How should we handle the need for HTTPS/SSL webhooks when self-hosting?

[Shpigford]

Basically all data providers require HTTPS/SSL webhook URLs for sending data (both initially and with automatic updates).

What's a sort of no-nonsense way to handle this for those that are self-hosting this?

Needs to be something easy to set up and relatively cheap and/or free.

Obviously lots of ways to solve this, but want to come up with something that has a very low barrier.

[tmyracle]

I can do some testing and comparisons on this since I'll need something for Teller webhooks.

So far the options seem to be:

• ngrok
• caddy
• traefik proxy
• ?

what else should I evaluate?

[PierreAndreis]

cloudflare tunnel is a free ngrok alternative but closed source. frp is a self-host open source alternative

[Shpigford]

cloudflare tunnel is a free ngrok alternative but closed source. frp is a self-host open source alternative

@PierreAndreis i like the idea of Cloudflare Tunnel but the handful of times i've used it, i was gouging my eyes out by the time i actually got it functioning.

[Shpigford]

I kind of wonder if just using ngrok's free account does the trick for us. At least to get things running. Then we can have a separate project to potentially set up a more privacy-friendly option?

Looking at the current codebase, is it really as easy as just setting NGROK_AUTH_TOKEN and then make sure we show what your URL is (so you can setup Plaid/etc webhooks)?

[tmyracle]

Yeah ngrok would definitely be the easiest, just add a NX_NGROK_URL to env.example and obviously .env and a few lines in the README and should in business. The env configs and webhook.ts already take care of routing things based on that env var it looks like. EDIT: might not need the URL, testing now

[tmyracle]

yep just adding the auth token for a free ngrok account gets things going, can hit the ngrok endpoint and then use that in service provider config dashboards for webhook setup

[tmyracle]

the only problem with the free plan is its gonna keep generating unique urls every time you stop and start the service which means you need to update the URL in all the third party services again. I believe the only way to have a statically named tunnel is paying for the minimum ngrok subscription 👎

[ams-ryanolson]

Do you envision users self-hosting locally? What would stop you from setting some cloud hosting requirements?

For example, you could turn this into a DigitalOcean 1-click app that installs on a droplet or even app platform. This would resolve SSL issues with webhooks and would also allow for a more controlled and manageable implementation.

[Shpigford]

100% want to support easy deploys to services like DigitalOcean. But there will also be a decent chunk of folks who want to keep it local (for privacy reasons).

So ultimately need to support both.

[ductilestudios]

Came here to say it seems like ngrok is the simplest way for now but looks like you guys already got there!

[Shpigford]

Well, @tmyracle's point about the URL changing every time is super problematic...so that actually probably makes ngrok a bad decision. :(

[ductilestudios]

Looks like that issue was resolved last Aug ... testing now on my account

https://ngrok.com/blog-post/free-static-domains-ngrok-users

[tmyracle]

oh sick, last time I really used ngrok was june/july so glad to see they added that!

[Shpigford]

Oh heckin yessssssss

[ductilestudios]

Confirming you get 1 free static domain on a free account. All worked as shown in that link with the fairly notable caveat that you must have the v3 agent installed. The -domain flag is not recognized in v2

[Shpigford]

Okay, lets go with ngrok and call it a day. Will create an Issue for it.