Webhooks

RUSEON Core can send HTTP POST requests to configured URLs when specific system events occur.

Configuration & Behavior

• Method: HTTP POST
• Timeout: 3 seconds per request.
• Retries: No explicit per-event retries. Delivery is best-effort.

Queueing

Webhooks are processed by worker goroutines with a queue capacity of 1000 events per worker. If the queue fills up (e.g., due to a slow receiving server), new events are dropped (drop-newest policy).

• Monitor dropped events via the Prometheus metric: ruseon_eventbus_drops_total.

Circuit Breaker

To prevent cascading failures, the webhook sender implements a circuit breaker per URL:

• If a URL fails repeatedly, the circuit opens for 30 seconds.
• During this 30-second window, no requests are sent to that URL (events are dropped immediately).

Security

If a webhook secret is configured, RUSEON includes an X-Signature header containing an HMAC SHA-256 signature of the payload.

Receiver validation example:

1. Compute HMAC_SHA256(secret, request_body)
2. Hex-encode the result.
3. Compare securely against the X-Signature header.