gitlab-runner delivered webhooks
One of the really powerful features of gitlab is that runners contact gitlab rather then gitlab contacts the runners. This allows them to easily be nestled in private networks such as in a kubernetes namespace without exposing it outside.
The same isn't true of webhooks. They all have to be accessible via gitlab directly.
Could an optional runner tag selector be added to the webhook config to cause the webhook in question to be initiated by a matching gitlab-runner rather then sent via gitlab? This would enable many more webhook options in complicated networks.