Move Stripe, Svix, and Zapier webhook pipes onto a router you host

Hookdeck, Svix, Zapier catch hooks, and Make scenarios all sit in the path between a vendor and your app. That path holds customer events, signing secrets, and retry state. When the bill is per event, you are renting a reverse proxy. Webhook Router is the same architecture on your host: ingest, verify, transform, fan-out, dead-letter.

Docker Compose

Put the data volume on the same disk you already back up. Secrets stay in router.env, not in the image.

services:
  webhook-router:
    image: webhook-router:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:8090:8090"
    environment:
      TZ: Europe/Madrid
      NEXUS_TELEMETRY: "off"
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET}
      GITHUB_WEBHOOK_SECRET: ${GITHUB_WEBHOOK_SECRET}
    volumes:
      - ./data/webhooks:/var/lib/webhook-router
      - ./routes.json:/app/routes.json:ro
      - ./router.env:/run/secrets/env:ro

routes.json

One source per vendor. Transforms are versioned with the rest of the repo. Destinations can be internal HTTP or a chat webhook.

{
  "sources": [
    {
      "id": "stripe",
      "path": "/hooks/stripe",
      "verify": { "type": "stripe", "secret_env": "STRIPE_WEBHOOK_SECRET" },
      "transform": { "keep": ["id", "type", "data.object"] },
      "destinations": [
        { "url": "https://billing.internal/events", "method": "POST" },
        { "url": "https://discord.com/api/webhooks/xxx", "method": "POST",
          "map": { "content": "Stripe {{type}} {{id}}" } }
      ],
      "retry": { "max": 8, "backoff_ms": 500 }
    },
    {
      "id": "github",
      "path": "/hooks/github",
      "verify": { "type": "hmac-sha256", "header": "X-Hub-Signature-256",
                  "secret_env": "GITHUB_WEBHOOK_SECRET" },
      "destinations": [
        { "url": "http://pipeline:8080/jobs/deploy", "method": "POST" }
      ]
    }
  ]
}

Cutover without dropped events

1. Inventory every vendor URL and signing secret.
2. Bring the router up behind TLS. Confirm /health.
3. Load routes.json. Replay a Stripe test event.
4. Update vendor endpoints to https://hooks.yourdomain.com/…
5. Keep the cloud inbox for one interval, then disable it.

# 1. Health check the local ingest
curl -sS -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8090/health

# 2. After DNS + TLS, update Stripe
stripe webhook_endpoints update we_xxx \
  --url https://hooks.yourdomain.com/hooks/stripe

# 3. Replay a stored event to prove the path
curl -sS -X POST http://127.0.0.1:8090/api/replay \
  -H "content-type: application/json" \
  -d '{"source":"stripe","event_id":"evt_test"}'

Related setup page: Self-hosted webhook router.