From 5c1c9d16089c2b3bcc858e03e9911408f9254c0a Mon Sep 17 00:00:00 2001 From: randogoth Date: Wed, 14 Oct 2026 12:44:24 +0300 Subject: [PATCH] Log webhook deliveries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The receiver logged nothing about requests — not a delivery, not a rejected HMAC, not a 404 for an unknown hook id. Verified the hard way: an unsigned POST was correctly refused and left no trace whatsoever in the journal. That makes the one failure that matters invisible. A webhook with the wrong secret or the wrong content type fails the HMAC check and is dropped, and the only symptom is that releases arrive a day late on the timer instead of immediately — which looks exactly like nothing being wrong. Co-Authored-By: Claude Opus 5 (1M context) --- module.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/module.nix b/module.nix index 1f3a9eb..c4dce6a 100644 --- a/module.nix +++ b/module.nix @@ -312,7 +312,13 @@ in Type = "simple"; RuntimeDirectory = "fdroid-webhook"; ExecStartPre = "+${makeHooks}"; - ExecStart = "${pkgs.webhook}/bin/webhook -hooks /run/fdroid-webhook/hooks.json -port ${toString cfg.webhookPort}"; + # -verbose, because without it this logs nothing at all about + # requests: not a delivery, not a rejection, not a 404 for an unknown + # hook id. A webhook whose secret or content type is wrong fails the + # HMAC check and is dropped, and the only remaining symptom is that + # releases quietly arrive a day late via the timer instead of at once. + # Silence is the one thing this must not do. + ExecStart = "${pkgs.webhook}/bin/webhook -hooks /run/fdroid-webhook/hooks.json -port ${toString cfg.webhookPort} -verbose"; Restart = "on-failure"; }; };