Sign inSign up

sergdudko/baton-worker

By sergdudko

•Updated about 1 month ago

Baton’s self-hosted worker: scheduled API runs, run history, and the git bridge for the web build.

Image
Integration & delivery
API management
Developer tools
0

135

sergdudko/baton-worker repository overview

⁠Baton Worker

The self-hosted companion service for Baton⁠, the git-native API client: collections, environments, and schedules are plain YAML files in a git repository you own. The worker pulls that repository and:

  • runs schedules — cron entries from the workspace's schedules.yaml, each in its own timezone, with run history and a failure webhook;
  • runs requests on demand — for requests that must start inside a network;
  • bridges git and proxies requests for Baton's web build, which cannot clone a repository or send a cross-origin request from a browser;
  • runs a collection once and exits — a CI step with a text, JSON, or JUnit report.

Your server, your network, your credentials. There is no Baton cloud.

⁠Run it

docker run -d --name baton-worker \
  -p 8787:8787 \
  -e BATON_WORKER_TOKEN=<long-random-token> \
  -e BATON_GIT_URL=https://github.com/acme/my-apis.git \
  -e BATON_GIT_TOKEN=<read-only-deploy-token> \
  -e BATON_SECRET_APITOKEN=<value> \
  -e TZ=UTC \
  -v baton-data:/data \
  {{IMAGE}}:latest

Then pair the app with the worker: its URL and the same token, kept in the operating system's secure storage.

VariablePurpose
BATON_WORKER_TOKENThe bearer token the app presents. Required: the worker refuses to start without it.
BATON_GIT_URLThe workspace repository, pulled at start and every five minutes.
BATON_GIT_TOKEN / BATON_GIT_USERNAMEA read-only deploy token for it, handed to git through a credential helper — never on a command line or in a log.
BATON_SECRET_<NAME>Values for the secret references requests use ({{name}}, {{secret:name}}).
BATON_VAULT_TOKENA token for the workspace's HashiCorp Vault, for secrets kept there.
BATON_DATA_DIR/data by default: the SQLite run history and the workspace checkout.
BATON_HISTORY_RETENTION_DAYS90 by default; 0 keeps every run.
BATON_PORT8787 by default.
BATON_WORKER_PUBLIC_EGRESS_ONLYtrue sends every request the worker makes to public addresses only.
BATON_WORKER_EGRESS_ALLOWWith the above: exact origins that stay reachable, comma-separated.

Run history keeps statuses, durations, and sizes, never request or response bodies, and secrets are masked by value in every report.

⁠In CI

docker run --rm -v "$PWD:/data/workspace" -e BATON_SECRET_APITOKEN \
  {{IMAGE}} run --workspace /data/workspace --environment staging

--collection, --reporter text|json|junit, --output, and --allow-failure narrow and shape the run. The exit code is 0 when every request passed, 1 when one failed, and 2 for a bad argument.

⁠The image

Port8787/tcp, plain HTTP — put Caddy, nginx, or Traefik in front for TLS
Volume/data
Platformslinux/amd64, linux/arm64
Tagsthe worker's version (0.2.3) and latest
Same imageghcr.io/dudko-dev/baton-worker
Without Dockernpx -y @dudko.dev/baton-worker on Node.js 24+ with git

⁠License

Proprietary. Free for personal, non-commercial use. Commercial use is free for small entities: your group must have raised less than USD 250,000 in total, be valued at less than USD 250,000, and have annual gross revenue under USD 1,000,000. Above any of the three, commercial use needs a license — write to [email protected]⁠.

Redistribution is not permitted. Pulling this image, caching it in your own registry proxy, and building your own deployment images are fine; republishing it or bundling it into something you ship is not.

Documentation ships inside the Baton app and lives at baton.dudko.dev⁠.

Tag summary

Content type

Image

Digest

sha256:08cc0ea26…

Size

118.6 MB

Last updated

about 1 month ago

docker pull sergdudko/baton-worker