalr-signature". + +```json +[ + { + "id": "redeploy-webhook", + "execute-command": "/home/adnan/redeploy-go-webhook.sh", + "command-working-directory": "/home/adnan/go", + "include-command-output-in-response": true, + "trigger-rule": + { + "match": + { + "type": "scalr-signature", + "secret": "Scalr-provided signing key" + } + }, + "pass-environment-to-command": + [ + { + "envname": "EVENT_NAME", + "source": "payload", + "name": "eventName" + }, + { + "envname": "SERVER_HOSTNAME", + "source": "payload", + "name": "data.SCALR_SERVER_HOSTNAME" + } + ] + } +] + +``` \ No newline at end of file diff --git a/docs/Hook-Rules.md b/docs/Hook-Rules.md index 32d35d3..52947aa 100644 --- a/docs/Hook-Rules.md +++ b/docs/Hook-Rules.md @@ -198,4 +198,20 @@ The IP can be IPv4- or IPv6-formatted, using [CIDR notation](https://en.wikipedi "ip-range": "192.168.0.1/24" } } +``` + +### 5. Match scalr-signature + +The trigger rule checks the scalr signature and also checks that the request was signed less than 5 minutes before it was received. +A unqiue signing key is generated for each webhook endpoint URL you register in Scalr. +Given the time check make sure that NTP is enabled on both your Scalr and webhook server to prevent any issues + +```json +{ + "match": + { + "type": "scalr-signature", + "secret": "Scalr-provided signing key" + } +} ``` \ No newline at end of file