Host a webhook service

Put HTTPS in front of the handler

On a VM you administer, run your handler on loopback, for example 127.0.0.1:8080. Point a hostname you control at the VM, then use a reverse proxy such as Caddy for public HTTPS. Open only the inbound ports you need and preserve your existing SSH access. With a publicly reachable Caddy setup, ports 80 and 443 support HTTP redirects and certificate provisioning.

Replace hooks.example.com with your hostname. With Caddy already installed, add this to its Caddyfile and adapt the upstream port to your app.

hooks.example.com {
  reverse_proxy 127.0.0.1:8080
}

sudo caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy

Verify the sender

Use the provider’s signing scheme to validate the raw request body before queueing work. Handle retries with stable event IDs and scope permissions to the task. Keep logs free of credentials and sensitive payloads. Check the HTTPS endpoint, then send a test event from your provider and verify it reached your application.