watch: ingest sink (--notify ingest) posting events to a push ingest endpoint

This commit is contained in:
CRTkafa 2026-10-23 15:30:18 +08:00
parent 5b3905679b
commit 487e138f9d
9 changed files with 236 additions and 18 deletions

View file

@ -46,12 +46,16 @@ All optional. Configure with environment variables or `~/.storebound/watch.json`
| ntfy | `STOREBOUND_NTFY_TOPIC` (required), `STOREBOUND_NTFY_URL` (default `https://ntfy.sh`), `STOREBOUND_NTFY_TOKEN` (optional). Title, Tags and Click headers; Priority high for `rejected` and `rollout_halted` |
| Telegram | `STOREBOUND_TELEGRAM_TOKEN` and `STOREBOUND_TELEGRAM_CHAT` |
| webhook | `STOREBOUND_WEBHOOK_URL` (JSON POST of the event) |
| ingest | `watch.json` `ingest` (or `STOREBOUND_INGEST_URL`, `STOREBOUND_INGEST_TOKEN_FILE`, `STOREBOUND_INGEST_CATEGORY`): JSON POST with `Authorization: Bearer <token>`; the token is read from `tokenFile` at send time (`~` expanded, trimmed, never logged; on POSIX a group- or world-readable file is refused). Body: `category`, `event`, `app` (slug), `platform` (`ios`/`android`), `version`, `detail` (max 300 chars), `url`, `dedupeKey`, at most 8 KiB. 202 = sent; 5xx and network errors retry once, 4xx do not (status and server message are logged). At most 60 sends a minute, the rest are dropped with a warning |
| OS notification | `--notify os`, or `"notify": ["os"]` in watch.json (Windows toast, macOS osascript, Linux notify-send; skipped quietly when unavailable) |
```json
{ "notify": ["os"], "ntfy": { "topic": "..." }, "telegram": { "token": "...", "chat": "..." }, "webhook": { "url": "..." } }
{ "notify": ["os"], "ntfy": { "topic": "..." }, "telegram": { "token": "...", "chat": "..." }, "webhook": { "url": "..." },
"ingest": { "url": "https://push.example.com/api/notifications/ingest", "tokenFile": "~/.ingest-token", "category": "storebound" } }
```
Ingest events: `review-rejected`, `review-approved`, `live`, `rollout-halted`, `crash-threshold`, `low-reviews`, `review-reply`. Several sinks can be active at once (ntfy stays a fine fallback).
Network calls time out after 10 s and are retried once. A failing sink is logged (by name) and never stops the watch.
## On a server with PM2