this works, to the extent that i tested it

routes/webhook.js

@@ -0,0 +1,32 @@
+import express from 'express';
+import { enqueueNatAdd, enqueueNatRemove } from '../services/natQueue.js';
+import { error, info, warn } from '../util/Console.js';
+
+const router = express.Router();
+
+router.post('/', (req, res) => {
+    const sig = req.headers['x-webhook-signature'] || req.headers['x-hook-signature'] || '';
+    const secret = process.env.WEBHOOK_SECRET || '';
+    if (!sig || sig !== secret) return res.status(403).json({ error: 'invalid signature' });
+
+    const body = req.body || {};
+    const event = body.event || '';
+    const data = body || {};
+    info(`Webhook: ${event}\n${JSON.stringify(body)}`);
+    // return res.status(418).json({ error: 'im a teapot' }); // temporary
+    try {
+        if (event === 'created: Allocation') {
+            enqueueNatAdd(data.ip, data.port, 'tcp');
+        } else if (event === 'deleted: Allocation') {
+            enqueueNatRemove(data.ip, data.port, 'tcp');
+        } else {
+            warn(`Unhandled webhook event: ${event}`);
+        }
+        return res.json({ success: true });
+    } catch (err) {
+        error(err);
+        return res.status(500).json({ error: 'error ocurred' });
+    }
+});
+
+export default router;