Make internal endpoints available to nodes only

modules/pubsub/naive/src/main/scala/docspell/pubsub/naive/NaivePubSub.scala

@@ -159,7 +159,7 @@ final class NaivePubSub[F[_]: Async](
       _ <- logger.trace(s"Publishing to remote urls ${urls.map(_.asString)}: $msg")
       reqs = urls
         .map(u => Uri.unsafeFromString(u.asString))
-        .map(uri => POST(List(msg), uri))
+        .map(uri => POST(List(msg), uri).putHeaders(cfg.reqHeader))
       resList <- reqs.traverse(req => client.status(req).attempt)
       _ <- resList.traverse {
         case Right(s) =>

modules/pubsub/naive/src/main/scala/docspell/pubsub/naive/PubSubConfig.scala

@@ -8,4 +8,11 @@ package docspell.pubsub.naive
 
 import docspell.common.{Ident, LenientUri}
 
-case class PubSubConfig(nodeId: Ident, url: LenientUri, subscriberQueueSize: Int)
+import org.http4s.Header
+
+case class PubSubConfig(
+    nodeId: Ident,
+    url: LenientUri,
+    subscriberQueueSize: Int,
+    reqHeader: Header.Raw
+)

modules/pubsub/naive/src/test/scala/docspell/pubsub/naive/Fixtures.scala

@@ -13,8 +13,9 @@ import docspell.pubsub.api._
 import docspell.store.{Store, StoreFixture}
 
 import munit.CatsEffectSuite
-import org.http4s.Response
 import org.http4s.client.Client
+import org.http4s.{Header, Response}
+import org.typelevel.ci._
 
 trait Fixtures extends HttpClientOps { self: CatsEffectSuite =>
 
@@ -67,7 +68,8 @@ object Fixtures {
     PubSubConfig(
       Ident.unsafe(nodeId),
       LenientUri.unsafe(s"http://$nodeId/"),
-      0
+      0,
+      Header.Raw(ci"Docspell-Internal", "abc")
     )
 
   def storeResource: Resource[IO, Store[IO]] =