v1.0.0 — Conduit is live

Conduit v1.0.0 — a source-agnostic webhook relay service.

What's included

Core Pipeline

• Inbound webhook receiver with auto-detection of 5 sources (GitHub, Stripe, Paystack, Slack, Shopify)
• Source-specific HMAC signature verification with raw body buffer capture
• Replay attack detection (Stripe, Slack — 5min window)
• Redis + BullMQ producer-consumer architecture
• Background worker with concurrency 5 and 10s delivery timeout
• Exponential backoff + jitter retry logic (5 attempts before dead letter)
• HMAC-SHA256 outbound payload signing (cdtsig_sha256=)
• Manual replay for failed/dead deliveries

API

• JWT auth (dashboard) + SHA-256 hashed API key auth (programmatic)
• Dual routing — same controllers, different auth middleware
• Endpoint CRUD with ownership verification
• Delivery logs, global stats, recent deliveries
• Event simulator for testing
• AES-256-GCM encryption for stored secrets

Infrastructure

• Docker Compose for Postgres + Redis
• Drizzle ORM with UUID primary keys
• express-validator input validation
• Deployed on Hetzner VPS with Nginx reverse proxy and Let's Encrypt SSL

Live API: https://api.conduit.useshipyard.xyz
Frontend: https://conduit-delivery.vercel.app
Frontend repo: https://github.com/Verifieddanny/conduit