Feat/webhooks

.direnv/flake-profile

@@ -0,0 +1 @@
+flake-profile-2-link

.direnv/flake-profile-2-link

@@ -0,0 +1 @@
+/nix/store/pknafnv7zx67x4misiglnnvbj3sgm30r-nix-shell-env

.gitignore

@@ -37,6 +37,7 @@ frontend/build/
 .idea/
 *.swp
 *.swo
+.envrc
 
 # OS
 .DS_Store

Cargo.toml

@@ -32,6 +32,7 @@ members = [
   "engine/packages/metrics",
   "engine/packages/metrics-server",
   "engine/packages/namespace",
+  "engine/packages/outbound-guard",
   "engine/packages/pegboard",
   "engine/packages/pegboard-envoy",
   "engine/packages/pegboard-gateway",
@@ -56,6 +57,7 @@ members = [
   "engine/packages/universalpubsub",
   "engine/packages/util",
   "engine/packages/util-id",
+  "engine/packages/webhook",
   "engine/packages/util-serde",
   "engine/packages/workflow-worker",
   "engine/sdks/rust/api-full",
@@ -500,6 +502,9 @@ members = [
     [workspace.dependencies.namespace]
     path = "engine/packages/namespace"
 
+    [workspace.dependencies.rivet-outbound-guard]
+    path = "engine/packages/outbound-guard"
+
     [workspace.dependencies.pegboard]
     path = "engine/packages/pegboard"
 
@@ -573,6 +578,9 @@ members = [
     [workspace.dependencies.rivet-util-id]
     path = "engine/packages/util-id"
 
+    [workspace.dependencies.webhook]
+    path = "engine/packages/webhook"
+
     [workspace.dependencies.rivet-util-serde]
     path = "engine/packages/util-serde"
     version = "=2.3.7"

docs/content/docs/debugging.mdx

@@ -199,7 +199,7 @@ Returns the configured provider settings per datacenter and the latest pool erro
 }
 ```
 
-`runner_pool_error` mirrors actor scheduling errors such as `serverless_http_error`, `serverless_connection_error`, and `serverless_stream_ended_early`.
+`runner_pool_error` mirrors actor scheduling errors such as `serverless_http_error`, `serverless_connection_error`, `serverless_destination_blocked`, and `serverless_stream_ended_early`.
 
 ### Check Serverless Provider Health
 

docs/content/docs/troubleshooting.mdx

@@ -97,6 +97,14 @@ Rivet was unable to connect to your serverless endpoint. Check that:
 - Your server is publicly reachable from the internet.
 - There are no DNS or firewall issues blocking the connection.
 
+### `serverless_destination_blocked`
+
+The configured serverless URL points at a destination Rivet is not allowed to reach. Rivet dials serverless endpoints from inside its own network, so by default it refuses any destination that is not publicly routable: private ranges, link-local and cloud metadata addresses, carrier-grade NAT, and other reserved ranges. Check that:
+
+- Your endpoint URL is publicly reachable, and is not an internal hostname or address.
+- The URL scheme is `http` or `https`, and the URL does not embed credentials.
+- If you are self-hosting and intentionally point runners at an address on your own network, set `outbound.allow_private_networks` to `true` in your engine config, or list the specific range in `outbound.allow_cidrs`.
+
 ### `serverless_stream_ended_early`
 
 The connection to your serverless endpoint was terminated before the actor finished. This usually means your serverless function hit its execution time limit. Ensure that your Rivet provider's request lifespan is configured to match the max duration of your serverless platform.