Merge pull request 'docs: note the 2026-11-03 webhook rotation' (#56) from docs/rotated-webhook-prefixes into main
Lint / JS (eslint) (push) Successful in 12s
Lint / Shell (shellcheck) (push) Successful in 18s
Lint / No secrets in webhook configs (push) Successful in 10s
Lint / No Hookshot webhook IDs in README (push) Successful in 10s
Lint / Python (ruff) (push) Successful in 6s
Lint / Landing page is rendered (matrix (push) Successful in 6s
Lint / Secret scan (gitleaks) (push) Successful in 14s
Lint / Python deps (pip-audit) (push) Successful in 55s

This commit was merged in pull request #56.
This commit is contained in:
2026-11-03 00:57:42 -05:00
+5 -4
View File
@@ -358,22 +358,23 @@ Webhook URL format: `https://matrix.lotusguild.org/webhook/<uuid>`
> the table lists only the first 8 characters (enough to match Hookshot's logs); the full URLs
> live in each sender's settings. Full UUIDs were in this file from 2026-02-20 to 2026-11-03,
> so the IDs below are exposed in git history until rotated (see *Webhook secrets — rotating*).
> Grafana, Proxmox, Uptime Kuma and Ci-Alert were rotated on 2026-11-03 (the old IDs now return 404).
> CI (`readme-no-webhook-ids`) rejects full UUIDs in this README.
| Service | Webhook UUID | Notes |
|---------|-------------|-------|
| Grafana | `df4a1302…` | Unified alerting contact point |
| Proxmox | `9b3eafe5…` | Notification system (8.1+), Discord embed format |
| Grafana | `e713b383…` | Unified alerting contact point |
| Proxmox | `ca27432c…` | Notification system (8.1+), Discord embed format |
| Sonarr | `aeffc311…` | All event types |
| Radarr | `34913454…` | All event types |
| Readarr | `e57ab4f3…` | All event types |
| Lidarr | `66ac6fdd…` | All event types |
| Uptime Kuma | `1a02e890…` | Status change notifications |
| Uptime Kuma | `4b3fb94b…` | Status change notifications |
| Seerr | `555185af…` | Request/approval events |
| Owncast (Livestream) | `9993e911…` | STREAM_STARTED / STREAM_STOPPED |
| Bazarr | `470fb267…` | Subtitle events (Apprise JSON notifier) |
| Tinker-Tickets | `6e306faf…` | Custom transformation code |
| Ci-Alert | `5e7051e7…` | Gitea Actions `notify-failure` jobs (org secret `MATRIX_WEBHOOK_URL`); transform `hookshot/ci-alert.js` |
| Ci-Alert | `66c1aa17…` | Gitea Actions `notify-failure` jobs (org secret `MATRIX_WEBHOOK_URL`); transform `hookshot/ci-alert.js` |
| Devdesk | `4a3ccfc9…` | DevDesk "Claude needs you" (CT 126 `devdesk-notify-matrix`, URL in `/etc/devdesk/matrix-webhook`); transform `hookshot/devdesk.js`; avatar set via the appservice token |
**Hookshot notes:**