adminandClaude
a93fe6f15e
webhook.py: check_auth() requires Bearer token (WEBHOOK_AUTH_TOKEN), checked before HMAC signature. Returns 401 on missing auth. Dockerfile: nginx proxies /hook -> host:41798, forwarding Authorization + X-Gitea-Signature headers. Host IP via HOST_IP env + host-gateway. docker-compose.yml: extra_hosts host-gateway + HOST_IP env. deploy-webhook.sh: generates .webhook.auth token, 'auth' subcommand. Co-Authored-By: Claude <noreply@anthropic.com>
67 lines
2.5 KiB
Bash
Executable File
67 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install/manage the Gitea-push webhook receiver as a systemd service.
|
|
# ./deploy-webhook.sh install | status | secret | auth | uninstall
|
|
#
|
|
# Gitea (admin/modelTesting) → Settings → Webhooks → Add webhook (Gitea type):
|
|
# Target URL: https://llmtesting.itsaygea.com/hook
|
|
# HTTP method: POST
|
|
# POST Content Type: application/json
|
|
# Secret: $(./deploy-webhook.sh secret)
|
|
# Authorization Header: $(./deploy-webhook.sh auth)
|
|
# Trigger On: Push Events, branch filter: main
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
|
|
UNIT=/etc/systemd/system/llm-bench-webhook.service
|
|
SECRET_FILE=.webhook.secret
|
|
AUTH_FILE=.webhook.auth
|
|
PORT="${WEBHOOK_PORT:-41798}"
|
|
|
|
case "${1:-status}" in
|
|
install)
|
|
[[ -f "$SECRET_FILE" ]] || { openssl rand -hex 32 > "$SECRET_FILE"; chmod 600 "$SECRET_FILE"; echo "generated HMAC secret"; }
|
|
[[ -f "$AUTH_FILE" ]] || { openssl rand -hex 24 > "$AUTH_FILE"; chmod 600 "$AUTH_FILE"; echo "generated auth token"; }
|
|
SECRET=$(cat "$SECRET_FILE"); AUTHTOK=$(cat "$AUTH_FILE")
|
|
sudo tee "$UNIT" >/dev/null <<EOF
|
|
[Unit]
|
|
Description=LLM Benchmark — Gitea push webhook receiver
|
|
After=network-online.target docker.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=aygea
|
|
Group=aygea
|
|
SupplementaryGroups=docker
|
|
WorkingDirectory=$(pwd)
|
|
Environment=WEBHOOK_PORT=${PORT}
|
|
Environment=WEBHOOK_SECRET=${SECRET}
|
|
Environment=WEBHOOK_AUTH_TOKEN=${AUTHTOK}
|
|
Environment=WEBHOOK_REF=refs/heads/main
|
|
Environment=HOME=/home/aygea
|
|
ExecStart=/usr/bin/python3 $(pwd)/webhook.py
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable --now llm-bench-webhook
|
|
echo
|
|
echo "✓ webhook service on 0.0.0.0:${PORT}"
|
|
echo " Gitea URL: https://llmtesting.itsaygea.com/hook"
|
|
echo " Authorization Header: $(./deploy-webhook.sh auth)"
|
|
echo " Secret: $(./deploy-webhook.sh secret)"
|
|
;;
|
|
status)
|
|
systemctl status llm-bench-webhook --no-pager -l 2>/dev/null | head -15 || echo "not installed"
|
|
echo "--- recent log ---"; sudo journalctl -u llm-bench-webhook -n 10 --no-pager 2>/dev/null || true ;;
|
|
secret) cat "$SECRET_FILE" ;;
|
|
auth) cat "$AUTH_FILE" ;;
|
|
uninstall)
|
|
sudo systemctl disable --now llm-bench-webhook 2>/dev/null || true
|
|
sudo rm -f "$UNIT"; sudo systemctl daemon-reload; echo "removed webhook service" ;;
|
|
*) echo "usage: $0 [install|status|secret|auth|uninstall]"; exit 1 ;;
|
|
esac
|