Leveret App proxy

Initial Cloudflare Worker relay for the shared Leveret GitHub App.

What it does

POST /hook:

1. caps the body at GitHub's 25 MB webhook limit and verifies X-Hub-Signature-256 against the untouched bytes;
2. mints an installation token narrowed to the delivery repository and contents:read / pull_requests:write;
3. reads relay.endpoint_jwe from .leveret.yml on that repository's default branch and decrypts it only in memory;
4. rejects non-HTTPS, local, private, link-local, and tailnet destinations;
5. challenges GET {endpoint}/.well-known/leveret?repo=...&iid=...;
6. signs the raw body and fixed relay metadata with the current Ed25519 key;
7. forwards the body, signature headers, and repository-scoped installation token.

No request body or token is logged. GET /version reports the injected build commit and bundle hash.

Use the hosted proxy

The shared Leveret GitHub App already uses proxy.leveret-dev.io. Repository owners only need to encrypt their box endpoint and commit the resulting configuration. They do not deploy this Worker or create proxy keys.

Use the guided browser generator at https://proxy.leveret-dev.io/setup, or follow the local command-line guide. Both encrypt the endpoint locally with the hosted proxy's public key and produce:

relay:
  endpoint_jwe: "eyJ...compact-jwe"

Self-host the proxy

The rest of this document is only for operators deploying their own Cloudflare Worker and GitHub App. It is not part of encrypting an endpoint for the shared Leveret App.

npm install
npx wrangler secret put APP_ID
npx wrangler secret put APP_PRIVATE_KEY < /path/to/github-app.pem
npx wrangler secret put ENDPOINT_DECRYPTION_KEYS < /path/to/endpoint-keyring.json
npx wrangler secret put DELIVERY_SIGNING_KEYS < /path/to/delivery-keyring.json
npx wrangler secret put WEBHOOK_SECRET
npm test
npm run check
npx wrangler deploy

Set the GitHub App webhook URL to https://YOUR-WORKER/hook and use the same webhook secret. Inject BUILD_COMMIT and BUNDLE_HASH as non-secret Worker values in the deployment pipeline for useful /version output.

Replace the committed public keyset with the public halves matching your own ENDPOINT_DECRYPTION_KEYS and DELIVERY_SIGNING_KEYS. Repositories using your deployment must encrypt against that keyset, not the hosted proxy's keys.

The box must answer the challenge only when it serves the supplied repository and installation, then accept the forwarded webhook and installation token. Its own serves: allowlist remains the final destination-side authority.

Apply a Cloudflare WAF rule to /hook using GitHub's current webhook CIDRs before production deployment. Keep /version public. IP filtering is quota protection, not authentication; HMAC verification remains mandatory.

Deliberately absent

No database, accounts, dashboard, endpoint cache, retry queue, replay dedupe, return channel, pull mode, arbitrary forwarded headers, or request-body logging. Add each only when its concrete trigger in Leveret issue #34 occurs.