vh
6d66bc2f30
Operator's call: keep the arbo stack in eshpfi and version its deploy machinery alongside the compose (was host-only on irv-ml1 = recoverability foot-gun). - arbo-webhook.py: :9009 HMAC listener (secret externalized to host file, not git) - arbo-deploy.sh: internal-route fetch + catalog-only targeted restart Document both in the README Q5 section + the internal-gitea-route gotcha.
24 lines
1.5 KiB
Python
Executable File
24 lines
1.5 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Gitea push-webhook listener: on a verified push to main, trigger ~/arbo-deploy.sh.
|
|
HMAC-SHA256 validated against ~/.config/arbo/webhook-secret (X-Gitea-Signature)."""
|
|
import hashlib, hmac, json, os, subprocess, threading
|
|
from http.server import BaseHTTPRequestHandler, HTTPServer
|
|
SECRET = open(os.path.expanduser("~/.config/arbo/webhook-secret"), "rb").read().strip()
|
|
DEPLOY = os.path.expanduser("~/arbo-deploy.sh")
|
|
class H(BaseHTTPRequestHandler):
|
|
def do_POST(self):
|
|
body = self.rfile.read(int(self.headers.get("Content-Length", 0)))
|
|
mac = hmac.new(SECRET, body, hashlib.sha256).hexdigest()
|
|
if not hmac.compare_digest(mac, self.headers.get("X-Gitea-Signature", "")):
|
|
self.send_response(401); self.end_headers(); self.wfile.write(b"bad signature\n"); return
|
|
try: ref = json.loads(body).get("ref", "")
|
|
except Exception: self.send_response(400); self.end_headers(); return
|
|
if ref != "refs/heads/main":
|
|
self.send_response(200); self.end_headers(); self.wfile.write(b"ignored " + ref.encode() + b"\n"); return
|
|
self.send_response(202); self.end_headers(); self.wfile.write(b"deploying\n")
|
|
threading.Thread(target=lambda: subprocess.run(["bash", DEPLOY]), daemon=True).start()
|
|
def do_GET(self):
|
|
self.send_response(200); self.end_headers(); self.wfile.write(b"arbo-webhook ok\n")
|
|
def log_message(self, *a): pass
|
|
HTTPServer(("0.0.0.0", 9009), H).serve_forever()
|