first commit

2026-07-12 18:32:01 +02:00
commit 7079f383d4
11 changed files with 528 additions and 0 deletions
@@ -0,0 +1,127 @@
+package main
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"bytes"
+	"fmt"
+	"time"
+
+	"github.com/go-git/go-git/v5"
+	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
+)
+
+var repo *git.Repository
+
+func cloneOrOpen(cfg *Config) {
+	auth := &githttp.BasicAuth{
+		Username: "x-token",
+		Password: cfg.RepoToken,
+	}
+
+	if _, err := os.Stat(cfg.ContentDir + "/.git"); os.IsNotExist(err) {
+		log.Println("Cloning repo...")
+		r, err := git.PlainClone(cfg.ContentDir, false, &git.CloneOptions{
+			URL:  cfg.RepoURL,
+			Auth: auth,
+		})
+		if err != nil {
+			notifyFailure(cfg, "clone failed", err)    // NEU
+			log.Fatalf("clone failed: %v", err)
+		}
+		repo = r
+	} else {
+		log.Println("Opening existing repo...")
+		r, err := git.PlainOpen(cfg.ContentDir)
+		if err != nil {
+			notifyFailure(cfg, "open failed", err)     // NEU
+			log.Fatalf("open failed: %v", err)
+		}
+		repo = r
+	}
+}
+
+func pull(cfg *Config) error {
+	w, err := repo.Worktree()
+	if err != nil {
+		return err
+	}
+	err = w.Pull(&git.PullOptions{
+		Auth: &githttp.BasicAuth{
+			Username: "x-token",
+			Password: cfg.RepoToken,
+		},
+	})
+	if err == git.NoErrAlreadyUpToDate {
+		return nil
+	}
+	return err
+}
+
+func validateSignature(secret, signature string, body []byte) bool {
+	mac := hmac.New(sha256.New, []byte(secret))
+	mac.Write(body)
+	expected := hex.EncodeToString(mac.Sum(nil))
+	return hmac.Equal([]byte(expected), []byte(signature))
+}
+
+func webhookHandler(cfg *Config) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+
+		sig := r.Header.Get("X-Gitea-Signature")
+		if !validateSignature(cfg.WebhookSecret, sig, body) {
+			log.Println("invalid webhook signature")
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+
+		if err := pull(cfg); err != nil {
+			notifyFailure(cfg, "pull failed", err)    // NEU
+			log.Printf("pull failed: %v", err)
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+
+		log.Println("pulled new content")
+		w.WriteHeader(http.StatusOK)
+	}
+}
+
+func notifyFailure(cfg *Config, context string, err error) {
+	if cfg.NtfyURL == "" || cfg.NtfyTopic == "" {
+		return
+	}
+
+	msg := fmt.Sprintf("%s: %v", context, err)
+	url := fmt.Sprintf("%s/%s", cfg.NtfyURL, cfg.NtfyTopic)
+
+	req, reqErr := http.NewRequest("POST", url, bytes.NewBufferString(msg))
+	if reqErr != nil {
+		log.Printf("ntfy request build failed: %v", reqErr)
+		return
+	}
+	req.Header.Set("Title", "Varde Webhook Failure")
+	req.Header.Set("Priority", "high")
+
+	client := &http.Client{Timeout: 5 * time.Second}
+	resp, sendErr := client.Do(req)
+	if sendErr != nil {
+		log.Printf("ntfy notification failed: %v", sendErr)
+		return
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 300 {
+		log.Printf("ntfy notification returned status %d", resp.StatusCode)
+	}
+}