74 lines
2.2 KiB
Markdown
74 lines
2.2 KiB
Markdown
# Auto-deploy via Git Webhook
|
|
|
|
Bila ada `git push` ke Gitea, Gitea hantar webhook ke server. Server tarik kod
|
|
terbaru dan jalankan `docker compose up --build -d` secara automatik.
|
|
|
|
Aliran: **push → Gitea webhook → `webhook` listener (port 9000) → `deploy.sh`**
|
|
|
|
---
|
|
|
|
## 1. Setup di server production (sekali sahaja)
|
|
|
|
Andaikan repo berada di `/opt/myansuran` (laraskan path dalam `hooks.json`
|
|
dan `myansuran-webhook.service` jika berbeza).
|
|
|
|
```bash
|
|
# a) Pasang webhook listener
|
|
sudo apt-get update && sudo apt-get install -y webhook
|
|
|
|
# b) Pastikan user 'deploy' wujud & ahli group docker (boleh tukar nama user)
|
|
sudo useradd -m -G docker deploy 2>/dev/null || sudo usermod -aG docker deploy
|
|
|
|
# c) Pastikan skrip executable
|
|
chmod +x /opt/myansuran/deploy/deploy.sh
|
|
|
|
# d) Set secret rahsia dalam hooks.json (ganti GANTI_DENGAN_SECRET_RAHSIA)
|
|
# Jana satu secret kuat:
|
|
openssl rand -hex 32
|
|
# Lepas tu edit /opt/myansuran/deploy/hooks.json -> letak nilai itu pada "secret"
|
|
|
|
# e) Pasang service systemd
|
|
sudo cp /opt/myansuran/deploy/myansuran-webhook.service /etc/systemd/system/
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable --now myansuran-webhook
|
|
sudo systemctl status myansuran-webhook
|
|
```
|
|
|
|
## 2. Setup webhook di Gitea
|
|
|
|
Repo → **Settings → Webhooks → Add Webhook → Gitea**:
|
|
|
|
- **Target URL:** `http://SERVER_IP:9000/hooks/myansuran-deploy`
|
|
- **HTTP Method:** `POST`
|
|
- **Content Type:** `application/json`
|
|
- **Secret:** secret SAMA seperti dalam `hooks.json`
|
|
- **Trigger:** Push events sahaja
|
|
- **Branch filter:** `main`
|
|
|
|
Klik **Test Delivery** untuk uji.
|
|
|
|
## 3. Uji manual
|
|
|
|
```bash
|
|
# Jalankan deploy terus tanpa webhook (untuk debug)
|
|
/opt/myansuran/deploy/deploy.sh
|
|
|
|
# Lihat log webhook
|
|
sudo journalctl -u myansuran-webhook -f
|
|
```
|
|
|
|
---
|
|
|
|
## Nota keselamatan
|
|
|
|
- Port `9000` hanya perlu dicapai oleh Gitea. Hadkan dengan firewall:
|
|
`sudo ufw allow from <IP_GITEA> to any port 9000 proto tcp`
|
|
- Atau letak di belakang Nginx/Apache reverse proxy dengan HTTPS.
|
|
- Signature HMAC-SHA256 menghalang sesiapa tanpa secret daripada trigger deploy.
|
|
|
|
## Tukar branch
|
|
|
|
Default deploy branch ialah `main`. Untuk branch lain, set dalam service:
|
|
`ExecStart=... ` tambah `Environment=BRANCH=staging`, dan tukar `refs/heads/main`
|
|
dalam `hooks.json` kepada branch berkenaan.
|