[apim.webhooks.http] enable = false has no effect — WebSub HTTP port 9021 cannot be disabled via deployment.toml

[ashanhr]

Description

The [apim.webhooks.http] enable = false configuration documented in the transport-level security guide has no effect. The WebSub HTTP inbound endpoint on port 9021 remains active regardless of this setting.

Root Cause

The config mapper pipeline requires two things to honour a deployment.toml key:

1. The key must be registered in default.json with a default value.
2. A j2 template must reference that key to render the target file.

WebhookServer.xml (the Synapse inbound endpoint that binds port 9021) is a static file — there is no corresponding j2 template. As a result, the config mapper never processes it, and [apim.webhooks.http] enable = false is silently ignored.

By contrast, SecureWebhookServer.xml (port 8021) already has a j2 template with suspend="{{!apim.webhooks.https.enable}}" and a matching entry in default.json, so HTTPS disabling works correctly.

Expected Behavior

Setting [apim.webhooks.http] enable = false in deployment.toml should suspend the WebSub HTTP inbound endpoint (port 9021), consistent with how [apim.webhooks.https] enable = false works for port 8021.

Fix

The fix requires changes to product-apim:

1. Add "apim.webhooks.http.enable": true to default.json in the relevant distributions (all-in-one-apim, gateway).
2. Create WebhookServer.xml.j2 templates (in both repository/resources/apim-synapse-config/ and repository/deployment/server/synapse-configs/default/inbound-endpoints/) with:

   <inboundEndpoint name="WebhookServer" protocol="http"
                    suspend="{{!apim.webhooks.http.enable}}" sequence="main">
       <parameters>
           <parameter name="inbound.http.port">9021</parameter>
       </parameters>
   </inboundEndpoint>

No backend (carbon-apimgt) changes are needed — Synapse's native suspend attribute handles the port binding suppression.