CENSUS WEBHOOK SERVE(1)

NAME
census-webhook-serve - Start a webhook receiver for T1/T2...

SYNOPSIS
census webhook serve [OPTIONS]

DESCRIPTION
Start a webhook receiver for T1/T2 lifecycle events.

    Listens for incoming CertiSigma webhook deliveries, verifies HMAC
    signatures, guards against replay attacks, and optionally executes
    --on-t1 / --on-t2 shell commands with the delivery payload on stdin.

    Binds to 127.0.0.1 by default (loopback only). For public exposure,
    use --bind 0.0.0.0 behind a reverse proxy with TLS termination, or
    provide --tls-cert / --tls-key for built-in TLS.

    Endpoints:
        POST /webhook/callback — delivery endpoint
        GET /health — health check (returns 200)

    Examples:
        census webhook serve --secret-file .webhook-secret --on-t1 'notify-send "T1 complete"' --on-t2 'curl -X POST https://slack/hook -d @-'

OPTIONS

--secret-file PATH
    File with signing secret (from 'webhook register --save-secret'). [required]

--port INTEGER
    Listen port. Default: 9514

--bind TEXT
    Bind address. Default: 127.0.0.1 (loopback only).

--on-t1 TEXT
    Shell command on T1 (TSA) event (JSON on stdin). Runs via shell; do not pass untrusted input.

--on-t2 TEXT
    Shell command on T2 (Bitcoin) event (JSON on stdin). Runs via shell; do not pass untrusted input.

--tls-cert PATH
    PEM certificate for built-in TLS (reverse proxy recommended instead).

--tls-key PATH
    PEM private key for built-in TLS.

--replay-window INTEGER
    Anti-replay window in seconds. Default: 300