Private repos, sources & webhooks

A source is a stored, AES-256-GCM encrypted credential for a Git provider or container registry. Services reference a source instead of embedding a token, so the same credential can be rotated once and picked up everywhere. Credentials are scrubbed from the working tree right after checkout and never appear in build logs.

Credential types

• Provider token — a GitHub / GitLab / Bitbucket PAT. The panel can list the repositories and branches it can reach, and test proves the token still authenticates without deploying anything.
• SSH deploy key — generated server-side as an ed25519 pair. The private half is encrypted into the source row and never leaves the server; you paste the returned public key into the provider's Deploy keys screen.
• Registry credential — used for private Docker image pulls, per source.

ninedeploy sources list
ninedeploy sources add              # interactive: provider, token or deploy key
ninedeploy sources test <id>        # live credential check
ninedeploy sources keygen <id>        # generate an ed25519 pair, print the public half

ninedeploy webhooks list <service>
ninedeploy webhooks add <serviceId> [branch] # returns URL + HMAC secret once

Auto-deploy webhooks

Each service can own webhooks that trigger a deploy on push. The receiver verifies the HMAC signature in constant time, checks the branch, applies the manifest's watch.paths globs, and de-duplicates replayed deliveries. A push whose diff touches nothing in watch.paths is accepted and skipped rather than rebuilt.