# yt-voice-clipper push-to-deploy (gitea webhook → irv-ml1)

Auto-deploys `vh/yt-voice-clipper` to irv-ml1 on every push to `main`. Built
2026-06-03 to end a run of manual rebuilds (the tool's frontend iterates fast).

## Flow

```
push to main → gitea webhook (POST) → HMAC-validated listener on irv-ml1:9008
            → ~/ytvc-deploy.sh : git fetch + reset --hard origin/main + docker compose up -d --build
```

main-only (other branches ignored). The deploy log is `~/.config/ytvc/deploy.log`
on irv-ml1.

## Components

**On the gitea server** (container `gitea` on **ana-docker**, data volume
`gitea_gitea_data`, app.ini at `/data/gitea/conf/app.ini`):
- `[webhook] ALLOWED_HOST_LIST = external, 10.100.0.0/16` — relaxes gitea's
  anti-SSRF guard to allow webhooks to the WG net (irv-ml1 is a private WG IP;
  the default `external` denies it). **Keep it scoped** — never `*`/`private`.
  Backup at `app.ini.bak-pre-webhook`. Requires `docker restart gitea` to apply
  (act_runner job containers survive the restart).
- Webhook on the repo: Target `http://10.100.79.3:9008/`, content-type
  `application/json`, Push events only, the shared secret.

**On irv-ml1** (all under `lkraven`, no root needed except the one-time
`loginctl enable-linger lkraven`):
- Deploy dir `/opt/docker/compose/yt-voice-clipper` is a **git clone**
  (remote `git@gitea-ytvc:vh/yt-voice-clipper.git` via read-only deploy key
  `~/.ssh/gitea_ytvc_deploy` + ssh-config `Host gitea-ytvc`). `.env`,
  `secrets/`, `docker-compose.override.yml` stay UNTRACKED so `git reset --hard`
  preserves them (incl. the `YTVC_PROXY` egress-proxy override).
- `~/ytvc-deploy.sh` — the deploy (fetch + reset + rebuild + recreate).
- `~/ytvc-webhook.py` — listener on `:9008`, HMAC-SHA256 validates
  `X-Gitea-Signature` against `~/.config/ytvc/webhook-secret` (mode 600), fires
  the deploy only on a verified push to `refs/heads/main`.
- `systemctl --user` service `ytvc-webhook.service` (lingering enabled).

## Verify / debug

```bash
# listener up?
ssh irv-ml1 'curl -s localhost:9008/'                       # -> ytvc-webhook ok
ssh irv-ml1 'systemctl --user is-active ytvc-webhook'
# deploys
ssh irv-ml1 'tail -20 ~/.config/ytvc/deploy.log'
# manual deploy (same as the webhook does)
ssh irv-ml1 'bash ~/ytvc-deploy.sh'
# gitea side: repo → Settings → Webhooks → Test Delivery (expect 202)
```

If gitea Test Delivery shows `dial tcp ... webhook can only call allowed HTTP
servers` → the `ALLOWED_HOST_LIST` change above is missing or gitea wasn't
restarted.