mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 21:10:59 +00:00
A single WEBHOOK channel covers Gotify, Discord, Slack, Matrix, and Home Assistant: the user supplies a public URL and an optional shared-secret header, and the dispatcher POSTs a small plain-text JSON envelope. The outbound goes through safeFetch with requirePublicHost so the SSRF floor and the connect-time DNS-rebinding pin apply to the user-supplied host, exactly as they do for ntfy. Responses classify 404/410/401/403 as hard rejects (auto-disable) and 5xx/429/timeout as transient (backoff). Settings card mirrors the ntfy card with a save + test-connection flow; the header value is never returned by the GET and is preserved across a save round-trip when left blank.