webhook

docker/host-nginx/taklimatspr.apps.mbip.my.conf

@@ -29,4 +29,21 @@ server {
         proxy_connect_timeout 30s;
         proxy_read_timeout    60s;
     }
+
+    # GitHub webhook deploy -> container webhook (adnanh/webhook) di 127.0.0.1:9001.
+    # Endpoint GitHub: https://taklimatspr.apps.mbip.my/hooks/deploy
+    location /hooks/ {
+        proxy_pass http://127.0.0.1:9001;
+
+        proxy_set_header Host            $host;
+        proxy_set_header X-Real-IP       $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+        # Deploy (build) ambil masa; bagi masa yg cukup utk response.
+        proxy_read_timeout 600s;
+    }
 }
+
+# NOTA: Selepas pasang SSL (certbot), blok di atas biasanya bertukar jadi
+# `listen 443 ssl`. Pastikan KEDUA-DUA `location /` dan `location /hooks/`
+# berada dalam blok 443 itu, dan `X-Forwarded-Proto $scheme` kekal ada.

docker/webhook/Dockerfile

@@ -0,0 +1,10 @@
+FROM golang:1.23-alpine AS builder
+RUN go install github.com/adnanh/webhook@2.8.1
+
+FROM alpine:3.21
+# docker-cli + compose plugin: deploy.sh perlu `docker compose build`
+# (kod taklimat di-bake dalam image, bukan bind-mount).
+RUN apk add --no-cache git docker-cli docker-cli-compose openssh-client
+COPY --from=builder /go/bin/webhook /usr/local/bin/webhook
+EXPOSE 9000
+ENTRYPOINT ["/usr/local/bin/webhook"]

docker/webhook/hooks.json

@@ -0,0 +1,32 @@
+[
+  {
+    "id": "deploy",
+    "execute-command": "/deploy.sh",
+    "command-working-directory": "/srv/spr2026_taklimat",
+    "response-message": "Deploy dimulakan.",
+    "trigger-rule": {
+      "and": [
+        {
+          "match": {
+            "type": "payload-hmac-sha256",
+            "secret": "{{ .Env.WEBHOOK_SECRET }}",
+            "parameter": {
+              "source": "header",
+              "name": "X-Hub-Signature-256"
+            }
+          }
+        },
+        {
+          "match": {
+            "type": "value",
+            "value": "refs/heads/master",
+            "parameter": {
+              "source": "payload",
+              "name": "ref"
+            }
+          }
+        }
+      ]
+    }
+  }
+]