Add Gitea-push webhook for auto-deploy

webhook.py: HMAC-signed receiver (X-Gitea-Signature), validates ref==main, one-concurrent-deploy lock, no request data reaches shell. deploy-webhook.sh: installs llm-bench-webhook systemd service (runs as aygea, in docker group), generates + stores secret in .webhook.secret. deploy.sh: port read from compose (now 31415). Installed on mewtwo: listening 0.0.0.0:41798, enabled for boot. Gitea webhook target: http://10.0.0.22:41798/hook Co-Authored-By: Claude <noreply@anthropic.com>
2026-07-28 14:20:03 -07:00
parent 42291f61b8
commit b97658e067
4 changed files with 189 additions and 2 deletions
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Install/manage the Gitea-push webhook receiver as a systemd service.
+#   ./deploy-webhook.sh install   -> generate secret, write unit, enable+start
+#   ./deploy-webhook.sh status    -> show service + last logs
+#   ./deploy-webhook.sh secret    -> print the current webhook secret (to paste into Gitea)
+#   ./deploy-webhook.sh uninstall -> disable+remove the service
+#
+# After install: in Gitea (admin/modelTesting) → Settings → Webhooks → Add webhook:
+#   Target URL:  http://10.0.0.22:41798/hook
+#   HTTP method: POST
+#   Content type: application/json
+#   Secret:      (output of `./deploy-webhook.sh secret`)
+#   Trigger on:  Push events (branch: main)
+set -euo pipefail
+cd "$(dirname "$0")"
+
+UNIT=/etc/systemd/system/llm-bench-webhook.service
+SECRET_FILE=.webhook.secret
+PORT="${WEBHOOK_PORT:-41798}"
+
+case "${1:-status}" in
+  install)
+    # generate a fresh secret if none yet
+    if [[ ! -f "$SECRET_FILE" ]]; then
+      openssl rand -hex 32 > "$SECRET_FILE"
+      chmod 600 "$SECRET_FILE"
+      echo "generated new secret -> $SECRET_FILE"
+    fi
+    SECRET=$(cat "$SECRET_FILE")
+    sudo tee "$UNIT" >/dev/null <<EOF
+[Unit]
+Description=LLM Benchmark — Gitea push webhook receiver
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=aygea
+Group=aygea
+SupplementaryGroups=docker
+WorkingDirectory=$(pwd)
+Environment=WEBHOOK_PORT=${PORT}
+Environment=WEBHOOK_SECRET=${SECRET}
+Environment=WEBHOOK_REF=refs/heads/main
+Environment=HOME=/home/aygea
+ExecStart=/usr/bin/python3 $(pwd)/webhook.py
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    sudo systemctl daemon-reload
+    sudo systemctl enable --now llm-bench-webhook
+    echo
+    echo "✓ webhook service installed and started on 0.0.0.0:${PORT}"
+    echo "  Gitea webhook URL: http://10.0.0.22:${PORT}/hook"
+    echo "  Secret: $(./deploy-webhook.sh secret)"
+    ;;
+  status)
+    systemctl status llm-bench-webhook --no-pager -l 2>/dev/null | head -15 || echo "not installed"
+    echo "--- recent log ---"
+    journalctl -u llm-bench-webhook -n 10 --no-pager 2>/dev/null || true
+    ;;
+  secret) cat "$SECRET_FILE" ;;
+  uninstall)
+    sudo systemctl disable --now llm-bench-webhook 2>/dev/null || true
+    sudo rm -f "$UNIT"; sudo systemctl daemon-reload
+    echo "removed webhook service"
+    ;;
+  *) echo "usage: $0 [install|status|secret|uninstall]"; exit 1 ;;
+esac