Delivering webhooks to private systems

In order to limit exposure of your private system to the internet, you can use a reverse proxy to forward webhooks from Fluid to your private system

About integrating with private systems via reverse proxy

You may want to deliver Fluid webhooks to private systems that are not directly accessible from the internet, such as CI systems, work management tools, and custom apps. You can use a reverse proxy to receive webhook payloads from Fluid and deliver them to the your private system.

A reverse proxy is a web server that sits between a client and an application. The reverse proxy receives requests from the client and forwards them to the application. This ensures no direct communication occurs between clients on the internet and the underlying application. A variety of systems can serve a reverse proxy, including:

• web servers, like nginx
• API gateways
• free, open-source overlay networks, like openziti
• commercial ingress management tools, like ngrok
• free, open-source ingress management tools, like zrok

How you configure your reverse proxy varies based on the system you're using.

Securing traffic to your reverse proxy

When deploying a reverse proxy, you should follow all practices recommended by your reverse proxy provider to secure the underlying proxy server. Additionally, you should take the following steps to verify that only requests from Fluid  are forwarded to your application.

Limiting inbound traffic to Fluid webhooks

You should configure your reverse proxy to only allow HTTPS POST requests from the subset of Fluid IP ranges that are used to deliver webhooks. This ensures that your reverse proxy does not process or forward other requests.

Validating webhook payloads

If your webhook is configured with a secret token, Fluid will include a cryptographic hash of each webhook payload. You should use this hash to validate the payload received from Fluid before any action is taken by your private system. For more information, see Validating Webhooks

You can implement payload validation either on the reverse proxy or on your private system.

Further reading

Troubleshooting webhooks

Webhook best practices

Webhook events and payloads