angarium 0.1.0

data/db/angarium_migrate/20260704000004_create_angarium_delivery_attempts.rb

@@ -0,0 +1,12 @@
+class CreateAngariumDeliveryAttempts < ActiveRecord::Migration[7.1]
+  def change
+    create_table :angarium_delivery_attempts, id: Angarium.primary_key_type do |t|
+      t.references :delivery, null: false, type: Angarium.primary_key_type, foreign_key: {to_table: :angarium_deliveries}
+      t.integer :response_code
+      t.text :response_body
+      t.string :error
+      t.float :duration
+      t.timestamps
+    end
+  end
+end

data/lib/angarium/address_policy.rb

@@ -0,0 +1,82 @@
+require "ipaddr"
+require "resolv"
+
+module Angarium
+  # Central SSRF policy. Decides whether a destination IP is permitted for a
+  # given endpoint, composing three controls:
+  #   1. endpoint.allowed_networks (CIDR list) -> if present, ONLY those are allowed
+  #   2. endpoint.allow_private_network        -> bypass the private-IP denylist
+  #   3. Angarium.config.block_private_ips      -> default denylist of private ranges
+  module AddressPolicy
+    module_function
+
+    # Is a single IP (String or IPAddr) permitted for this endpoint?
+    #
+    # Two independent gates, both must pass:
+    #   Gate A (private denylist): private/loopback/link-local addresses are
+    #     blocked unless endpoint.allow_private_network is set. An allowlist entry
+    #     does NOT by itself unlock a private address.
+    #   Gate B (allowlist): when endpoint.allowed_networks is non-empty, the
+    #     address must fall within one of those CIDRs.
+    def ip_allowed?(ip, endpoint)
+      ip = to_ipaddr(ip)
+      return false unless ip
+
+      if private?(ip) && Angarium.config.block_private_ips
+        return false unless endpoint.allow_private_network
+      end
+
+      allowlist = Array(endpoint.allowed_networks).reject(&:blank?)
+      unless allowlist.empty?
+        return false unless allowlist.any? { |cidr| cidr_include?(cidr, ip) }
+      end
+
+      true
+    end
+
+    # Resolve host and return true only if EVERY resolved address is allowed.
+    # Unresolvable hosts return [] and this returns true (can't prove disallowed);
+    # callers that need strictness at connect time check each resolved IP instead.
+    def host_permitted_for_validation?(host, endpoint)
+      resolve(host).all? { |ip| ip_allowed?(ip, endpoint) }
+    end
+
+    def resolve(host)
+      literal = to_ipaddr(host)
+      return [literal] if literal
+
+      Resolv.getaddresses(host).filter_map { |a| to_ipaddr(a) }
+    rescue
+      []
+    end
+
+    def private?(ip)
+      ip = normalize(ip)
+      return true if ip.to_i.zero? # 0.0.0.0 / :: (unspecified -> localhost on Linux)
+
+      ip.loopback? || ip.private? || ip.link_local? ||
+        (ip.respond_to?(:unique_local?) && ip.unique_local?)
+    end
+
+    # Collapse IPv4-mapped IPv6 (::ffff:x.x.x.x) to native IPv4 so the predicates
+    # above see the real address; leave other addresses untouched.
+    def normalize(ip)
+      ip.respond_to?(:native) ? ip.native : ip
+    rescue
+      ip
+    end
+
+    def cidr_include?(cidr, ip)
+      IPAddr.new(cidr.to_s).include?(ip)
+    rescue IPAddr::InvalidAddressError
+      false
+    end
+
+    def to_ipaddr(value)
+      ip = value.is_a?(IPAddr) ? value : IPAddr.new(value.to_s)
+      normalize(ip)
+    rescue IPAddr::InvalidAddressError
+      nil
+    end
+  end
+end

data/lib/angarium/client.rb

@@ -0,0 +1,53 @@
+require "httpx"
+
+module Angarium
+  # Thin wrapper over HTTPX. Returns a plain result struct so callers/tests
+  # never touch HTTPX response objects directly. Note: HTTPX does NOT follow
+  # redirects unless the :follow_redirects plugin is enabled, so we intentionally
+  # leave it disabled so a 3xx to an internal URL can't bypass SSRF checks.
+  class Client
+    Result = Struct.new(:success, :code, :body, :error, :duration, :headers) do
+      def success? = success
+    end
+
+    def post(url, body:, headers:, addresses: nil)
+      conn = self.class.connection
+      conn = conn.with(addresses: addresses) if addresses && !addresses.empty?
+
+      started = monotonic
+      response = conn.post(url, body: body, headers: headers)
+      duration = monotonic - started
+
+      if response.is_a?(HTTPX::ErrorResponse)
+        return Result.new(success: false,
+          error: "#{response.error.class}: #{response.error.message}",
+          duration: duration,
+          headers: {})
+      end
+
+      max = Angarium.config.max_response_body_bytes
+      body = response.body.to_s
+      body = body.byteslice(0, max) if max
+
+      Result.new(
+        success: (200..299).cover?(response.status),
+        code: response.status,
+        body: body,
+        duration: duration,
+        headers: response.headers.to_h.transform_keys(&:downcase)
+      )
+    end
+
+    def monotonic = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+
+    def self.connection
+      HTTPX.with(
+        headers: {"user-agent" => Angarium.config.user_agent, "content-type" => "application/json"},
+        timeout: {
+          connect_timeout: Angarium.config.open_timeout,
+          read_timeout: Angarium.config.http_timeout
+        }
+      )
+    end
+  end
+end

data/lib/angarium/configuration.rb

@@ -0,0 +1,66 @@
+module Angarium
+  class Configuration
+    attr_accessor :job_queue, :http_timeout, :open_timeout, :user_agent,
+      :retry_schedule, :block_private_ips,
+      :primary_key_type, :database, :connects_to, :max_response_body_bytes,
+      :auto_disable_endpoint_after, :respect_retry_after,
+      :max_retry_after, :retry_jitter, :signing_secret_grace_period,
+      :delivery_attempt_retention, :delivering_timeout,
+      :on_delivery_exhausted, :on_endpoint_deactivated, :on_endpoint_verified,
+      :parent_controller, :current_user, :policy_class
+
+    def initialize
+      @job_queue = :default
+      @http_timeout = 10
+      @open_timeout = 5
+      @user_agent = "Angarium/#{Angarium::VERSION}"
+      # Follows the Standard Webhooks recommendation of a multi-day schedule with
+      # exponential backoff (delays between retries; the first delivery is
+      # immediate). Spans ~10 days; jitter is added per attempt (see
+      # config.retry_jitter).
+      @retry_schedule = [
+        5.seconds, 5.minutes, 30.minutes, 2.hours, 5.hours,
+        10.hours, 14.hours, 20.hours, 24.hours, 36.hours, 48.hours, 72.hours
+      ]
+      @block_private_ips = true
+      @primary_key_type = nil
+      # Multi-database: the database (a key from config/database.yml) that
+      # Angarium's tables live in. Drives both the connection and where the
+      # migrations generator installs migrations (db/<database>_migrate).
+      # nil (default) keeps Angarium on the app's primary connection.
+      @database = nil
+      # Advanced multi-database: a hash passed straight to Rails' connects_to for
+      # custom roles/shards, e.g. { database: { writing: :angarium, reading: :angarium } }.
+      # Takes precedence over @database for the connection.
+      @connects_to = nil
+      @max_response_body_bytes = 65_536
+      @auto_disable_endpoint_after = nil
+      @respect_retry_after = true
+      @max_retry_after = 3600
+      @retry_jitter = 0.15
+      @signing_secret_grace_period = 24.hours
+      @delivery_attempt_retention = nil
+      @delivering_timeout = 15.minutes
+      @on_delivery_exhausted = nil # ->(delivery) { ... }
+      @on_endpoint_deactivated = nil # ->(endpoint, reason) { ... } reason: :consecutive_failures | :gone
+      @on_endpoint_verified = nil # ->(endpoint) { ... } fired when an unverified endpoint is verified
+
+      # --- Headless JSON API (only used if you mount Angarium::Engine) ---------
+      # Base controller the API inherits from, so your app's authentication
+      # (Devise/Rodauth/etc.) applies to Angarium's endpoints too.
+      @parent_controller = "ApplicationController"
+      # Resolves the current user from the controller (your current-user convention).
+      @current_user = ->(controller) { controller.current_user }
+      # Authorization: scope, create-owner, and per-action permissions, all in one
+      # class. Subclass Angarium::Api::Policy to customize any of them.
+      @policy_class = "Angarium::Api::Policy"
+    end
+
+    # The database Angarium's migrations belong in, for the migrations generator.
+    # Prefers the explicit @database, else the writing role from a connects_to
+    # hash. nil => the app's primary db/migrate.
+    def migrations_database
+      database || connects_to&.dig(:database, :writing)
+    end
+  end
+end

data/lib/angarium/dispatch.rb

@@ -0,0 +1,23 @@
+module Angarium
+  module Dispatch
+    module_function
+
+    def call(event_name, payload, owner:)
+      notify_payload = {event: event_name, event_id: nil, deliveries: 0}
+      ActiveSupport::Notifications.instrument("dispatch.angarium", notify_payload) do
+        endpoints = Endpoint.enabled.where(owner: owner).select do |endpoint|
+          endpoint.subscribed_to?(event_name)
+        end
+        next nil if endpoints.empty?
+
+        Event.transaction do
+          event = Event.create!(name: event_name, payload: payload)
+          endpoints.each { |endpoint| event.deliveries.create!(endpoint: endpoint) }
+          notify_payload[:event_id] = event.id
+          notify_payload[:deliveries] = endpoints.size
+          event
+        end
+      end
+    end
+  end
+end

data/lib/angarium/engine.rb

@@ -0,0 +1,5 @@
+module Angarium
+  class Engine < ::Rails::Engine
+    isolate_namespace Angarium
+  end
+end

data/lib/angarium/event_matcher.rb

@@ -0,0 +1,17 @@
+module Angarium
+  module EventMatcher
+    module_function
+
+    # pattern: "*" (all), "prefix.*" (prefix), or an exact event name
+    def match?(pattern, event_name)
+      return true if pattern == "*"
+
+      if pattern.end_with?(".*")
+        prefix = pattern[0..-3] # strip ".*"
+        event_name == prefix || event_name.start_with?("#{prefix}.")
+      else
+        pattern == event_name
+      end
+    end
+  end
+end

data/lib/angarium/signature.rb

@@ -0,0 +1,57 @@
+require "openssl"
+require "base64"
+
+module Angarium
+  module Signature
+    module_function
+
+    # secret may be a String or Array of secrets (dual-secret rotation grace);
+    # produces one `v1,<base64>` token per secret, space-delimited.
+    def sign(payload:, id:, timestamp:, secret:)
+      Array(secret).map { |s| "v1,#{signature_for(s, id, timestamp, payload)}" }.join(" ")
+    end
+
+    # Verify a Standard Webhooks signature. Pass the fields explicitly, or pass a
+    # Rails `request:` and Angarium pulls the raw body and webhook-* headers for
+    # you, so a receiver is a one-liner:
+    #
+    #   Angarium::Signature.verify(request:, secret: endpoint.signing_secret)
+    #
+    def verify(secret:, request: nil, payload: nil, id: nil, timestamp: nil, signature: nil,
+      tolerance: 300, now: Time.now.to_i)
+      if request
+        payload ||= request.raw_post
+        id ||= request.headers["webhook-id"]
+        timestamp ||= request.headers["webhook-timestamp"]
+        signature ||= request.headers["webhook-signature"]
+      end
+
+      return false unless timestamp.to_s.match?(/\A\d+\z/)
+      return false if (now - timestamp.to_i).abs > tolerance
+
+      expected = signature_for(secret, id, timestamp.to_i, payload)
+      parse(signature).any? { |sig| secure_compare(expected, sig) }
+    end
+
+    def signature_for(secret, id, timestamp, payload)
+      key = Base64.decode64(secret.to_s.delete_prefix("whsec_"))
+      digest = OpenSSL::HMAC.digest("SHA256", key, "#{id}.#{timestamp}.#{payload}")
+      Base64.strict_encode64(digest)
+    end
+
+    # webhook-signature is space-delimited `v1,<base64>` tokens; keep the base64
+    # payload of each v1 token.
+    def parse(header)
+      header.to_s.split(" ").filter_map { |token|
+        version, sig = token.split(",", 2)
+        sig if version == "v1" && sig && !sig.empty?
+      }
+    end
+
+    def secure_compare(a, b)
+      ActiveSupport::SecurityUtils.secure_compare(a, b)
+    rescue ArgumentError
+      false
+    end
+  end
+end

data/lib/angarium/version.rb

@@ -0,0 +1,3 @@
+module Angarium
+  VERSION = "0.1.0"
+end

data/lib/angarium.rb

@@ -0,0 +1,44 @@
+require "angarium/version"
+require "angarium/engine"
+require "angarium/configuration"
+require "angarium/event_matcher"
+require "angarium/signature"
+require "angarium/address_policy"
+require "angarium/dispatch"
+require "angarium/client"
+
+module Angarium
+  class << self
+    def config
+      @config ||= Configuration.new
+    end
+
+    def configure
+      yield config
+    end
+
+    # Primary key type for Angarium's own tables. Explicit config wins; otherwise
+    # respect the app's global generators setting; otherwise Rails' default (bigint).
+    def primary_key_type
+      config.primary_key_type ||
+        Rails.application.config.generators.options.dig(:active_record, :primary_key_type) ||
+        :bigint
+    end
+
+    def dispatch(event_name, payload, owner:)
+      Dispatch.call(event_name, payload, owner: owner)
+    end
+
+    # Invoke a configured notification callback (e.g. on_delivery_exhausted,
+    # on_endpoint_deactivated). A callback raising must never break the delivery
+    # pipeline, so errors are logged and swallowed.
+    def notify(callback_name, *args)
+      callback = config.public_send(callback_name)
+      return unless callback
+
+      callback.call(*args)
+    rescue => e
+      Rails.logger.error { "[Angarium] #{callback_name} callback raised: #{e.class}: #{e.message}" }
+    end
+  end
+end

data/lib/generators/angarium/install/install_generator.rb

@@ -0,0 +1,57 @@
+require "rails/generators/base"
+
+module Angarium
+  module Generators
+    class InstallGenerator < Rails::Generators::Base
+      source_root File.expand_path("templates", __dir__)
+
+      desc "Creates the Angarium initializer and installs its migrations. Pass " \
+           "--database=NAME to run Angarium in its own database (multi-db)."
+
+      class_option :database, type: :string, aliases: "-d", default: nil, banner: "NAME",
+        desc: "Place Angarium in its own database: sets config.database and installs " \
+              "migrations into db/NAME_migrate instead of db/migrate"
+
+      def copy_initializer
+        template "initializer.rb", "config/initializers/angarium.rb"
+      end
+
+      # With --database, record config.database in the initializer so a later
+      # `angarium:migrations` run (e.g. after a gem upgrade) still targets the
+      # right place without the flag.
+      def set_database_config
+        return unless database
+
+        gsub_file "config/initializers/angarium.rb", /^\s*#?\s*config\.database\s*=.*$/,
+          %(  config.database = :#{database})
+      end
+
+      # The single migration path: delegate to the migrations generator, which
+      # installs into db/NAME_migrate (multi-db) or db/migrate (primary).
+      def install_migrations
+        invoke "angarium:migrations", [], database: database
+      end
+
+      def print_next_steps
+        if database
+          say <<~MSG
+            Add the '#{database}' database to config/database.yml (per environment), e.g.:
+
+                #{database}:
+                  <<: *default
+                  database: myapp_#{database}
+                  migrations_paths: db/#{database}_migrate
+
+            then run:  bin/rails db:migrate:#{database}
+          MSG
+        else
+          say "\nNext: run bin/rails db:migrate"
+        end
+      end
+
+      private
+
+      def database = options[:database]
+    end
+  end
+end

data/lib/generators/angarium/install/templates/initializer.rb

@@ -0,0 +1,77 @@
+Angarium.configure do |config|
+  # ActiveJob queue used for webhook deliveries.
+  # config.job_queue = :default
+
+  # HTTP read timeout (seconds) per delivery attempt.
+  # config.http_timeout = 10
+
+  # TCP connect timeout (seconds) per delivery attempt.
+  # config.open_timeout = 5
+
+  # User-Agent header sent with each delivery.
+  # config.user_agent = "Angarium/#{Angarium::VERSION}"
+
+  # Backoff schedule between retries. Length = number of retries.
+  # Delays between retries (the first delivery is immediate). Standard Webhooks
+  # recommended default spans ~10 days; jitter is added per attempt.
+  # config.retry_schedule = [5.seconds, 5.minutes, 30.minutes, 2.hours, 5.hours,
+  #                          10.hours, 14.hours, 20.hours, 24.hours, 36.hours, 48.hours, 72.hours]
+
+  # Reject endpoint URLs that resolve to private/loopback addresses (SSRF guard).
+  # Per-endpoint overrides: endpoint.allow_private_network and endpoint.allowed_networks.
+  # config.block_private_ips = true
+
+  # Primary key type for Angarium's own tables.
+  # config.primary_key_type = nil # nil = use the app's default (bigint unless overridden); set :uuid etc. to force
+
+  # Multi-database: keep Angarium's tables in their own database. Set this to a
+  # database name from config/database.yml and Angarium routes all its models and
+  # migrations there. `bin/rails g angarium:install --database=NAME` sets this for
+  # you; after a gem upgrade, `bin/rails g angarium:migrations` reads it so new
+  # migrations still land in db/NAME_migrate. nil (default) uses the primary connection.
+  # config.database = :angarium
+  #
+  # Advanced: for custom roles/shards, pass a hash straight to Rails' connects_to.
+  # It wins over config.database for the connection (set config.database too so the
+  # migrations generator knows where to install).
+  # config.connects_to = { database: { writing: :angarium, reading: :angarium } }
+
+  # Truncate the stored response body to this many bytes. nil = store the full body.
+  # config.max_response_body_bytes = 65_536
+
+  # Auto-disable an endpoint after this many consecutive failed deliveries. nil = never.
+  # config.auto_disable_endpoint_after = nil
+
+  # Honor a receiver's Retry-After header (seconds or HTTP-date) for the next attempt.
+  # config.respect_retry_after = true
+
+  # Cap (seconds) applied to a honored Retry-After value. nil = uncapped.
+  # config.max_retry_after = 3600
+
+  # Fraction of additive positive jitter applied to each backoff delay.
+  # config.retry_jitter = 0.15
+
+  # Grace window during which a rotated endpoint's previous signing secret stays
+  # valid (deliveries are signed with both), so receivers can roll over with no downtime.
+  # config.signing_secret_grace_period = 24.hours
+
+  # Notification callbacks fire on terminal delivery events so you can alert
+  # consumers out of band (email, Slack, PagerDuty). A raised callback is logged
+  # and swallowed, so it never breaks delivery.
+  # config.on_delivery_exhausted = ->(delivery) { }         # retry schedule exhausted
+  # config.on_endpoint_deactivated = ->(endpoint, reason) { } # reason: :consecutive_failures | :gone (HTTP 410)
+  # config.on_endpoint_verified = ->(endpoint) { }          # an `unverified` endpoint passed its first delivery
+
+  # --- Headless JSON API (only used if you `mount Angarium::Engine`) -----------
+  # Base controller the API inherits from, so your app's authentication applies.
+  # config.parent_controller = "ApplicationController"
+
+  # Resolve the current user from the controller (your current-user convention).
+  # config.current_user = ->(controller) { controller.current_user }
+
+  # Authorization, all in one class: #scope(relation) (what a user may see),
+  # #owner (who a new endpoint belongs to), and #<action>? predicates. Generate a
+  # starting point with `bin/rails g angarium:policy`, then override only what you
+  # need. Defaults are permissive and single-owner (you manage your own endpoints).
+  # config.policy_class = "WebhookEndpointPolicy"
+end

data/lib/generators/angarium/migrations/migrations_generator.rb

@@ -0,0 +1,39 @@
+require "rails/generators/base"
+
+module Angarium
+  module Generators
+    # Installs (and, after a gem upgrade, refreshes) Angarium's engine migrations.
+    # Angarium keeps its migrations in db/angarium_migrate rather than the
+    # conventional db/migrate, so Rails never auto-appends them onto the host's
+    # primary connection nor generates a generic install:migrations task: this
+    # generator is the single install path. It is multi-database aware: it reads
+    # config.database (set at install time) so a host that forgets the flag on a
+    # later run still gets new migrations in the right place. Uses Rails' native
+    # ActiveRecord::Migration.copy, so re-runs are idempotent (already-installed
+    # migrations are skipped).
+    class MigrationsGenerator < Rails::Generators::Base
+      desc "Installs Angarium's migrations. Multi-db setups (config.database or " \
+           "--database) get them in db/NAME_migrate; otherwise the primary db/migrate."
+
+      class_option :database, type: :string, aliases: "-d", default: nil, banner: "NAME",
+        desc: "Install into db/NAME_migrate for this database " \
+              "(defaults to config.database / connects_to)"
+
+      def install_migrations
+        database = options[:database].presence || Angarium.config.migrations_database
+        # The primary connection always migrates from db/migrate; only a separate
+        # database gets its own db/<name>_migrate path.
+        dir = (database.nil? || database.to_s == "primary") ? "db/migrate" : "db/#{database}_migrate"
+        copied = ActiveRecord::Migration.copy(
+          File.join(destination_root, dir),
+          {"angarium" => Angarium::Engine.root.join("db/angarium_migrate").to_s}
+        )
+        if copied.any?
+          say_status :installed, "#{copied.size} Angarium migration(s) into #{dir}", :green
+        else
+          say_status :identical, "Angarium migrations already present in #{dir}", :blue
+        end
+      end
+    end
+  end
+end

data/lib/generators/angarium/policy/policy_generator.rb

@@ -0,0 +1,40 @@
+require "rails/generators/base"
+
+module Angarium
+  module Generators
+    class PolicyGenerator < Rails::Generators::Base
+      source_root File.expand_path("templates", __dir__)
+
+      desc "Creates an Angarium API policy (a subclass of Angarium::Api::Policy)."
+
+      argument :policy_name, type: :string, default: "WebhookEndpointPolicy",
+        banner: "NAME", desc: "Policy class name (default: WebhookEndpointPolicy)"
+
+      def create_policy
+        template "policy.rb", File.join("app/policies", "#{policy_name.underscore}.rb")
+      end
+
+      # Point config.policy_class at the generated class, uncommenting (or
+      # replacing) the line in the initializer so it takes effect immediately.
+      def enable_policy
+        initializer = "config/initializers/angarium.rb"
+
+        unless File.exist?(File.join(destination_root, initializer))
+          say_status :skip, %(#{initializer} not found; set config.policy_class = "#{class_name}" yourself), :yellow
+          return
+        end
+
+        line = %r{^\s*#?\s*config\.policy_class\s*=.*$}
+        if File.read(File.join(destination_root, initializer)).match?(line)
+          gsub_file initializer, line, %(  config.policy_class = "#{class_name}")
+        else
+          say_status :skip, %(add config.policy_class = "#{class_name}" to #{initializer}), :yellow
+        end
+      end
+
+      private
+
+      def class_name = policy_name.camelize
+    end
+  end
+end

data/lib/generators/angarium/policy/templates/policy.rb

@@ -0,0 +1,33 @@
+# Authorization for Angarium's JSON API. Enable it with
+#   config.policy_class = "<%= class_name %>"
+# in config/initializers/angarium.rb.
+#
+# The policy runs in the controller's context, so `current_user`, `params`, and
+# `controller` are available. Override only what you need; the inherited defaults
+# are permissive and single-owner (a user sees and manages their own endpoints).
+class <%= class_name %> < Angarium::Api::Policy
+  # Narrow the base relation to the endpoints this user may see and act on.
+  # def scope(relation)
+  #   relation.where(owner: current_user)
+  # end
+
+  # Owner for a newly-created endpoint. Override to create on behalf of another
+  # owner (read a param), then gate who may do so in #create?.
+  # def owner
+  #   current_user
+  # end
+
+  # SSRF controls, gated independently (default off). allow_private_network
+  # relaxes the private-IP block (dangerous, operators only); allowed_networks
+  # only restricts delivery to a CIDR allowlist (safe to expose more widely).
+  # def permit_allow_private_network? = current_user.admin?
+  # def permit_allowed_networks? = true
+
+  # Per-action permissions. rotate_secret?/pause?/enable?/ping?/redeliver? all
+  # default to update?.
+  # def index?   = true
+  # def show?    = true
+  # def create?  = true
+  # def update?  = true
+  # def destroy? = true
+end

data/lib/tasks/angarium_tasks.rake

@@ -0,0 +1,15 @@
+namespace :angarium do
+  desc "Prune delivery attempts older than Angarium.config.delivery_attempt_retention"
+  task prune: :environment do
+    retention = Angarium.config.delivery_attempt_retention
+    abort "Set Angarium.config.delivery_attempt_retention (e.g. 90.days) before pruning." unless retention
+    count = Angarium::DeliveryAttempt.prune(older_than: retention)
+    puts "Angarium: pruned #{count} delivery attempt(s) older than #{retention.inspect}."
+  end
+
+  desc "Requeue deliveries stuck in the delivering state past Angarium.config.delivering_timeout"
+  task reap: :environment do
+    count = Angarium::Delivery.reap_stalled
+    puts "Angarium: requeued #{count} stalled deliver(y/ies)."
+  end
+end