admin/modelTesting
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Authorization-header + /hook proxy to webhook/deploy

Browse Source 
webhook.py: check_auth() requires Bearer token (WEBHOOK_AUTH_TOKEN),
  checked before HMAC signature. Returns 401 on missing auth.
Dockerfile: nginx proxies /hook -> host:41798, forwarding Authorization
  + X-Gitea-Signature headers. Host IP via HOST_IP env + host-gateway.
docker-compose.yml: extra_hosts host-gateway + HOST_IP env.
deploy-webhook.sh: generates .webhook.auth token, 'auth' subcommand.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
admin
2026-07-28 14:28:16 -07:00
co-authored by Claude
parent b97658e067
commit a93fe6f15e
4 changed files with 79 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy-webhook.sh
+21 -27
View File
@@ -1,32 +1,27 @@
#!/usr/bin/env bash
# Install/manage the Gitea-push webhook receiver as a systemd service.
# ./deploy-webhook.sh install -> generate secret, write unit, enable+start
# ./deploy-webhook.sh status -> show service + last logs
# ./deploy-webhook.sh secret -> print the current webhook secret (to paste into Gitea)
# ./deploy-webhook.sh uninstall -> disable+remove the service
# ./deploy-webhook.sh install | status | secret | auth | uninstall
#
# After install: in Gitea (admin/modelTesting) → Settings → Webhooks → Add webhook:
# Target URL: http://10.0.0.22:41798/hook
# HTTP method: POST
# Content type: application/json
# Secret: (output of `./deploy-webhook.sh secret`)
# Trigger on: Push events (branch: main)
# Gitea (admin/modelTesting) → Settings → Webhooks → Add webhook (Gitea type):
# Target URL: https://llmtesting.itsaygea.com/hook
# HTTP method: POST
# POST Content Type: application/json
# Secret: $(./deploy-webhook.sh secret)
# Authorization Header: $(./deploy-webhook.sh auth)
# Trigger On: Push Events, branch filter: main
set -euo pipefail
cd "$(dirname "$0")"
UNIT=/etc/systemd/system/llm-bench-webhook.service
SECRET_FILE=.webhook.secret
AUTH_FILE=.webhook.auth
PORT="${WEBHOOK_PORT:-41798}"
case "${1:-status}" in
install)
# generate a fresh secret if none yet
if [[ ! -f "$SECRET_FILE" ]]; then
openssl rand -hex 32 > "$SECRET_FILE"
chmod 600 "$SECRET_FILE"
echo "generated new secret -> $SECRET_FILE"
fi
SECRET=$(cat "$SECRET_FILE")
[[ -f "$SECRET_FILE" ]] || { openssl rand -hex 32 > "$SECRET_FILE"; chmod 600 "$SECRET_FILE"; echo "generated HMAC secret"; }
[[ -f "$AUTH_FILE" ]] || { openssl rand -hex 24 > "$AUTH_FILE"; chmod 600 "$AUTH_FILE"; echo "generated auth token"; }
SECRET=$(cat "$SECRET_FILE"); AUTHTOK=$(cat "$AUTH_FILE")
sudo tee "$UNIT" >/dev/null <<EOF
[Unit]
Description=LLM Benchmark — Gitea push webhook receiver
@@ -41,6 +36,7 @@ SupplementaryGroups=docker
WorkingDirectory=$(pwd)
Environment=WEBHOOK_PORT=${PORT}
Environment=WEBHOOK_SECRET=${SECRET}
Environment=WEBHOOK_AUTH_TOKEN=${AUTHTOK}
Environment=WEBHOOK_REF=refs/heads/main
Environment=HOME=/home/aygea
ExecStart=/usr/bin/python3 $(pwd)/webhook.py
@@ -53,20 +49,18 @@ EOF
sudo systemctl daemon-reload
sudo systemctl enable --now llm-bench-webhook
echo
echo "✓ webhook service installed and started on 0.0.0.0:${PORT}"
echo " Gitea webhook URL: http://10.0.0.22:${PORT}/hook"
echo " Secret: $(./deploy-webhook.sh secret)"
echo "✓ webhook service on 0.0.0.0:${PORT}"
echo " Gitea URL: https://llmtesting.itsaygea.com/hook"
echo " Authorization Header: $(./deploy-webhook.sh auth)"
echo " Secret: $(./deploy-webhook.sh secret)"
;;
status)
systemctl status llm-bench-webhook --no-pager -l 2>/dev/null | head -15 || echo "not installed"
echo "--- recent log ---"
journalctl -u llm-bench-webhook -n 10 --no-pager 2>/dev/null || true
;;
echo "--- recent log ---"; sudo journalctl -u llm-bench-webhook -n 10 --no-pager 2>/dev/null || true ;;
secret) cat "$SECRET_FILE" ;;
auth) cat "$AUTH_FILE" ;;
uninstall)
sudo systemctl disable --now llm-bench-webhook 2>/dev/null || true
sudo rm -f "$UNIT"; sudo systemctl daemon-reload
echo "removed webhook service"
;;
*) echo "usage: $0 [install|status|secret|uninstall]"; exit 1 ;;
sudo rm -f "$UNIT"; sudo systemctl daemon-reload; echo "removed webhook service" ;;
*) echo "usage: $0 [install|status|secret|auth|uninstall]"; exit 1 ;;
esac