Publish the annia webhook through the Cloudflare Tunnel #91

Merged

tepichord merged 6 commits from feat/88-publish-annia-webhook-cloudflare-tunnel into main

2026-09-25 17:40:19 -07:00

tepichord commented

2026-09-22 16:33:36 -07:00

Owner

Closes #88

Automated PR created by forgejo-done adapter.

Closes #88 Automated PR created by forgejo-done adapter.

tepichord added 4 commits

2026-09-22 16:33:36 -07:00

feat(cloudflare): add annia webhook route to tunnel e6c9dd61e3

Add annia.vando.dev/api/hook entry to webhook_routes default, pointing
at the annia-enqueuer Service in the annia namespace. The hostname is
exactly one level below vando.dev (satisfying
webhook_hostnames_live_in_the_zone) and the path /api/hook is already
in local.hook_paths via distinct(), so the WAF expression is unchanged.

The service string http://annia-enqueuer.annia.svc.cluster.local:80 is
a cross-issue contract with #89.

Refs: #88

test(cloudflare): re-index ingress assertions for annia route a798135a1b

Rebase the ingress_publishes_only_the_hook_path run from 3 to 4
entries: length 3→4, hook-path alltrue slice 0,2→0,3, distinct
hostnames 2→3, catch-all ingress[2]→ingress[3]. Add two new assertions
for ingress[2] (annia enqueuer path and service).

rate_limit_rule_is_free_plan_legal and test_flux_receiver pass
unchanged — the distinct() claim holds and the path set is still
{/api/hook, /hook/}.

Refs: #88

docs: add annia webhook endpoint to documentation surfaces e5bc708ef7

- cloudflare/README.md: add annia.vando.dev row to zone-shape table,
  extend 'Adding a webhook endpoint' example to three routes
- OPERATIONS.md §1: add annia.vando.dev/api/hook to public webhook
  endpoints row
- ARCHITECTURE.md §7: generalize Woodpecker-only sentences and traffic
  row to cover ci/flux/annia webhook endpoints

Refs: #88

test(cloudflare): pin the annia tunnel record in the plan tests

ci/woodpecker/pr/gates Pipeline failed

Details

fe13bc5d90

The Flux route, added in 2487f80, came with CNAME assertions for its own
hostname in hook_record_is_a_proxied_tunnel_cname. The annia route was
added to webhook_routes without the equivalent pair, so a route whose
hostname never reaches cloudflare_dns_record.webhook would pass the
suite — and the check that the new hostname actually produces a proxied
record (the DNS half of this issue's acceptance criteria) was absent.

Add the type/proxied assertions for annia.vando.dev next to the Flux pair,
and correct the run header, which still said one route.

Refs: #88

tepichord added the

reviewing

label

2026-09-22 16:33:36 -07:00

tepichord added this to the MVP project

2026-09-25 17:17:19 -07:00

tepichord added 2 commits

2026-09-25 17:30:43 -07:00

Merge branch 'main' of ssh://clone.gloom.garden/tepichord/milner into feat/88-publish-annia-webhook-cloudflare-tunnel dbee95854e

# Conflicts:
#	ARCHITECTURE.md
#	OPERATIONS.md

docs: name where the annia route is published, not the issue that adds it

ci/woodpecker/pr/gates Pipeline was successful

Details

ci/woodpecker/pull_request_closed/cleanup Pipeline was successful

Details

32a0ef542e

Four sentences across `apps/annia/set-credential.sh` and `docs/rabbitmq.md`
said the Forgejo webhook registration "waits on #88's route". This is the
change that publishes it, so the wait is over and the sentence is false in the
same commit that makes it so. They now name `cloudflare/main.tf` — the file a
reader can open — and the Terraform apply, which is what actually remains.

`enqueuer/app.py`'s parenthetical is deliberately left alone. It says the
receiver "sits on the public edge (#88's route)", a historical attribution
rather than a pending claim, so it is not made false here. It is also an
`enqueuer-tag-guard` input: editing a comment in that tree is an image change,
which would demand a tag bump and a re-push of a 112 MB image to say nothing
new. The guard is right to charge for it.

tepichord merged commit 9d7eb5048d into main

2026-09-25 17:40:19 -07:00

tepichord deleted branch feat/88-publish-annia-webhook-cloudflare-tunnel

2026-09-25 17:40:19 -07:00

tepichord referenced this pull request from a commit

2026-09-25 17:40:21 -07:00

Merge pull request 'Publish the annia webhook through the Cloudflare Tunnel' (#91) from feat/88-publish-annia-webhook-cloudflare-tunnel into main

tepichord removed the

reviewing

label

2026-09-25 20:33:46 -07:00