Implement proper webhook content negotiation per external-dns spec

- Proxy now echoes Accept header back as Content-Type (per webhook spec)
- Firewalla webhook validates Accept header and uses res.send() to avoid Express charset
- All JSON endpoints now properly handle content negotiation
- Fixes external-dns v0.20.0 strict content-type validation

The external-dns webhook spec requires the server to read the Accept
header and respond with that exact value as Content-Type:
application/external.dns.webhook+json;version=1

Author: TheOutdoorProgrammer

src/controllers/adjustEndpoints.js

@@ -8,21 +8,53 @@ const logger = require('../utils/logger');
 const validator = require('../utils/validator');
 
 /**
- * Adjust endpoints - filter out unsupported record types
+ * Handle adjust endpoints request
  */
 function adjustEndpoints(req, res) {
   const endpoints = req.body;
+  const acceptHeader = req.get('Accept');
 
   logger.debug('Adjust endpoints request received', { 
-    count: Array.isArray(endpoints) ? endpoints.length : 0 
+    count: (endpoints || []).length,
+    accept: acceptHeader
   });
 
-  // Validate input
+  // Validate Accept header
+  if (acceptHeader && !acceptHeader.includes(config.contentType)) {
+    logger.warn('Unsupported Accept header', { accept: acceptHeader });
+    return res.status(406).json({ error: 'Not Acceptable' });
+  }
+  
+  // Validate request body
   if (!Array.isArray(endpoints)) {
-    logger.warn('Invalid request body for adjust endpoints (not an array)');
-    return res.status(400).json({ error: 'Request body must be an array of endpoints' });
+    logger.warn('Invalid request body for adjust endpoints');
+    return res.status(400).json({ error: 'Invalid request body' });
   }
 
+  // Filter out unsupported record types
+  // We only support A and TXT records
+  const filtered = endpoints.filter(endpoint => {
+    const supported = SUPPORTED_RECORD_TYPES.has(endpoint.recordType);
+    if (!supported) {
+      logger.debug('Filtering out unsupported record type', {
+        dnsName: endpoint.dnsName,
+        recordType: endpoint.recordType
+      });
+    }
+    return supported;
+  });
+  
+  logger.info('Adjust endpoints completed', {
+    input: endpoints.length,
+    output: filtered.length,
+    filtered: endpoints.length - filtered.length
+  });
+  
+  // Set exact content type (no charset) for external-dns webhook protocol
+  res.setHeader('Content-Type', config.contentType);
+  res.send(JSON.stringify(filtered));
+}
+  
   // Filter endpoints:
   // 1. Keep only A and TXT record types
   // 2. Remove invalid endpoints

src/controllers/negotiate.js

@@ -10,19 +10,30 @@ const logger = require('../utils/logger');
  * Handle negotiate request
  */
 function negotiate(req, res) {
+  const acceptHeader = req.get('Accept');
+  
   logger.debug('Negotiate request received', { 
-    accept: req.get('Accept'),
+    accept: acceptHeader,
     userAgent: req.get('User-Agent')
   });
 
+  // Validate Accept header matches our supported media type
+  // External-DNS sends: application/external.dns.webhook+json;version=1
+  if (acceptHeader && !acceptHeader.includes(config.contentType)) {
+    logger.warn('Unsupported Accept header', { accept: acceptHeader });
+    return res.status(406).json({ error: 'Not Acceptable' });
+  }
+  
   // Return domain filter
   const response = {
     domainFilter: config.domainFilter
   };
 
-  // Set content type for external-dns webhook protocol
+  // Respond with the EXACT content type from Accept header
+  // Must be: application/external.dns.webhook+json;version=1 (no spaces, no charset)
+  // Use res.send() instead of res.json() to prevent Express from adding charset
   res.setHeader('Content-Type', config.contentType);
-  res.json(response);
+  res.send(JSON.stringify(response));
 
   logger.info('Negotiate response sent', { domainFilterCount: config.domainFilter.length });
 }

src/controllers/records.js

@@ -15,14 +15,22 @@ const updateQueue = [];
  * Get all DNS records (GET /records)
  */
 async function getRecords(req, res) {
-  logger.debug('Get records request received');
+  const acceptHeader = req.get('Accept');
+  
+  logger.debug('Get records request received', { accept: acceptHeader });
+  
+  // Validate Accept header
+  if (acceptHeader && !acceptHeader.includes(config.contentType)) {
+    logger.warn('Unsupported Accept header', { accept: acceptHeader });
+    return res.status(406).json({ error: 'Not Acceptable' });
+  }
 
   try {
     const records = await dnsmasqService.getRecords();
 
-    // Set content type for external-dns webhook protocol
+    // Set exact content type (no charset) for external-dns webhook protocol
     res.setHeader('Content-Type', config.contentType);
-    res.json(records);
+    res.send(JSON.stringify(records));
 
     logger.info('Get records response sent', { count: records.length });
 

webhook-proxy/proxy.js

@@ -34,6 +34,7 @@ console.log(`Metrics Port: ${METRICS_PORT}`);
 function proxyRequest(clientReq, clientRes, targetUrl) {
   const startTime = Date.now();
   const url = new URL(clientReq.url, targetUrl);
+  const acceptHeader = clientReq.headers['accept'];
 
   const options = {
     hostname: url.hostname,
@@ -52,15 +53,15 @@ function proxyRequest(clientReq, clientRes, targetUrl) {
   console.log(`[${clientReq.method}] ${clientReq.url} -> ${url.href}`);
 
   const proxyReq = http.request(options, (proxyRes) => {
-    // Clean up headers - remove charset from content-type for external-dns compatibility
+    // Echo back the Accept header as Content-Type (per webhook spec)
+    // External-DNS sends Accept: application/external.dns.webhook+json;version=1
+    // We must respond with the exact same value in Content-Type
     const headers = { ...proxyRes.headers };
-    if (headers['content-type']) {
-      // External-DNS expects exactly: application/external.dns.webhook+json;version=1
-      // Express adds charset which breaks strict validation
-      headers['content-type'] = headers['content-type'].replace(/;\s*charset=[^;]+/, '');
+    if (acceptHeader) {
+      headers['content-type'] = acceptHeader;
     }
 
-    // Forward status code and cleaned headers
+    // Forward status code and headers
     clientRes.writeHead(proxyRes.statusCode, headers);
 
     // Pipe response body