b6dec2a894
deploy.sh runs on LXC 121: git pull, caddy validate, systemctl reload. webhook.py is a small HTTP receiver on :9797/deploy that verifies the gitea HMAC-SHA256 signature and triggers deploy.sh. install.sh provisions /etc/caddy-deploy/secret and the systemd unit.
25 lines
717 B
Bash
Executable File
25 lines
717 B
Bash
Executable File
#!/bin/bash
|
|
# One-shot installer for the caddy-conf deploy webhook. Run on LXC 121 as root.
|
|
set -euo pipefail
|
|
|
|
REPO_DIR="${REPO_DIR:-/etc/caddy}"
|
|
SECRET_DIR=/etc/caddy-deploy
|
|
UNIT=caddy-deploy-webhook.service
|
|
|
|
install -d -m 700 "$SECRET_DIR"
|
|
if [[ ! -s "$SECRET_DIR/secret" ]]; then
|
|
umask 177
|
|
openssl rand -hex 32 > "$SECRET_DIR/secret"
|
|
echo "[install] generated new secret at $SECRET_DIR/secret"
|
|
fi
|
|
|
|
install -m 644 "$REPO_DIR/scripts/webhook/$UNIT" "/etc/systemd/system/$UNIT"
|
|
systemctl daemon-reload
|
|
systemctl enable --now "$UNIT"
|
|
systemctl status "$UNIT" --no-pager | head -6
|
|
|
|
echo
|
|
echo "Webhook listening on 0.0.0.0:9797/deploy"
|
|
echo "Secret (configure this in the Gitea webhook):"
|
|
cat "$SECRET_DIR/secret"
|