Hook from gitlab.com fails with http 400 error

Caddyfile:

```Caddyfile
mysite {
git {
branch {latest}
clone_args --recurse-submodules
hook /webhook redacted
hook_type gitlab
interval -1
key /root/.ssh/id_rsa
path /tmp/site
repo git@gitlab.com:redacted/redacted.git
then hugo --destination=/srv/site
}
root /srv/site
tls {
dns lightsail
wildcard
}
}
```

Startup log:

```
Cloning into '/tmp/site'...
Submodule 'redacted' (https://github.com/redacted/redacted) registered for path 'redacted'
Cloning into '/tmp/site/redacted'...
Submodule path 'redacted/redacted': checked out '9465b903193e75d153ff5b270b7f74b0cca5fd68'
2019/07/09 13:19:11 ssh://git@gitlab.com:redacted/redacted.git pulled.
Note: checking out 'tags/v1.0.1'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by performing another checkout.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -b with the checkout command again. Example:

git checkout -b

HEAD is now at 38944b8 fix: Wrong base url
2019/07/09 13:19:14 Tag v1.0.1 checkout done.
Building sites …
| EN
+------------------+----+
Pages | 7
Paginator pages | 0
Non-page files | 0
Static files | 6
Processed images | 0
Aliases | 0
Sitemaps | 1
Cleaned | 0

Total in 16 ms
2019/07/09 13:19:14 Command 'hugo --destination=/srv/site' successful.

Serving HTTPS on port 443
https://redacted

Serving HTTP on port 80
http://redacted

[..]
```

gitlab.com hook details

```
Request URL: POST https://redacted/webhook
Trigger: Tag Push Hook
Elapsed time: 0.43 sec
```

gitlab.com request headers

```
Content-Type: application/json
X-Gitlab-Event: Tag Push Hook
X-Gitlab-Token: redacted
```

Caddy response headers and body:

```
Content-Type: text/plain; charset=utf-8
Server: Caddy
X-Content-Type-Options: nosniff
Date: Tue, 09 Jul 2019 13:19:52 GMT
Content-Length: 16
Connection: close

400 Bad Request
```

Log shows nothing, triple checked every detail (hook URL & secret). Can't get it to work - any idea?