Fabian Gasper
128 lines
2.8 KiB
Go
128 lines
2.8 KiB
Go
package main
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"io"
|
|
"log"
|
|
"net/http"
|
|
"os"
|
|
"bytes"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/go-git/go-git/v5"
|
|
githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
|
|
)
|
|
|
|
var repo *git.Repository
|
|
|
|
func cloneOrOpen(cfg *Config) {
|
|
auth := &githttp.BasicAuth{
|
|
Username: "x-token",
|
|
Password: cfg.RepoToken,
|
|
}
|
|
|
|
if _, err := os.Stat(cfg.ContentDir + "/.git"); os.IsNotExist(err) {
|
|
log.Println("Cloning repo...")
|
|
r, err := git.PlainClone(cfg.ContentDir, false, &git.CloneOptions{
|
|
URL: cfg.RepoURL,
|
|
Auth: auth,
|
|
})
|
|
if err != nil {
|
|
notifyFailure(cfg, "clone failed", err) // NEU
|
|
log.Fatalf("clone failed: %v", err)
|
|
}
|
|
repo = r
|
|
} else {
|
|
log.Println("Opening existing repo...")
|
|
r, err := git.PlainOpen(cfg.ContentDir)
|
|
if err != nil {
|
|
notifyFailure(cfg, "open failed", err) // NEU
|
|
log.Fatalf("open failed: %v", err)
|
|
}
|
|
repo = r
|
|
}
|
|
}
|
|
|
|
func pull(cfg *Config) error {
|
|
w, err := repo.Worktree()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
err = w.Pull(&git.PullOptions{
|
|
Auth: &githttp.BasicAuth{
|
|
Username: "x-token",
|
|
Password: cfg.RepoToken,
|
|
},
|
|
})
|
|
if err == git.NoErrAlreadyUpToDate {
|
|
return nil
|
|
}
|
|
return err
|
|
}
|
|
|
|
func validateSignature(secret, signature string, body []byte) bool {
|
|
mac := hmac.New(sha256.New, []byte(secret))
|
|
mac.Write(body)
|
|
expected := hex.EncodeToString(mac.Sum(nil))
|
|
return hmac.Equal([]byte(expected), []byte(signature))
|
|
}
|
|
|
|
func webhookHandler(cfg *Config) http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
body, err := io.ReadAll(r.Body)
|
|
if err != nil {
|
|
w.WriteHeader(http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
sig := r.Header.Get("X-Gitea-Signature")
|
|
if !validateSignature(cfg.WebhookSecret, sig, body) {
|
|
log.Println("invalid webhook signature")
|
|
w.WriteHeader(http.StatusUnauthorized)
|
|
return
|
|
}
|
|
|
|
if err := pull(cfg); err != nil {
|
|
notifyFailure(cfg, "pull failed", err) // NEU
|
|
log.Printf("pull failed: %v", err)
|
|
w.WriteHeader(http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
log.Println("pulled new content")
|
|
w.WriteHeader(http.StatusOK)
|
|
}
|
|
}
|
|
|
|
func notifyFailure(cfg *Config, context string, err error) {
|
|
if cfg.NtfyURL == "" || cfg.NtfyTopic == "" {
|
|
return
|
|
}
|
|
|
|
msg := fmt.Sprintf("%s: %v", context, err)
|
|
url := fmt.Sprintf("%s/%s", cfg.NtfyURL, cfg.NtfyTopic)
|
|
|
|
req, reqErr := http.NewRequest("POST", url, bytes.NewBufferString(msg))
|
|
if reqErr != nil {
|
|
log.Printf("ntfy request build failed: %v", reqErr)
|
|
return
|
|
}
|
|
req.Header.Set("Title", "Varde Webhook Failure")
|
|
req.Header.Set("Priority", "high")
|
|
|
|
client := &http.Client{Timeout: 5 * time.Second}
|
|
resp, sendErr := client.Do(req)
|
|
if sendErr != nil {
|
|
log.Printf("ntfy notification failed: %v", sendErr)
|
|
return
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode >= 300 {
|
|
log.Printf("ntfy notification returned status %d", resp.StatusCode)
|
|
}
|
|
}
|