saufi/myAnsuran-KIK-JPPH-
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

webhook

Browse Source
This commit is contained in:
Saufi
2026-06-16 17:09:17 +08:00
parent fb4739e407
commit 9d4717eb45
3 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
deploy/README.md
View File

@@ -3,7 +3,10 @@
Bila ada `git push` ke Gitea, Gitea hantar webhook ke server. Server tarik kod Bila ada `git push` ke Gitea, Gitea hantar webhook ke server. Server tarik kod
terbaru dan jalankan `docker compose up --build -d` secara automatik. terbaru dan jalankan `docker compose up --build -d` secara automatik.
Aliran: **push → Gitea webhook → `webhook` listener (port 9000) → `deploy.sh`** Aliran: **push → Gitea webhook → `webhook` listener (port 9001) → `deploy.sh`**
> Nota: port **9001** digunakan (bukan 9000 default) kerana server ini sudah
> ada satu lagi app guna webhook di port 9001. Pastikan tiada port bertindih.
--- ---
@@ -38,7 +41,7 @@ sudo systemctl status myansuran-webhook
Repo → **Settings → Webhooks → Add Webhook → Gitea**: Repo → **Settings → Webhooks → Add Webhook → Gitea**:
- **Target URL:** `http://SERVER_IP:9000/hooks/myansuran-deploy` - **Target URL:** `http://SERVER_IP:9001/hooks/myansuran-deploy`
- **HTTP Method:** `POST` - **HTTP Method:** `POST`
- **Content Type:** `application/json` - **Content Type:** `application/json`
- **Secret:** secret SAMA seperti dalam `hooks.json` - **Secret:** secret SAMA seperti dalam `hooks.json`
@@ -61,8 +64,8 @@ sudo journalctl -u myansuran-webhook -f
## Nota keselamatan ## Nota keselamatan
- Port `9000` hanya perlu dicapai oleh Gitea. Hadkan dengan firewall: - Port `9001` hanya perlu dicapai oleh Gitea. Hadkan dengan firewall:
`sudo ufw allow from <IP_GITEA> to any port 9000 proto tcp` `sudo ufw allow from <IP_GITEA> to any port 9001 proto tcp`
- Atau letak di belakang Nginx/Apache reverse proxy dengan HTTPS. - Atau letak di belakang Nginx/Apache reverse proxy dengan HTTPS.
- Signature HMAC-SHA256 menghalang sesiapa tanpa secret daripada trigger deploy. - Signature HMAC-SHA256 menghalang sesiapa tanpa secret daripada trigger deploy.

2
deploy/hooks.json
View File

@@ -17,7 +17,7 @@
{ {
"match": { "match": {
"type": "value", "type": "value",
"value": "refs/heads/main", "value": "refs/heads/master",
"parameter": { "source": "payload", "name": "ref" } "parameter": { "source": "payload", "name": "ref" }
} }
} }

2
deploy/myansuran-webhook.service
View File

@@ -7,7 +7,7 @@ Requires=docker.service
# User mesti ahli group 'docker' supaya boleh jalankan docker compose tanpa sudo. # User mesti ahli group 'docker' supaya boleh jalankan docker compose tanpa sudo.
User=deploy User=deploy
WorkingDirectory=/opt/myansuran WorkingDirectory=/opt/myansuran
ExecStart=/usr/bin/webhook -hooks /opt/myansuran/deploy/hooks.json -port 9000 -verbose -hotreload ExecStart=/usr/bin/webhook -hooks /opt/myansuran/deploy/hooks.json -port 9001 -verbose -hotreload
Restart=always Restart=always
RestartSec=5 RestartSec=5