Hook from gitlab.com fails with http 400 error

[nurtext]

Caddyfile:

mysite {
  git {
    branch {latest}
    clone_args --recurse-submodules
    hook /webhook redacted
    hook_type gitlab
    interval -1
    key /root/.ssh/id_rsa
    path /tmp/site
    repo git@gitlab.com:redacted/redacted.git
    then hugo --destination=/srv/site
  }
  root /srv/site
  tls {
    dns lightsail
    wildcard
  }
}

Startup log:

Cloning into '/tmp/site'...
Submodule 'redacted' (https://github.com/redacted/redacted) registered for path 'redacted'
Cloning into '/tmp/site/redacted'...
Submodule path 'redacted/redacted': checked out '9465b903193e75d153ff5b270b7f74b0cca5fd68'
2019/07/09 13:19:11 ssh://[email protected]:redacted/redacted.git pulled.
Note: checking out 'tags/v1.0.1'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by performing another checkout.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -b with the checkout command again. Example:

  git checkout -b <new-branch-name>

HEAD is now at 38944b8 fix: Wrong base url
2019/07/09 13:19:14 Tag v1.0.1 checkout done.
Building sites …
                   | EN
+------------------+----+
  Pages            |  7
  Paginator pages  |  0
  Non-page files   |  0
  Static files     |  6
  Processed images |  0
  Aliases          |  0
  Sitemaps         |  1
  Cleaned          |  0

Total in 16 ms
2019/07/09 13:19:14 Command 'hugo --destination=/srv/site' successful.

Serving HTTPS on port 443
https://redacted

Serving HTTP on port 80
http://redacted

[..]

gitlab.com hook details

Request URL: POST https://redacted/webhook
Trigger: Tag Push Hook
Elapsed time: 0.43 sec

gitlab.com request headers

Content-Type: application/json
X-Gitlab-Event: Tag Push Hook
X-Gitlab-Token: redacted

Caddy response headers and body:

Content-Type: text/plain; charset=utf-8
Server: Caddy
X-Content-Type-Options: nosniff
Date: Tue, 09 Jul 2019 13:19:52 GMT
Content-Length: 16
Connection: close

400 Bad Request

Log shows nothing, triple checked every detail (hook URL & secret). Can't get it to work - any idea?