From 7dc2eaab2918d974c87d522e246b548bbf87f7a4 Mon Sep 17 00:00:00 2001 From: TZGyn Date: Sun, 25 Oct 2026 14:45:46 +0800 Subject: [PATCH] Note the per-app webhook secret gotcha --- AGENTS.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index bd9de7f..80e9546 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -56,6 +56,11 @@ what we take vs. skip). Never vendor it into the build. so it matches fine. A curl replay needs `X-Gitea-Event: push` and the signature header, or it answers "No matching application or invalid signature." + The app's `manual_webhook_secret_gitea` is **regenerated whenever the app + is recreated** — if the Coolify app is ever recreated, update the Gitea + hook's secret too (`PATCH /repos/TZGyn/tunnel/hooks/5` with + `{"config":{"secret":""}}`), or real deliveries silently fail + signature checks while curl replays still work. This Coolify version stores `custom_labels` **base64-encoded** and does *not* merge its generated Traefik labels for API-created apps: the full label set must live in `custom_labels` (mirror a working app's generated