webhook.py: check_auth() requires Bearer token (WEBHOOK_AUTH_TOKEN), checked before HMAC signature. Returns 401 on missing auth. Dockerfile: nginx proxies /hook -> host:41798, forwarding Authorization + X-Gitea-Signature headers. Host IP via HOST_IP env + host-gateway. docker-compose.yml: extra_hosts host-gateway + HOST_IP env. deploy-webhook.sh: generates .webhook.auth token, 'auth' subcommand. Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Run on mewtwo: bound 0.0.0.0:8081 -> nginx :80. Rebuilds site from source on every 'deploy.sh up' so new grades flow through without Coolify. Point Netbird at http://<host>:8081. Co-Authored-By: Claude <noreply@anthropic.com>