Angarium
Everything your hand-rolled webhook job is missing: HMAC signing, retries with backoff, zero-downtime secret rotation, SSRF protection, and a queryable log of every delivery attempt.
Angarium is a Rails engine. It signs to the Standard Webhooks spec, so your receivers verify with off-the-shelf libraries in any language and you never write verification docs of your own. Works with any ActiveJob backend on Rails 7.1+.
Install
# Gemfile
gem "angarium"bundle install
bin/rails g angarium:install
bin/rails db:migrateThe 30-second tour
Any model can own endpoints (an account, team, or user):
class Account < ApplicationRecord
has_many :webhook_endpoints, as: :owner, class_name: "Angarium::Endpoint"
end
# Register an endpoint; the signing secret is generated for you
account.webhook_endpoints.create!(
name: "Production",
url: "https://example.com/webhooks",
subscribed_events: ["invoice.*", "user.created"]
)
# Fan an event out to every subscribed endpoint
Angarium.dispatch("invoice.paid", { id: 123, total: 4200 }, owner: account)Angarium handles the rest: signing, retries with backoff, Retry-After, dedup-friendly delivery IDs, SSRF checks, and a full attempt log.
What you get
- Standard Webhooks signing. HMAC-SHA256 over every request, verifiable with an off-the-shelf library. Conformance is enforced in CI.
- Retries with backoff. Twelve attempts over roughly ten days, with jitter, honoring
Retry-Afterto delay but never to hammer. - Zero-downtime secret rotation. Signs with both old and new during a grace window, so receivers roll over without a rejected delivery.
- SSRF protection. Blocks private ranges, pins the connection to the validated IP against DNS rebinding, and fails closed on unresolvable hosts.
- A log of every attempt. Response code, body, error, and duration are persisted. Nothing is silently dropped.
- An optional JSON API. Policy-gated endpoints for managing subscriptions and browsing deliveries, using your app's own auth.