#!/bin/bash
# One-shot installer for the caddy-conf deploy webhook. Run on LXC 121 as root.
set -euo pipefail

REPO_DIR="${REPO_DIR:-/etc/caddy}"
SECRET_DIR=/etc/caddy-deploy
UNIT=caddy-deploy-webhook.service

install -d -m 700 "$SECRET_DIR"
if [[ ! -s "$SECRET_DIR/secret" ]]; then
  umask 177
  openssl rand -hex 32 > "$SECRET_DIR/secret"
  echo "[install] generated new secret at $SECRET_DIR/secret"
fi

install -m 644 "$REPO_DIR/scripts/webhook/$UNIT" "/etc/systemd/system/$UNIT"
systemctl daemon-reload
systemctl enable --now "$UNIT"
systemctl status "$UNIT" --no-pager | head -6

echo
echo "Webhook listening on 0.0.0.0:9797/deploy"
echo "Secret (configure this in the Gitea webhook):"
cat "$SECRET_DIR/secret"