docs: fix signature header template escaping, merge template field tables

docs/content/destinations/webhook.mdoc

@@ -109,18 +109,28 @@ In default mode, operators can customize both the signed content and the signatu
 
 These use the same configuration key names in both deployment models, but they are applied differently: Managed Outpost stores them through the Config API or Hookdeck dashboard, while self-hosted Outpost reads them from environment variables or YAML configuration.
 
-Templates use Go template syntax with helper functions such as `join`. The signature content template can use:
+Templates use Go template syntax with helper functions such as `join`. The two templates accept different fields:
 
-| Field | Description |
-|-------|-------------|
-| `.EventID` | Event id used for the delivery |
-| `.Topic` | Event topic |
-| `.Timestamp` | Delivery timestamp |
-| `.Body` | Raw request body |
+| Field | Description | Content template | Header template |
+|-------|-------------|------------------|-----------------|
+| `.EventID` | Event id used for the delivery | yes | yes |
+| `.Topic` | Event topic | yes | yes |
+| `.Timestamp` | Delivery timestamp | yes | yes |
+| `.Body` | Raw request body | yes | — |
+| `.Signatures` | List of generated signatures for all valid secrets | — | yes |
 
-The signature header template can use the same metadata plus `.Signatures`, which is the list of generated signatures for all valid secrets. During secret rotation, `.Signatures` contains the current secret's signature first and the previous secret's signature second.
+A field marked `—` is not available in that template. Using it does not render as an empty value — the template still parses, but the configuration is rejected at startup.
 
-For example, to include a Unix timestamp in the signed content and header:
+During secret rotation, `.Signatures` contains the current secret's signature first and the previous secret's signature second.
+
+For example, to include a Unix timestamp in the signed content and header, use these template values:
+
+```
+{{.Timestamp.Unix}}.{{.Body}}
+t={{.Timestamp.Unix}},v0={{.Signatures | join ","}}
+```
+
+These are the literal template values. If the format carrying them requires escaping — the inner quotes in a JSON string, or in a double-quoted shell string — apply that format's own escaping; a JSON library or the dashboard does this for you.
 
 {% tabs tabGroup="deployment" %}
 {% tab label="Managed" %}
@@ -134,14 +144,28 @@ Set the values in the [Config API](/docs/outpost/api#configuration) or in [Hookd
 ```
 {% /tab %}
 {% tab label="Self-Hosted" %}
-Set the values as environment variables:
+Set the values as environment variables. In a double-quoted shell string the inner quotes are escaped:
 
 ```sh
 DESTINATIONS_WEBHOOK_SIGNATURE_CONTENT_TEMPLATE="{{.Timestamp.Unix}}.{{.Body}}"
 DESTINATIONS_WEBHOOK_SIGNATURE_HEADER_TEMPLATE="t={{.Timestamp.Unix}},v0={{.Signatures | join \",\"}}"
 ```
 
-You can also set `signature_content_template` and `signature_header_template` in YAML under `destinations.webhook`.
+In a `.env` file or a Compose `environment:` entry, write the value unquoted:
+
+```sh
+DESTINATIONS_WEBHOOK_SIGNATURE_CONTENT_TEMPLATE={{.Timestamp.Unix}}.{{.Body}}
+DESTINATIONS_WEBHOOK_SIGNATURE_HEADER_TEMPLATE=t={{.Timestamp.Unix}},v0={{.Signatures | join ","}}
+```
+
+You can also set `signature_content_template` and `signature_header_template` in YAML under `destinations.webhook`. Use single quotes — YAML takes a single-quoted scalar as-is, while a value starting with `{{` cannot be written unquoted, and a double-quoted one needs the inner quotes escaped as `\"`:
+
+```yaml
+destinations:
+  webhook:
+    signature_content_template: '{{.Timestamp.Unix}}.{{.Body}}'
+    signature_header_template: 't={{.Timestamp.Unix}},v0={{.Signatures | join ","}}'
+```
 {% /tab %}
 {% /tabs %}
 

docs/content/self-hosting/changelog/upgrade-v0.12.mdoc

@@ -56,13 +56,27 @@ The default webhook signature templates have changed to a simpler format without
 
 If your webhook receivers verify signatures using the old format, signature verification will fail after upgrading.
 
-**To maintain backward compatibility**, set these environment variables:
+**To maintain backward compatibility**, restore the old template values:
 
-```bash
+```
+{{.Timestamp.Unix}}.{{.Body}}
+t={{.Timestamp.Unix}},v0={{.Signatures | join ","}}
+```
+
+These are the literal template values; if the format carrying them requires escaping, apply that format's own. In a double-quoted shell string the inner quotes are escaped:
+
+```sh
 DESTINATIONS_WEBHOOK_SIGNATURE_CONTENT_TEMPLATE="{{.Timestamp.Unix}}.{{.Body}}"
 DESTINATIONS_WEBHOOK_SIGNATURE_HEADER_TEMPLATE="t={{.Timestamp.Unix}},v0={{.Signatures | join \",\"}}"
 ```
 
+In a `.env` file or a Compose `environment:` entry, write the value unquoted:
+
+```sh
+DESTINATIONS_WEBHOOK_SIGNATURE_CONTENT_TEMPLATE={{.Timestamp.Unix}}.{{.Body}}
+DESTINATIONS_WEBHOOK_SIGNATURE_HEADER_TEMPLATE=t={{.Timestamp.Unix}},v0={{.Signatures | join ","}}
+```
+
 ## SDK Request Body Field Names (All SDKs)
 
 All SDKs (TypeScript v0.6.0, Python v0.5.0, Go v0.5.1) now use a consistent `params` field name for request bodies instead of operation-specific names like `destinationCreate` or `destinationUpdate`.