interstellarlabs/solidhooks-connector repository overview

⁠SolidHooks Connector

The customer agent for SolidHooks Connect, private webhook delivery.

It lets SolidHooks deliver webhooks to endpoints inside your network, services with no public DNS, no public IP, and no inbound firewall rule. The connector dials out to the SolidHooks overlay and hosts your endpoint on it, so nothing needs to be exposed to the internet.

Built on OpenZiti⁠ — a re-badged openziti/ziti-host⁠ running in host mode, plus a small bootstrap step that exchanges your enrollment key for a Ziti identity.

⁠Quick start

Get an enrollment key from the SolidHooks dashboard (Connectors → Create), then:

docker run -d \
  --name solidhooks-connector \
  -v solidhooks_connector_identity:/ziti \
  -e ENROLLMENT_KEY=cbt_your_key_here \
  interstellarlabs/solidhooks-connector:v1.15.0

Mount a writable volume at /ziti. The connector enrols once and persists its identity there, renewing its own certificate in place. An ephemeral identity cannot reconnect after a restart.

⁠Kubernetes

A Helm chart is published alongside this image and is the recommended way to run it in production — it handles per-replica identity volumes, pod disruption budgets, and graceful deregistration on scale-down:

helm repo add interstellar-labs https://interstellar-labs.github.io/charts/
helm repo update

helm install solidhooks-connector interstellar-labs/solidhooks-connector \
  --set enrollmentKey=cbt_your_key_here

⁠Configuration

⁠How it boots

Fresh boot (no identity on the volume) — exchanges ENROLLMENT_KEY for a one-time Ziti enrollment token via POST /v1/connectors/bootstrap, enrols, and writes the identity to /ziti.

Restart (identity present) — loads the existing identity and renews its certificate in place. The bootstrap endpoint is only contacted on genuine scale-up or volume loss, so your enrollment key is used once per replica, not on every start.

⁠High availability

Run more than one replica. Each enrols its own distinct identity and persists it to its own volume, and all of them share the connector's service through a role attribute. Every replica therefore registers its own terminator on the overlay, and the controller load-balances across them and fails over automatically.

No shared identity, no shared secret, no manual certificate rotation. Replica counts are bounded by your plan's per-connector limit, enforced at enrolment.

⁠Security model

• Outbound only. The connector opens no listening port and needs no inbound firewall rule.
• Mutually authenticated. Every connection is mTLS over an OpenZiti overlay; identities are issued per replica and are revocable individually.
• Least exposure. Only the destinations you configure for that connector are reachable, and only by SolidHooks.

⁠Links

• SolidHooks — https://solidhooks.com⁠
• Helm repository — https://interstellar-labs.github.io/charts/

Tags follow the SolidHooks release train (vX.Y.Z). There is no latest tag — pin an explicit version.