44 lines
1.2 KiB
Bash
44 lines
1.2 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# Forgejo/GitHub push webhook target — validates HMAC and redeploys main.
|
||
|
|
#
|
||
|
|
# Install on CT 116 with almquist/webhook or Caddy reverse_proxy to this script.
|
||
|
|
# Forgejo → Repository → Webhooks → POST → http://192.168.68.116:9000/hooks/deploy
|
||
|
|
#
|
||
|
|
# Env:
|
||
|
|
# DEPLOY_WEBHOOK_SECRET — shared secret (same as Forgejo webhook secret)
|
||
|
|
# APP_DIR=/opt/submatter
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
APP_DIR="${APP_DIR:-/opt/submatter}"
|
||
|
|
SECRET="${DEPLOY_WEBHOOK_SECRET:-}"
|
||
|
|
|
||
|
|
read -r payload || payload=""
|
||
|
|
if [[ -z "$payload" ]]; then
|
||
|
|
payload="$(cat)"
|
||
|
|
fi
|
||
|
|
signature="${HTTP_X_HUB_SIGNATURE_256:-${HTTP_X_FORGEJO_SIGNATURE:-}}"
|
||
|
|
|
||
|
|
if [[ -n "$SECRET" ]]; then
|
||
|
|
if [[ -z "$signature" ]]; then
|
||
|
|
echo "missing signature" >&2
|
||
|
|
exit 403
|
||
|
|
fi
|
||
|
|
sig="${signature#sha256=}"
|
||
|
|
expected="$(printf '%s' "$payload" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')"
|
||
|
|
if [[ "$sig" != "$expected" ]]; then
|
||
|
|
echo "invalid signature" >&2
|
||
|
|
exit 403
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
|
||
|
|
ref="$(printf '%s' "$payload" | sed -n 's/.*"ref":"\([^"]*\)".*/\1/p')"
|
||
|
|
if [[ "$ref" != "refs/heads/main" ]]; then
|
||
|
|
echo "ignored ref=${ref}"
|
||
|
|
exit 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "[deploy-webhook] push to main — deploying"
|
||
|
|
cd "$APP_DIR"
|
||
|
|
bash scripts/git-sync-deploy.sh
|
||
|
|
exec bash scripts/deploy-prod.sh build
|