feat(deploy): Webhook, Build-Skript, nginx, Traefik
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
ClaudeandClaude Opus 5.5 committed
1 parent
30f4ddc0f4
commit
906bdf1033
7 files changed
+1084
No files matched your search
@@ -0,0 +1,98 @@
|
||||
# Deployment aircard-ios.org
|
||||
|
||||
Die Seite wird auf dem Webklar-Server aus dem Gitea-Repo `knso/AirCardIOS` gebaut und von nginx ausgeliefert. Traefik stellt TLS und Weiterleitungen. Dieser Ordner enthält alles, was dafür im Repo liegt; die Dateien auf dem Server sind Kopien davon.
|
||||
|
||||
## Bestandteile
|
||||
|
||||
| Datei im Repo | Ziel auf dem Server (`/home/webklar/apps/`) | Aufgabe |
|
||||
|---|---|---|
|
||||
| `deploy/deploy.sh` | `aircard-ios.org/deploy.sh` (ausführbar) | klont/aktualisiert das Repo, baut `web/` und kopiert `dist/` nach `out/` |
|
||||
| `deploy/webhook-server.js` | `aircard-ios.org/webhook-server.js` | nimmt den Gitea-Webhook an, startet `deploy.sh` nacheinander, pollt alle 15 Minuten |
|
||||
| `deploy/nginx/aircard-ios.org.conf` | `aircard-ios.org/nginx/aircard-ios.org.conf` | nginx-Konfiguration der Seite |
|
||||
| `deploy/traefik/aircard.yml` | `traefik/dynamic/aircard.yml` | Route `/v1` mit Header `X-Appwrite-Project: aircard` an Appwrite |
|
||||
| `deploy/compose-snippet.yml` | `docker-compose.yml` (nach dem eship-Block) | Dienste `aircard-build` und `aircard` |
|
||||
|
||||
Weitere Ordner unter `aircard-ios.org/` (nicht im Repo): `build/` (Klon des Repos, Arbeitsordner des Build-Containers), `out/` (gebaute Seite, von nginx ausgeliefert), `dev/` (Arbeitskopie für die Entwicklung, nicht gemountet).
|
||||
|
||||
## Einrichten (einmalig)
|
||||
|
||||
```sh
|
||||
APP=/home/webklar/apps
|
||||
SRC=$APP/aircard-ios.org/dev/deploy
|
||||
|
||||
mkdir -p $APP/aircard-ios.org/build $APP/aircard-ios.org/out $APP/aircard-ios.org/nginx
|
||||
cp $SRC/deploy.sh $APP/aircard-ios.org/deploy.sh && chmod +x $APP/aircard-ios.org/deploy.sh
|
||||
cp $SRC/webhook-server.js $APP/aircard-ios.org/webhook-server.js
|
||||
cp $SRC/nginx/aircard-ios.org.conf $APP/aircard-ios.org/nginx/aircard-ios.org.conf
|
||||
|
||||
# Compose: Backup, dann den Inhalt von compose-snippet.yml unter `services:` direkt nach dem eship-Block einfügen
|
||||
cp $APP/docker-compose.yml $APP/docker-compose.yml.bak-2026-10-04-aircard
|
||||
cd $APP && docker compose config -q; echo $? # 0; einzige erlaubte Ausgabe: Warnung "attribute `version` is obsolete"
|
||||
|
||||
# Traefik-Route atomar ablegen (Datei-Provider lädt sie ohne Neustart)
|
||||
cp $SRC/traefik/aircard.yml $APP/traefik/dynamic/aircard.yml.tmp && mv $APP/traefik/dynamic/aircard.yml.tmp $APP/traefik/dynamic/aircard.yml
|
||||
```
|
||||
|
||||
Die `.env` neben der `docker-compose.yml` muss `GITEA_DEPLOY_TOKEN` (Lesezugriff auf `knso/AirCardIOS`) und `GITEA_DEPLOY_WEBHOOK_SECRET` enthalten. Beide Werte gehören nie in Logs, Chats oder Commits.
|
||||
|
||||
## Starten
|
||||
|
||||
```sh
|
||||
cd /home/webklar/apps && docker compose up -d aircard-build aircard
|
||||
```
|
||||
|
||||
Nur diese beiden Dienste starten, nie ein nacktes `docker compose up -d` (das würde nicht laufende Dienste wie eship-build wieder anlegen). Der Build-Container installiert beim Start `git`, startet den Webhook-Server und baut sofort einmal (`initial`). Den Fortschritt zeigt `docker logs -f webklar-aircard-build`; am Ende steht `Deployment abgeschlossen` (oder eine Zeile mit `ERROR:`).
|
||||
|
||||
Ohne `AIRCARD_WEBHOOK_TOKEN` (also ohne `GITEA_DEPLOY_WEBHOOK_SECRET` in der `.env`) beendet sich der Webhook-Server mit Exit-Code 1, statt Anfragen ungeprüft durchzulassen.
|
||||
|
||||
## Manuell deployen
|
||||
|
||||
```sh
|
||||
docker exec webklar-aircard-build sh /deploy.sh
|
||||
```
|
||||
|
||||
Ohne `DEPLOY_TRIGGER` baut das Skript immer neu, auch wenn sich der Commit nicht geändert hat.
|
||||
|
||||
## Gitea-Webhook
|
||||
|
||||
Repo `knso/AirCardIOS` → Einstellungen → Webhooks → Gitea:
|
||||
|
||||
| Feld | Wert |
|
||||
|---|---|
|
||||
| Ziel-URL | `https://aircard-ios.org/webhook/deploy` |
|
||||
| HTTP-Methode | POST |
|
||||
| Content-Type | `application/json` |
|
||||
| Secret | Wert von `GITEA_DEPLOY_WEBHOOK_SECRET` aus `/home/webklar/apps/.env` (volle Länge, nur dort nachsehen) |
|
||||
| Auslöser | nur Push-Ereignisse |
|
||||
| Branch-Filter | `main` |
|
||||
| Aktiv | ja |
|
||||
|
||||
„Test delivery“ muss `202` ergeben. `401` heißt: Secret stimmt nicht. `200` mit `{"ignored":true}` heißt: Push auf einen anderen Branch als `main`.
|
||||
|
||||
## Verhalten
|
||||
|
||||
- **Webhook** (`POST /webhook/deploy`): prüft die Signatur im Header `x-gitea-signature` (HMAC-SHA256 über den Rohbody). `401` bei falscher oder fehlender Signatur, `413` bei Body über 1 MB, `200` bei Push auf einen anderen Branch, `202` bei Push auf `main`; der Build läuft danach im Hintergrund. Alles andere antwortet `404`.
|
||||
- **Warteschlange**: Builds laufen nacheinander, höchstens einer läuft und einer wartet. Weitere Pushes während ein Lauf wartet, werden mit `202` beantwortet und fügen keinen Lauf hinzu (der wartende Lauf holt ohnehin den neuesten Stand).
|
||||
- **Trigger**: `webhook` und manuelle Aufrufe bauen immer. `initial` (Container-Start) und `poll` (alle 15 Minuten) bauen nur, wenn es einen neuen Commit gibt oder `out/index.html` fehlt.
|
||||
- **Gemerkter Commit**: `build/.git/aircard-last-deployed-commit` enthält den zuletzt **versuchten** Commit, geschrieben vor dem Build. Ein kaputter Build wird deshalb nicht alle 15 Minuten wiederholt; die alte Seite bleibt online, bis ein neuer Commit oder ein Webhook-/manueller Lauf kommt.
|
||||
- **Fehler**: Ein fehlgeschlagener Lauf wird mit `[webhook] … deployment failed` protokolliert und beendet den Server nicht. Fehlerzeilen des Skripts beginnen mit `ERROR:`.
|
||||
- **Build-Variablen**: `VITE_APPWRITE_ENDPOINT` und `VITE_APPWRITE_PROJECT_ID` kommen aus der Container-Umgebung (compose); Vite liest sie direkt.
|
||||
|
||||
## Änderungen später
|
||||
|
||||
- `deploy.sh` ändern: Datei auf dem Server mit `cp` überschreiben (nicht `mv`, sonst zeigt der Datei-Mount auf die alte Datei). Gilt beim nächsten Lauf.
|
||||
- `webhook-server.js` ändern: ebenso mit `cp` ersetzen, dann `cd /home/webklar/apps && docker compose restart aircard-build`.
|
||||
- nginx-Konfiguration ändern: mit `cp` ersetzen, dann `docker exec webklar-aircard nginx -t && docker exec webklar-aircard nginx -s reload`.
|
||||
- Traefik-Route ändern: Datei atomar ersetzen wie oben; Löschen der Datei entfernt die Route wieder.
|
||||
|
||||
## www.aircard-ios.org
|
||||
|
||||
Solange `dig +short www.aircard-ios.org @8.8.8.8` nichts liefert, gibt es nur die Hauptdomain. Zeigt der A-Record auf `91.99.156.85`, werden die auskommentierten www-Labels am Dienst `aircard` in `docker-compose.yml` aktiviert (Backup vorher, dann `docker compose config -q` und `docker compose up -d aircard`). Sie leiten per 301 auf `https://aircard-ios.org` weiter und haben eigene Router, damit ein www-Fehler das Zertifikat der Hauptdomain nicht blockiert.
|
||||
|
||||
## Tests
|
||||
|
||||
```sh
|
||||
node --test deploy/webhook-server.test.js
|
||||
```
|
||||
|
||||
Die Tests brauchen nur Node und starten die Server auf Port 0.
|
||||
@@ -0,0 +1,81 @@
|
||||
# ==============================================
|
||||
# AIRCARD-IOS.ORG - Automatisches Deployment aus Gitea
|
||||
# URL: aircard-ios.org
|
||||
# Repository: https://git.webklar.com/knso/AirCardIOS
|
||||
# Einfügen unter `services:` direkt nach dem eship-Block (siehe deploy/README.md).
|
||||
# Starten NUR mit: docker compose up -d aircard-build aircard
|
||||
# (ein nacktes `up -d` würde andere Dienste wieder anlegen)
|
||||
# Die Appwrite-Route liegt als Datei in traefik/dynamic/aircard.yml.
|
||||
# ==============================================
|
||||
aircard-build:
|
||||
image: node:22-alpine
|
||||
container_name: webklar-aircard-build
|
||||
restart: unless-stopped
|
||||
init: true
|
||||
mem_limit: 768m
|
||||
working_dir: /app
|
||||
environment:
|
||||
- GITEA_URL=https://git.webklar.com
|
||||
- GITEA_USER=knso
|
||||
- GITEA_REPO=AirCardIOS
|
||||
- GITEA_TOKEN=${GITEA_DEPLOY_TOKEN}
|
||||
- APP_SUBDIR=web
|
||||
- DEPLOY_BRANCH=main
|
||||
- AIRCARD_DEPLOY_BRANCH=main
|
||||
- AIRCARD_WEBHOOK_TOKEN=${GITEA_DEPLOY_WEBHOOK_SECRET}
|
||||
- AIRCARD_WEBHOOK_PORT=8087
|
||||
- AIRCARD_DEPLOY_SCRIPT=/deploy.sh
|
||||
- POLL_INTERVAL_MINUTES=15
|
||||
- NODE_OPTIONS=--max-old-space-size=512
|
||||
- VITE_APPWRITE_ENDPOINT=https://aircard-ios.org/v1
|
||||
- VITE_APPWRITE_PROJECT_ID=aircard
|
||||
volumes:
|
||||
- ./aircard-ios.org/build:/app
|
||||
- ./aircard-ios.org/out:/out
|
||||
- ./aircard-ios.org/deploy.sh:/deploy.sh:ro
|
||||
- ./aircard-ios.org/webhook-server.js:/webhook/server.js:ro
|
||||
networks:
|
||||
- webklar-network
|
||||
command: /bin/sh -c "apk add --no-cache git && node /webhook/server.js"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.aircard-webhook.rule=Host(`aircard-ios.org`) && Path(`/webhook/deploy`)"
|
||||
- "traefik.http.routers.aircard-webhook.entrypoints=websecure"
|
||||
- "traefik.http.routers.aircard-webhook.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.aircard-webhook.priority=200"
|
||||
- "traefik.http.services.aircard-webhook.loadbalancer.server.port=8087"
|
||||
|
||||
aircard:
|
||||
image: nginx:alpine
|
||||
container_name: webklar-aircard
|
||||
restart: unless-stopped
|
||||
mem_limit: 64m
|
||||
volumes:
|
||||
- ./aircard-ios.org/out:/usr/share/nginx/html:ro
|
||||
- ./aircard-ios.org/nginx/aircard-ios.org.conf:/etc/nginx/conf.d/default.conf:ro
|
||||
networks:
|
||||
- webklar-network
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.aircard.rule=Host(`aircard-ios.org`)"
|
||||
- "traefik.http.routers.aircard.entrypoints=websecure"
|
||||
- "traefik.http.routers.aircard.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.aircard.loadbalancer.server.port=80"
|
||||
- "traefik.http.middlewares.aircard-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.aircard-https.redirectscheme.permanent=true"
|
||||
- "traefik.http.routers.aircard-http.rule=Host(`aircard-ios.org`)"
|
||||
- "traefik.http.routers.aircard-http.entrypoints=web"
|
||||
- "traefik.http.routers.aircard-http.middlewares=aircard-https"
|
||||
# --- www (Step 10): erst einkommentieren, wenn www.aircard-ios.org per DNS auf 91.99.156.85 zeigt.
|
||||
# Eigene Router, damit ein www-Fehler (Zertifikat) die Hauptdomain nicht blockiert.
|
||||
# `$$` ist das Escape für ein einzelnes `$` in docker compose; `\\.` ergibt im YAML ein `\.`.
|
||||
# - "traefik.http.routers.aircard-www.rule=Host(`www.aircard-ios.org`)"
|
||||
# - "traefik.http.routers.aircard-www.entrypoints=websecure"
|
||||
# - "traefik.http.routers.aircard-www.tls.certresolver=letsencrypt"
|
||||
# - "traefik.http.routers.aircard-www.middlewares=aircard-www"
|
||||
# - "traefik.http.routers.aircard-www-http.rule=Host(`www.aircard-ios.org`)"
|
||||
# - "traefik.http.routers.aircard-www-http.entrypoints=web"
|
||||
# - "traefik.http.routers.aircard-www-http.middlewares=aircard-www"
|
||||
# - "traefik.http.middlewares.aircard-www.redirectregex.regex=^https?://www\\.aircard-ios\\.org(.*)"
|
||||
# - "traefik.http.middlewares.aircard-www.redirectregex.replacement=https://aircard-ios.org$${1}"
|
||||
# - "traefik.http.middlewares.aircard-www.redirectregex.permanent=true"
|
||||
Executable
+133
@@ -0,0 +1,133 @@
|
||||
#!/bin/sh
|
||||
# AirCard-Deployment (läuft im Container webklar-aircard-build, node:22-alpine, POSIX sh).
|
||||
#
|
||||
# Ablauf: Repo klonen bzw. aktualisieren -> (bei poll/initial) überspringen, wenn dieser Commit
|
||||
# schon versucht wurde -> npm ci -> Build -> web/dist nach $OUT_DIR kopieren.
|
||||
#
|
||||
# Aufruf: durch webhook-server.js (DEPLOY_TRIGGER=initial|poll|webhook) oder von Hand:
|
||||
# docker exec webklar-aircard-build sh /deploy.sh
|
||||
#
|
||||
# Variablen (Standardwerte in Klammern):
|
||||
# REPO_DIR (/app) OUT_DIR (/out) GITEA_URL (https://git.webklar.com) GITEA_USER (knso)
|
||||
# GITEA_REPO (AirCardIOS) GITEA_TOKEN (leer = anonym) APP_SUBDIR (web) DEPLOY_BRANCH (main)
|
||||
# DEPLOY_TRIGGER (leer = manual)
|
||||
#
|
||||
# Fehlerzeilen beginnen mit "ERROR:"; der letzte Satz eines erfolgreichen Builds ist
|
||||
# "Deployment abgeschlossen".
|
||||
set -e
|
||||
|
||||
# Jeder Abbruch soll eine ERROR-Zeile hinterlassen, auch wenn set -e ihn auslöst.
|
||||
ERROR_PRINTED=""
|
||||
fail() {
|
||||
echo "ERROR: $*"
|
||||
ERROR_PRINTED=1
|
||||
exit 1
|
||||
}
|
||||
trap 'status=$?; if [ "${status}" -ne 0 ] && [ -z "${ERROR_PRINTED}" ]; then echo "ERROR: Deployment unerwartet abgebrochen (Exit-Code ${status})"; fi' EXIT
|
||||
|
||||
REPO_DIR="${REPO_DIR:-/app}"
|
||||
OUT_DIR="${OUT_DIR:-/out}"
|
||||
GITEA_URL="${GITEA_URL:-https://git.webklar.com}"
|
||||
GITEA_URL="${GITEA_URL%/}"
|
||||
GITEA_USER="${GITEA_USER:-knso}"
|
||||
GITEA_REPO="${GITEA_REPO:-AirCardIOS}"
|
||||
GITEA_TOKEN="${GITEA_TOKEN:-}"
|
||||
APP_SUBDIR="${APP_SUBDIR:-web}"
|
||||
DEPLOY_BRANCH="${DEPLOY_BRANCH:-main}"
|
||||
|
||||
# Clone-URL: mit Token nur, wenn GITEA_TOKEN gesetzt ist. Die URL mit Token wird nie ausgegeben.
|
||||
CLEAN_URL="${GITEA_URL}/${GITEA_USER}/${GITEA_REPO}.git"
|
||||
if [ -n "${GITEA_TOKEN}" ]; then
|
||||
case "${GITEA_URL}" in
|
||||
https://*) REPO_URL="https://${GITEA_TOKEN}@${GITEA_URL#https://}/${GITEA_USER}/${GITEA_REPO}.git" ;;
|
||||
http://*) REPO_URL="http://${GITEA_TOKEN}@${GITEA_URL#http://}/${GITEA_USER}/${GITEA_REPO}.git" ;;
|
||||
*) fail "GITEA_URL muss mit https:// oder http:// beginnen" ;;
|
||||
esac
|
||||
else
|
||||
REPO_URL="${CLEAN_URL}"
|
||||
fi
|
||||
|
||||
# git-Aufruf, dessen Ausgabe nie eine URL mit Zugangsdaten verrät (git zeigt sie in manchen Fehlermeldungen).
|
||||
run_git() {
|
||||
_git_log="$(mktemp)"
|
||||
if "$@" >"${_git_log}" 2>&1; then
|
||||
_git_rc=0
|
||||
else
|
||||
_git_rc=$?
|
||||
fi
|
||||
sed 's#//[^/@ ]*@#//***@#g' "${_git_log}"
|
||||
rm -f "${_git_log}"
|
||||
return "${_git_rc}"
|
||||
}
|
||||
|
||||
echo "=========================================="
|
||||
echo "AirCard Deployment (Trigger: ${DEPLOY_TRIGGER:-manual})"
|
||||
echo "=========================================="
|
||||
echo "Repository: ${GITEA_URL}/${GITEA_USER}/${GITEA_REPO} (Branch ${DEPLOY_BRANCH})"
|
||||
echo ""
|
||||
|
||||
mkdir -p "${REPO_DIR}" "${OUT_DIR}" || fail "Verzeichnisse ${REPO_DIR} und ${OUT_DIR} nicht anlegbar"
|
||||
|
||||
if [ ! -d "${REPO_DIR}/.git" ]; then
|
||||
echo "Klone Repository..."
|
||||
# Reste eines abgebrochenen Klons entfernen (inkl. versteckter Dateien); das Verzeichnis selbst ist ein Mount.
|
||||
rm -rf "${REPO_DIR}"/* "${REPO_DIR}"/.[!.]* "${REPO_DIR}"/..?*
|
||||
run_git git clone --quiet --branch "${DEPLOY_BRANCH}" "${REPO_URL}" "${REPO_DIR}" ||
|
||||
fail "Repository konnte nicht geklont werden"
|
||||
fi
|
||||
|
||||
cd "${REPO_DIR}" || fail "Verzeichnis ${REPO_DIR} nicht erreichbar"
|
||||
|
||||
echo "Aktualisiere Repository..."
|
||||
# Remote-URL bei jedem Lauf neu setzen, damit ein getauschtes Token greift.
|
||||
git remote set-url origin "${REPO_URL}" || fail "git remote set-url fehlgeschlagen"
|
||||
run_git git fetch --quiet origin "+refs/heads/${DEPLOY_BRANCH}:refs/remotes/origin/${DEPLOY_BRANCH}" ||
|
||||
fail "git fetch für Branch ${DEPLOY_BRANCH} fehlgeschlagen"
|
||||
# Token nur für clone/fetch: danach aus der Remote-URL entfernen, damit er nicht in .git/config liegen
|
||||
# bleibt (dort könnten ihn die Build-Skripte lesen).
|
||||
git remote set-url origin "${CLEAN_URL}" || fail "git remote set-url fehlgeschlagen"
|
||||
git reset --hard "origin/${DEPLOY_BRANCH}" >/dev/null || fail "git reset auf origin/${DEPLOY_BRANCH} fehlgeschlagen"
|
||||
git clean -fd >/dev/null || fail "git clean fehlgeschlagen"
|
||||
|
||||
CURRENT_COMMIT="$(git rev-parse HEAD)" || fail "git rev-parse HEAD fehlgeschlagen"
|
||||
echo "Commit: ${CURRENT_COMMIT}"
|
||||
|
||||
# Beim Neustart (initial) und beim Polling nur bauen, wenn es einen neuen Commit gibt.
|
||||
# Webhook-, manuelle und Aufrufe ohne Trigger bauen immer.
|
||||
MARKER="${REPO_DIR}/.git/aircard-last-deployed-commit"
|
||||
case "${DEPLOY_TRIGGER:-manual}" in
|
||||
poll | initial)
|
||||
if [ -f "${MARKER}" ] && [ "$(cat "${MARKER}")" = "${CURRENT_COMMIT}" ] && [ -f "${OUT_DIR}/index.html" ]; then
|
||||
echo "Commit ${CURRENT_COMMIT} unverändert, Build übersprungen."
|
||||
exit 0
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
# Gemerkt wird der zuletzt VERSUCHTE Commit (vor dem Build): ein kaputter Build wird nicht alle
|
||||
# 15 Minuten wiederholt, und die alte Seite bleibt online.
|
||||
echo "${CURRENT_COMMIT}" >"${MARKER}" || fail "Marker ${MARKER} nicht schreibbar"
|
||||
|
||||
[ -d "${REPO_DIR}/${APP_SUBDIR}" ] || fail "Ordner ${APP_SUBDIR} fehlt im Repository"
|
||||
cd "${REPO_DIR}/${APP_SUBDIR}"
|
||||
|
||||
# Zugangsdaten nicht an npm und die Build-Skripte weiterreichen.
|
||||
unset GITEA_TOKEN REPO_URL
|
||||
|
||||
echo ""
|
||||
echo "Installiere Abhängigkeiten..."
|
||||
npm ci --no-audit --no-fund || fail "npm ci fehlgeschlagen"
|
||||
|
||||
echo ""
|
||||
echo "Baue die Seite..."
|
||||
# VITE_*-Variablen kommen direkt aus der Container-Umgebung (compose).
|
||||
rm -rf dist
|
||||
npm run build || fail "Build fehlgeschlagen"
|
||||
[ -f dist/index.html ] || fail "dist/index.html fehlt nach dem Build"
|
||||
|
||||
echo ""
|
||||
echo "Kopiere nach ${OUT_DIR}..."
|
||||
rm -rf "${OUT_DIR}"/* "${OUT_DIR}"/.[!.]* "${OUT_DIR}"/..?*
|
||||
cp -r dist/. "${OUT_DIR}/" || fail "Kopieren nach ${OUT_DIR} fehlgeschlagen"
|
||||
|
||||
echo "Deployment abgeschlossen"
|
||||
@@ -0,0 +1,66 @@
|
||||
# nginx für aircard-ios.org (Container webklar-aircard, nginx:alpine; wird nach
|
||||
# /etc/nginx/conf.d/default.conf gemountet). Ausgeliefert wird die statische Seite aus
|
||||
# /usr/share/nginx/html (= out/ des Build-Containers). TLS macht Traefik davor.
|
||||
#
|
||||
# Wichtig: In den location-Blöcken kein add_header verwenden - sonst entfallen die
|
||||
# Sicherheits-Header vom server-Block. "expires" ist davon nicht betroffen.
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
|
||||
root /usr/share/nginx/html;
|
||||
index index.html;
|
||||
|
||||
# Sicherheits-Header (alle Antworten, auch Fehler)
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_min_length 1024;
|
||||
gzip_comp_level 6;
|
||||
gzip_types
|
||||
text/plain
|
||||
text/css
|
||||
text/xml
|
||||
text/javascript
|
||||
application/javascript
|
||||
application/json
|
||||
application/manifest+json
|
||||
application/xml
|
||||
image/svg+xml;
|
||||
|
||||
# Gehashte Build-Dateien: ein Jahr, nie auf index.html zurückfallen.
|
||||
location ^~ /assets/ {
|
||||
try_files $uri =404;
|
||||
expires 1y;
|
||||
access_log off;
|
||||
}
|
||||
|
||||
# Die Appwrite-API liegt nur über Traefik (Header X-Appwrite-Project) auf /v1.
|
||||
# Ohne diesen Header darf nginx hier nie die App (index.html) ausliefern.
|
||||
location ^~ /v1/ {
|
||||
return 404;
|
||||
}
|
||||
|
||||
location = /index.html {
|
||||
expires -1;
|
||||
}
|
||||
|
||||
# Versteckte Dateien sperren (außer /.well-known). Steht vor den Regex-Blöcken
|
||||
# darunter, damit z. B. /.git/x.png nicht als Bild durchgeht.
|
||||
location ~ /\.(?!well-known) {
|
||||
deny all;
|
||||
}
|
||||
|
||||
location ~* \.(?:png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf)$ {
|
||||
expires 7d;
|
||||
}
|
||||
|
||||
# Single-Page-App: alle anderen Pfade (/karten, /editor ...) liefern index.html.
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
expires -1;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
# Appwrite-Route für aircard-ios.org (Projekt "aircard" auf der bestehenden Appwrite-Instanz).
|
||||
#
|
||||
# Das Frontend ruft https://aircard-ios.org/v1/... auf und sendet den Header
|
||||
# X-Appwrite-Project: aircard. Nur Anfragen MIT diesem Header gehen an Appwrite; alles andere
|
||||
# unter /v1 (z. B. ein <img src> oder ein Aufruf ohne Header) landet beim nginx der Seite und
|
||||
# bekommt dort 404.
|
||||
#
|
||||
# Priorität 150 liegt über dem Seiten-Router (Host-Regel, Label-Router `aircard`) und unter
|
||||
# dem Webhook-Router (200). Der Service `appwrite@docker` stammt aus dem Appwrite-Container;
|
||||
# an diesem Container wird nichts geändert.
|
||||
#
|
||||
# Wird per Datei-Provider geladen (Hot-Reload). Additiv + reversibel: Datei löschen entfernt die Route.
|
||||
http:
|
||||
routers:
|
||||
aircard-api:
|
||||
rule: "Host(`aircard-ios.org`) && PathPrefix(`/v1`) && Header(`X-Appwrite-Project`, `aircard`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: appwrite@docker
|
||||
priority: 150
|
||||
tls:
|
||||
certResolver: letsencrypt
|
||||
@@ -0,0 +1,233 @@
|
||||
'use strict';
|
||||
|
||||
/**
|
||||
* Deploy-Webhook für aircard-ios.org (Node 22, nur Bordmittel).
|
||||
*
|
||||
* POST /webhook/deploy Gitea-Push-Webhook; Signatur im Header x-gitea-signature
|
||||
* (HMAC-SHA256 über den Rohbody, Hex ohne Präfix).
|
||||
* 401 Signatur fehlt oder stimmt nicht
|
||||
* 413 Body größer als 1 MB
|
||||
* 200 {"ignored":true} Push auf einen anderen Branch (oder ohne Branch)
|
||||
* 202 {"queued":true} Push auf den Deploy-Branch; der Build läuft im Hintergrund
|
||||
* alles andere 404
|
||||
*
|
||||
* Builds laufen nacheinander: höchstens ein laufender und ein wartender Lauf. Weitere
|
||||
* Anfragen während ein Lauf wartet, werden mit 202 beantwortet, fügen aber keinen
|
||||
* Lauf hinzu (der wartende Lauf holt ohnehin den neuesten Stand).
|
||||
*
|
||||
* Umgebung (nur beim Start als Programm): AIRCARD_WEBHOOK_TOKEN (Pflicht, sonst Exit 1),
|
||||
* AIRCARD_WEBHOOK_PORT (8087), AIRCARD_DEPLOY_BRANCH (main), AIRCARD_DEPLOY_SCRIPT
|
||||
* (/deploy.sh), POLL_INTERVAL_MINUTES (15; 0 schaltet das Polling ab).
|
||||
*/
|
||||
|
||||
const http = require('node:http');
|
||||
const crypto = require('node:crypto');
|
||||
const { spawn } = require('node:child_process');
|
||||
|
||||
const MAX_BODY_BYTES = 1024 * 1024;
|
||||
const WEBHOOK_PATH = '/webhook/deploy';
|
||||
const BRANCH_PREFIX = 'refs/heads/';
|
||||
|
||||
/**
|
||||
* Prüft die Gitea-Signatur: kleingeschriebenes Hex von HMAC-SHA256 über den Rohbody.
|
||||
* false bei leerem Secret, fehlender oder unpassend langer Signatur.
|
||||
*/
|
||||
function verifySignature(raw, signatureHex, secret) {
|
||||
if (typeof secret !== 'string' || secret === '') return false;
|
||||
if (typeof signatureHex !== 'string' || signatureHex === '') return false;
|
||||
if (!Buffer.isBuffer(raw)) return false;
|
||||
|
||||
const expected = Buffer.from(crypto.createHmac('sha256', secret).update(raw).digest('hex'));
|
||||
const given = Buffer.from(signatureHex);
|
||||
// timingSafeEqual wirft bei ungleicher Länge, deshalb vorher prüfen.
|
||||
if (given.length !== expected.length) return false;
|
||||
return crypto.timingSafeEqual(given, expected);
|
||||
}
|
||||
|
||||
/** `refs/heads/<x>` -> `<x>`, alles andere -> null. */
|
||||
function branchFromPayload(body) {
|
||||
if (body === null || typeof body !== 'object') return null;
|
||||
const ref = body.ref;
|
||||
if (typeof ref !== 'string' || !ref.startsWith(BRANCH_PREFIX)) return null;
|
||||
const branch = ref.slice(BRANCH_PREFIX.length);
|
||||
return branch === '' ? null : branch;
|
||||
}
|
||||
|
||||
/**
|
||||
* Baut den HTTP-Server (ohne ihn zu starten).
|
||||
*
|
||||
* @param {object} options
|
||||
* @param {string} options.secret Webhook-Secret; leer -> jede Anfrage bekommt 401
|
||||
* @param {string} [options.branch] Deploy-Branch (Standard: main)
|
||||
* @param {(trigger: string) => Promise<void>} options.runDeploy führt einen Lauf aus
|
||||
* @param {(line: string) => void} [options.log] bekommt fertige Zeilen, die mit [webhook] beginnen
|
||||
* @returns {http.Server} mit zusätzlicher Methode `enqueueDeploy(trigger)` für initial/poll-Läufe
|
||||
* über dieselbe Warteschlange
|
||||
*/
|
||||
function createServer({ secret, branch = 'main', runDeploy, log = console.log }) {
|
||||
const say = (message) => log(`[webhook] ${new Date().toISOString()} ${message}`);
|
||||
|
||||
// Warteschlange: ein laufender Lauf + ein Platz für einen wartenden Lauf.
|
||||
let running = false;
|
||||
let pending = null; // Trigger des wartenden Laufs oder null
|
||||
|
||||
async function drain() {
|
||||
if (running) return;
|
||||
running = true;
|
||||
try {
|
||||
while (pending !== null) {
|
||||
const trigger = pending;
|
||||
pending = null;
|
||||
say(`starting deployment (trigger=${trigger})`);
|
||||
try {
|
||||
await runDeploy(trigger);
|
||||
say(`deployment finished (trigger=${trigger})`);
|
||||
} catch (err) {
|
||||
say(`deployment failed (trigger=${trigger}): ${err && err.message ? err.message : err}`);
|
||||
}
|
||||
}
|
||||
} finally {
|
||||
running = false;
|
||||
}
|
||||
}
|
||||
|
||||
/** @returns {boolean} true, wenn ein neuer Lauf vorgemerkt wurde; false, wenn schon einer wartet */
|
||||
function enqueueDeploy(trigger) {
|
||||
if (pending !== null) {
|
||||
// Der Webhook baut immer, ein Poll darf überspringen: der wartende Lauf behält den stärkeren Trigger.
|
||||
if (trigger === 'webhook') pending = 'webhook';
|
||||
return false;
|
||||
}
|
||||
pending = trigger;
|
||||
drain();
|
||||
return true;
|
||||
}
|
||||
|
||||
function sendJson(res, status, payload) {
|
||||
const body = JSON.stringify(payload);
|
||||
res.writeHead(status, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) });
|
||||
res.end(body);
|
||||
}
|
||||
|
||||
function handleWebhook(req, res) {
|
||||
const chunks = [];
|
||||
let size = 0;
|
||||
let tooLarge = false;
|
||||
|
||||
req.on('data', (chunk) => {
|
||||
if (tooLarge) return; // Rest verwerfen, die Verbindung bleibt sauber
|
||||
size += chunk.length;
|
||||
if (size > MAX_BODY_BYTES) {
|
||||
tooLarge = true;
|
||||
chunks.length = 0;
|
||||
say('rejected request: body too large');
|
||||
sendJson(res, 413, { error: 'payload too large' });
|
||||
return;
|
||||
}
|
||||
chunks.push(chunk);
|
||||
});
|
||||
|
||||
req.on('error', (err) => say(`request error: ${err.message}`));
|
||||
|
||||
req.on('end', () => {
|
||||
if (tooLarge) return;
|
||||
const raw = Buffer.concat(chunks);
|
||||
|
||||
if (!verifySignature(raw, req.headers['x-gitea-signature'], secret)) {
|
||||
say('rejected request: invalid signature');
|
||||
sendJson(res, 401, { error: 'invalid signature' });
|
||||
return;
|
||||
}
|
||||
|
||||
let pushedBranch = null;
|
||||
try {
|
||||
pushedBranch = branchFromPayload(JSON.parse(raw.toString('utf8')));
|
||||
} catch {
|
||||
// kein JSON: wie ein Push ohne Branch behandeln
|
||||
}
|
||||
|
||||
if (pushedBranch !== branch) {
|
||||
say(`ignoring push to ${pushedBranch === null ? 'unknown ref' : pushedBranch} (only ${branch} deploys)`);
|
||||
sendJson(res, 200, { ignored: true });
|
||||
return;
|
||||
}
|
||||
|
||||
// Sofort antworten: Gitea wartet nur wenige Sekunden, der Build dauert Minuten.
|
||||
const queued = enqueueDeploy('webhook');
|
||||
say(queued ? `push to ${branch} queued` : `push to ${branch} accepted, a deployment is already waiting`);
|
||||
sendJson(res, 202, { queued: true });
|
||||
});
|
||||
}
|
||||
|
||||
const server = http.createServer((req, res) => {
|
||||
const pathname = (req.url || '').split('?')[0];
|
||||
if (req.method === 'POST' && pathname === WEBHOOK_PATH) {
|
||||
handleWebhook(req, res);
|
||||
return;
|
||||
}
|
||||
sendJson(res, 404, { error: 'not found' });
|
||||
});
|
||||
|
||||
server.enqueueDeploy = enqueueDeploy;
|
||||
return server;
|
||||
}
|
||||
|
||||
// ---- Start als Programm -----------------------------------------------------
|
||||
|
||||
/**
|
||||
* Startet `sh <script>` mit DEPLOY_TRIGGER; erfolgreich bei Exit-Code 0, sonst Ablehnung.
|
||||
* Das Webhook-Secret bekommt das Skript nicht (npm und die Build-Skripte laufen darunter).
|
||||
*/
|
||||
function spawnDeploy(script, trigger) {
|
||||
return new Promise((resolve, reject) => {
|
||||
const env = { ...process.env, DEPLOY_TRIGGER: trigger };
|
||||
delete env.AIRCARD_WEBHOOK_TOKEN;
|
||||
const child = spawn('sh', [script], { stdio: 'inherit', env });
|
||||
child.once('error', reject);
|
||||
child.once('exit', (code, signal) => {
|
||||
if (code === 0) resolve();
|
||||
else reject(new Error(`deploy exited with ${code === null ? `signal ${signal}` : `code ${code}`}`));
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
function integerFromEnv(name, fallback, { min }) {
|
||||
const raw = process.env[name];
|
||||
if (raw === undefined || raw.trim() === '') return fallback;
|
||||
const value = Number.parseInt(raw, 10);
|
||||
return Number.isInteger(value) && value >= min ? value : fallback;
|
||||
}
|
||||
|
||||
function main() {
|
||||
const secret = process.env.AIRCARD_WEBHOOK_TOKEN || '';
|
||||
if (secret.trim() === '') {
|
||||
console.error('[webhook] AIRCARD_WEBHOOK_TOKEN ist nicht gesetzt - Abbruch (ohne Secret wird kein Webhook angeboten)');
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
const port = integerFromEnv('AIRCARD_WEBHOOK_PORT', 8087, { min: 1 });
|
||||
const branch = process.env.AIRCARD_DEPLOY_BRANCH || 'main';
|
||||
const script = process.env.AIRCARD_DEPLOY_SCRIPT || '/deploy.sh';
|
||||
const pollMinutes = integerFromEnv('POLL_INTERVAL_MINUTES', 15, { min: 0 });
|
||||
|
||||
const server = createServer({
|
||||
secret,
|
||||
branch,
|
||||
runDeploy: (trigger) => spawnDeploy(script, trigger),
|
||||
});
|
||||
|
||||
server.listen(port, () => {
|
||||
console.log(`[webhook] ${new Date().toISOString()} listening on :${port} (branch ${branch})`);
|
||||
server.enqueueDeploy('initial');
|
||||
if (pollMinutes > 0) {
|
||||
console.log(`[webhook] ${new Date().toISOString()} periodic check enabled: every ${pollMinutes} minutes`);
|
||||
setInterval(() => server.enqueueDeploy('poll'), pollMinutes * 60 * 1000);
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
module.exports = { verifySignature, branchFromPayload, createServer };
|
||||
|
||||
if (require.main === module) {
|
||||
main();
|
||||
}
|
||||
@@ -0,0 +1,451 @@
|
||||
'use strict';
|
||||
|
||||
// Tests für deploy/webhook-server.js. Aufruf: node --test deploy/webhook-server.test.js
|
||||
// Nur Node-Bordmittel; die Server laufen auf Port 0 und werden nach jedem Test geschlossen.
|
||||
|
||||
const { test, afterEach } = require('node:test');
|
||||
const assert = require('node:assert/strict');
|
||||
const crypto = require('node:crypto');
|
||||
const http = require('node:http');
|
||||
const net = require('node:net');
|
||||
const fs = require('node:fs');
|
||||
const os = require('node:os');
|
||||
const path = require('node:path');
|
||||
const { spawn } = require('node:child_process');
|
||||
|
||||
const { verifySignature, branchFromPayload, createServer } = require('./webhook-server.js');
|
||||
|
||||
const SECRET = 'test-secret-0123456789abcdef-test-secret-0123456789abcdef';
|
||||
|
||||
function sign(raw, secret = SECRET) {
|
||||
return crypto.createHmac('sha256', secret).update(raw).digest('hex');
|
||||
}
|
||||
|
||||
function pushBody(ref) {
|
||||
return Buffer.from(JSON.stringify({ ref, after: '0123456789abcdef0123456789abcdef01234567' }));
|
||||
}
|
||||
|
||||
async function waitFor(condition, what, timeoutMs = 3000) {
|
||||
const deadline = Date.now() + timeoutMs;
|
||||
while (!condition()) {
|
||||
if (Date.now() > deadline) throw new Error(`Zeitüberschreitung beim Warten auf: ${what}`);
|
||||
await new Promise((resolve) => setTimeout(resolve, 10));
|
||||
}
|
||||
}
|
||||
|
||||
const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
|
||||
|
||||
// ---- Aufräumen -------------------------------------------------------------
|
||||
|
||||
const servers = [];
|
||||
const children = [];
|
||||
const tmpDirs = [];
|
||||
|
||||
afterEach(async () => {
|
||||
for (const child of children.splice(0)) {
|
||||
if (child.exitCode === null && child.signalCode === null) {
|
||||
child.kill('SIGKILL');
|
||||
await new Promise((resolve) => child.once('exit', resolve));
|
||||
}
|
||||
}
|
||||
for (const server of servers.splice(0)) {
|
||||
server.closeAllConnections();
|
||||
await new Promise((resolve) => server.close(resolve));
|
||||
}
|
||||
for (const dir of tmpDirs.splice(0)) {
|
||||
fs.rmSync(dir, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
// ---- Hilfen für Server-Tests -----------------------------------------------
|
||||
|
||||
/** Startet createServer() auf Port 0. runDeploy-Aufrufe werden in `calls` gesammelt. */
|
||||
async function startServer(overrides = {}) {
|
||||
const calls = [];
|
||||
const logs = [];
|
||||
const options = {
|
||||
secret: SECRET,
|
||||
branch: 'main',
|
||||
runDeploy: async (trigger) => {
|
||||
calls.push(trigger);
|
||||
},
|
||||
log: (line) => logs.push(line),
|
||||
...overrides,
|
||||
};
|
||||
const server = createServer(options);
|
||||
servers.push(server);
|
||||
await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
|
||||
return { server, port: server.address().port, calls, logs };
|
||||
}
|
||||
|
||||
/** Ein runDeploy, das so lange blockiert, bis der Test den Lauf freigibt. */
|
||||
function blockedDeploy() {
|
||||
const calls = [];
|
||||
const releases = [];
|
||||
const runDeploy = (trigger) => {
|
||||
calls.push(trigger);
|
||||
return new Promise((resolve) => releases.push(resolve));
|
||||
};
|
||||
return { calls, releases, runDeploy };
|
||||
}
|
||||
|
||||
function request(port, { method = 'POST', path: urlPath = '/webhook/deploy', headers = {}, body } = {}) {
|
||||
return new Promise((resolve, reject) => {
|
||||
const req = http.request({ host: '127.0.0.1', port, method, path: urlPath, headers }, (res) => {
|
||||
const chunks = [];
|
||||
res.on('data', (chunk) => chunks.push(chunk));
|
||||
res.on('end', () => {
|
||||
const text = Buffer.concat(chunks).toString('utf8');
|
||||
let json = null;
|
||||
try {
|
||||
json = JSON.parse(text);
|
||||
} catch {
|
||||
// kein JSON
|
||||
}
|
||||
resolve({ status: res.statusCode, headers: res.headers, text, json });
|
||||
});
|
||||
});
|
||||
req.on('error', reject);
|
||||
if (body) req.write(body);
|
||||
req.end();
|
||||
});
|
||||
}
|
||||
|
||||
function signedPush(port, ref, secret = SECRET) {
|
||||
const body = pushBody(ref);
|
||||
return request(port, {
|
||||
headers: { 'content-type': 'application/json', 'x-gitea-signature': sign(body, secret) },
|
||||
body,
|
||||
});
|
||||
}
|
||||
|
||||
// ---- verifySignature --------------------------------------------------------
|
||||
|
||||
test('verifySignature: gültige Signatur wird akzeptiert', () => {
|
||||
const raw = Buffer.from('{"ref":"refs/heads/main"}');
|
||||
assert.equal(verifySignature(raw, sign(raw), SECRET), true);
|
||||
});
|
||||
|
||||
test('verifySignature: falscher Rohbody oder falsches Secret wird abgelehnt', () => {
|
||||
const raw = Buffer.from('{"ref":"refs/heads/main"}');
|
||||
assert.equal(verifySignature(Buffer.from('{"ref":"refs/heads/dev"}'), sign(raw), SECRET), false);
|
||||
assert.equal(verifySignature(raw, sign(raw, 'anderes-secret'), SECRET), false);
|
||||
assert.equal(verifySignature(raw, sign(raw), 'anderes-secret'), false);
|
||||
});
|
||||
|
||||
test('verifySignature: ungültige oder unpassend lange Signaturen liefern false ohne Exception', () => {
|
||||
const raw = Buffer.from('{}');
|
||||
const valid = sign(raw);
|
||||
assert.equal(verifySignature(raw, 'deadbeef', SECRET), false);
|
||||
assert.equal(verifySignature(raw, valid.slice(0, -1), SECRET), false);
|
||||
assert.equal(verifySignature(raw, `${valid}00`, SECRET), false);
|
||||
assert.equal(verifySignature(raw, 'z'.repeat(valid.length), SECRET), false);
|
||||
assert.equal(verifySignature(raw, `sha256=${valid}`, SECRET), false);
|
||||
});
|
||||
|
||||
test('verifySignature: leeres Secret ist immer false', () => {
|
||||
const raw = Buffer.from('{}');
|
||||
assert.equal(verifySignature(raw, sign(raw, ''), ''), false);
|
||||
assert.equal(verifySignature(raw, sign(raw), ''), false);
|
||||
assert.equal(verifySignature(raw, sign(raw), undefined), false);
|
||||
});
|
||||
|
||||
test('verifySignature: fehlender Header ist false', () => {
|
||||
const raw = Buffer.from('{}');
|
||||
assert.equal(verifySignature(raw, undefined, SECRET), false);
|
||||
assert.equal(verifySignature(raw, '', SECRET), false);
|
||||
});
|
||||
|
||||
// ---- branchFromPayload ------------------------------------------------------
|
||||
|
||||
test('branchFromPayload: refs/heads/<x> ergibt <x>', () => {
|
||||
assert.equal(branchFromPayload({ ref: 'refs/heads/main' }), 'main');
|
||||
assert.equal(branchFromPayload({ ref: 'refs/heads/feature/neu' }), 'feature/neu');
|
||||
});
|
||||
|
||||
test('branchFromPayload: alles andere ergibt null', () => {
|
||||
assert.equal(branchFromPayload({}), null);
|
||||
assert.equal(branchFromPayload(null), null);
|
||||
assert.equal(branchFromPayload('refs/heads/main'), null);
|
||||
assert.equal(branchFromPayload({ ref: 42 }), null);
|
||||
assert.equal(branchFromPayload({ ref: 'refs/tags/v1' }), null);
|
||||
assert.equal(branchFromPayload({ ref: 'refs/heads/' }), null);
|
||||
});
|
||||
|
||||
// ---- Server -----------------------------------------------------------------
|
||||
|
||||
test('Server: unsignierter POST ergibt 401 und startet keinen Lauf', async () => {
|
||||
const { port, calls } = await startServer();
|
||||
const res = await request(port, {
|
||||
headers: { 'content-type': 'application/json' },
|
||||
body: pushBody('refs/heads/main'),
|
||||
});
|
||||
assert.equal(res.status, 401);
|
||||
await pause(20);
|
||||
assert.deepEqual(calls, []);
|
||||
});
|
||||
|
||||
test('Server: POST mit falscher Signatur ergibt 401', async () => {
|
||||
const { port, calls } = await startServer();
|
||||
const res = await signedPush(port, 'refs/heads/main', 'falsches-secret');
|
||||
assert.equal(res.status, 401);
|
||||
assert.deepEqual(calls, []);
|
||||
});
|
||||
|
||||
test('Server: Signatur nur im Header x-gitea-signature, keine Fallbacks', async () => {
|
||||
const { port, calls } = await startServer();
|
||||
const body = pushBody('refs/heads/main');
|
||||
const res = await request(port, {
|
||||
headers: {
|
||||
'x-hub-signature-256': `sha256=${sign(body)}`,
|
||||
'x-hub-signature': `sha256=${sign(body)}`,
|
||||
'x-gitea-token': SECRET,
|
||||
},
|
||||
body,
|
||||
});
|
||||
assert.equal(res.status, 401);
|
||||
assert.deepEqual(calls, []);
|
||||
});
|
||||
|
||||
test('Server: leeres Secret lehnt jeden Push ab', async () => {
|
||||
const { port, calls } = await startServer({ secret: '' });
|
||||
const body = pushBody('refs/heads/main');
|
||||
const res = await request(port, { headers: { 'x-gitea-signature': sign(body, '') }, body });
|
||||
assert.equal(res.status, 401);
|
||||
assert.deepEqual(calls, []);
|
||||
});
|
||||
|
||||
test('Server: signierter Push auf main ergibt 202 und runDeploy("webhook")', async () => {
|
||||
const { port, calls } = await startServer();
|
||||
const res = await signedPush(port, 'refs/heads/main');
|
||||
assert.equal(res.status, 202);
|
||||
assert.deepEqual(res.json, { queued: true });
|
||||
await waitFor(() => calls.length === 1, 'runDeploy');
|
||||
assert.deepEqual(calls, ['webhook']);
|
||||
});
|
||||
|
||||
test('Server: Push auf einen anderen Branch wird mit 200 ignoriert', async () => {
|
||||
const { port, calls } = await startServer();
|
||||
const res = await signedPush(port, 'refs/heads/dev');
|
||||
assert.equal(res.status, 200);
|
||||
assert.deepEqual(res.json, { ignored: true });
|
||||
await pause(20);
|
||||
assert.deepEqual(calls, []);
|
||||
});
|
||||
|
||||
test('Server: Tag-Push und Body ohne Branch werden mit 200 ignoriert', async () => {
|
||||
const { port, calls } = await startServer();
|
||||
assert.deepEqual((await signedPush(port, 'refs/tags/v1')).json, { ignored: true });
|
||||
|
||||
const notJson = Buffer.from('das ist kein JSON');
|
||||
const res = await request(port, { headers: { 'x-gitea-signature': sign(notJson) }, body: notJson });
|
||||
assert.equal(res.status, 200);
|
||||
assert.deepEqual(res.json, { ignored: true });
|
||||
assert.deepEqual(calls, []);
|
||||
});
|
||||
|
||||
test('Server: alles andere ergibt 404', async () => {
|
||||
const { port, calls } = await startServer();
|
||||
assert.equal((await request(port, { method: 'GET', path: '/' })).status, 404);
|
||||
assert.equal((await request(port, { method: 'GET', path: '/webhook/deploy' })).status, 404);
|
||||
assert.equal((await request(port, { method: 'POST', path: '/' })).status, 404);
|
||||
assert.equal((await request(port, { method: 'POST', path: '/webhook/deploy/x' })).status, 404);
|
||||
assert.equal((await request(port, { method: 'GET', path: '/healthz' })).status, 404);
|
||||
assert.deepEqual(calls, []);
|
||||
});
|
||||
|
||||
test('Server: zu großer Body ergibt 413 und startet keinen Lauf', async () => {
|
||||
const { port, calls } = await startServer();
|
||||
const body = Buffer.alloc(1024 * 1024 + 1, 'a');
|
||||
const res = await request(port, { headers: { 'x-gitea-signature': sign(body) }, body });
|
||||
assert.equal(res.status, 413);
|
||||
await pause(20);
|
||||
assert.deepEqual(calls, []);
|
||||
});
|
||||
|
||||
test('Server: drei schnelle Pushes bei blockiertem runDeploy -> alle 202, danach genau 2 Läufe', async () => {
|
||||
const deploy = blockedDeploy();
|
||||
const { port } = await startServer({ runDeploy: deploy.runDeploy });
|
||||
|
||||
const first = await signedPush(port, 'refs/heads/main');
|
||||
const second = await signedPush(port, 'refs/heads/main');
|
||||
const third = await signedPush(port, 'refs/heads/main');
|
||||
assert.deepEqual([first.status, second.status, third.status], [202, 202, 202]);
|
||||
assert.deepEqual([first.json, second.json, third.json], [{ queued: true }, { queued: true }, { queued: true }]);
|
||||
|
||||
// Solange der erste Lauf hängt, startet kein zweiter (nacheinander, nie parallel).
|
||||
await pause(50);
|
||||
assert.equal(deploy.calls.length, 1);
|
||||
|
||||
deploy.releases[0]();
|
||||
await waitFor(() => deploy.calls.length === 2, 'zweiter Lauf');
|
||||
deploy.releases[1]();
|
||||
await pause(50);
|
||||
assert.deepEqual(deploy.calls, ['webhook', 'webhook']);
|
||||
assert.equal(deploy.releases.length, 2);
|
||||
});
|
||||
|
||||
test('Server: ein Push nach Ende aller Läufe startet wieder einen Lauf', async () => {
|
||||
const deploy = blockedDeploy();
|
||||
const { port } = await startServer({ runDeploy: deploy.runDeploy });
|
||||
|
||||
await signedPush(port, 'refs/heads/main');
|
||||
deploy.releases[0]();
|
||||
await pause(30);
|
||||
await signedPush(port, 'refs/heads/main');
|
||||
await waitFor(() => deploy.calls.length === 2, 'zweiter Lauf');
|
||||
deploy.releases[1]();
|
||||
await pause(30);
|
||||
assert.deepEqual(deploy.calls, ['webhook', 'webhook']);
|
||||
});
|
||||
|
||||
test('Server: ein fehlgeschlagener Lauf wird protokolliert, der Server läuft weiter', async () => {
|
||||
const calls = [];
|
||||
const { port, logs } = await startServer({
|
||||
runDeploy: async (trigger) => {
|
||||
calls.push(trigger);
|
||||
throw new Error('deploy exited with code 1');
|
||||
},
|
||||
});
|
||||
|
||||
assert.equal((await signedPush(port, 'refs/heads/main')).status, 202);
|
||||
await waitFor(() => logs.some((line) => line.includes('deploy exited with code 1')), 'Fehlerzeile im Log');
|
||||
|
||||
assert.equal((await signedPush(port, 'refs/heads/main')).status, 202);
|
||||
await waitFor(() => calls.length === 2, 'zweiter Lauf nach Fehler');
|
||||
});
|
||||
|
||||
test('Server: synchron werfendes runDeploy bringt den Server nicht zum Absturz', async () => {
|
||||
const calls = [];
|
||||
const { port } = await startServer({
|
||||
runDeploy: () => {
|
||||
calls.push('x');
|
||||
throw new Error('kaputt');
|
||||
},
|
||||
});
|
||||
assert.equal((await signedPush(port, 'refs/heads/main')).status, 202);
|
||||
await waitFor(() => calls.length === 1, 'Lauf');
|
||||
assert.equal((await signedPush(port, 'refs/heads/main')).status, 202);
|
||||
await waitFor(() => calls.length === 2, 'zweiter Lauf');
|
||||
});
|
||||
|
||||
test('Server: enqueueDeploy teilt die Warteschlange; ein wartender poll wird vom Webhook überholt', async () => {
|
||||
const deploy = blockedDeploy();
|
||||
const { server, port } = await startServer({ runDeploy: deploy.runDeploy });
|
||||
|
||||
server.enqueueDeploy('initial');
|
||||
server.enqueueDeploy('poll'); // wartet
|
||||
const res = await signedPush(port, 'refs/heads/main');
|
||||
assert.equal(res.status, 202);
|
||||
await pause(30);
|
||||
assert.deepEqual(deploy.calls, ['initial']);
|
||||
|
||||
deploy.releases[0]();
|
||||
await waitFor(() => deploy.calls.length === 2, 'zweiter Lauf');
|
||||
deploy.releases[1]();
|
||||
await pause(30);
|
||||
// Der Webhook baut immer; deshalb darf der wartende Lauf kein überspringbarer "poll" bleiben.
|
||||
assert.deepEqual(deploy.calls, ['initial', 'webhook']);
|
||||
});
|
||||
|
||||
test('Server: Logzeilen beginnen mit [webhook] und enthalten weder Secret noch Signatur', async () => {
|
||||
const { port, logs } = await startServer();
|
||||
const body = pushBody('refs/heads/main');
|
||||
const signature = sign(body);
|
||||
await request(port, { headers: { 'x-gitea-signature': signature }, body });
|
||||
await request(port, { headers: { 'x-gitea-signature': 'deadbeef' }, body });
|
||||
await signedPush(port, 'refs/heads/dev');
|
||||
await pause(30);
|
||||
|
||||
assert.ok(logs.length >= 3, `zu wenige Logzeilen: ${logs.length}`);
|
||||
for (const line of logs) {
|
||||
assert.ok(line.startsWith('[webhook]'), `Zeile beginnt nicht mit [webhook]: ${line}`);
|
||||
assert.ok(!line.includes(SECRET), 'Secret im Log');
|
||||
assert.ok(!line.includes(signature), 'Signatur im Log');
|
||||
}
|
||||
});
|
||||
|
||||
// ---- Start als Programm (require.main === module) ---------------------------
|
||||
|
||||
const SERVER_JS = path.join(__dirname, 'webhook-server.js');
|
||||
|
||||
function freePort() {
|
||||
return new Promise((resolve, reject) => {
|
||||
const probe = net.createServer();
|
||||
probe.once('error', reject);
|
||||
probe.listen(0, '127.0.0.1', () => {
|
||||
const { port } = probe.address();
|
||||
probe.close(() => resolve(port));
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
function makeTmpDir() {
|
||||
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'aircard-webhook-'));
|
||||
tmpDirs.push(dir);
|
||||
return dir;
|
||||
}
|
||||
|
||||
function startProgram(env) {
|
||||
const child = spawn(process.execPath, [SERVER_JS], {
|
||||
env: { PATH: process.env.PATH, ...env },
|
||||
stdio: ['ignore', 'pipe', 'pipe'],
|
||||
});
|
||||
children.push(child);
|
||||
const output = { text: '' };
|
||||
child.stdout.on('data', (chunk) => (output.text += chunk));
|
||||
child.stderr.on('data', (chunk) => (output.text += chunk));
|
||||
return { child, output };
|
||||
}
|
||||
|
||||
test('Start ohne AIRCARD_WEBHOOK_TOKEN: Fehlermeldung ohne Wert, Exit-Code 1', async () => {
|
||||
for (const env of [{}, { AIRCARD_WEBHOOK_TOKEN: '' }]) {
|
||||
const { child, output } = startProgram({ ...env, AIRCARD_WEBHOOK_PORT: String(await freePort()) });
|
||||
const code = await new Promise((resolve) => child.once('exit', resolve));
|
||||
assert.equal(code, 1);
|
||||
assert.match(output.text, /AIRCARD_WEBHOOK_TOKEN/);
|
||||
}
|
||||
});
|
||||
|
||||
test('Start: initial-Lauf, Webhook-Lauf mit DEPLOY_TRIGGER und weiterlaufender Server nach Fehlschlag', async () => {
|
||||
const dir = makeTmpDir();
|
||||
const record = path.join(dir, 'triggers.txt');
|
||||
const script = path.join(dir, 'deploy.sh');
|
||||
const secretSeen = path.join(dir, 'secret-seen.txt');
|
||||
// Protokolliert (ob das Webhook-Secret im Env ankommt, dann den Trigger); scheitert, solange "fail" existiert.
|
||||
fs.writeFileSync(
|
||||
script,
|
||||
`#!/bin/sh\necho "\${AIRCARD_WEBHOOK_TOKEN:-leer}" >> "${secretSeen}"\necho "$DEPLOY_TRIGGER" >> "${record}"\n` +
|
||||
`if [ -f "${path.join(dir, 'fail')}" ]; then exit 3; fi\n`,
|
||||
);
|
||||
fs.writeFileSync(path.join(dir, 'fail'), '');
|
||||
|
||||
const port = await freePort();
|
||||
const { child, output } = startProgram({
|
||||
AIRCARD_WEBHOOK_TOKEN: SECRET,
|
||||
AIRCARD_WEBHOOK_PORT: String(port),
|
||||
AIRCARD_DEPLOY_BRANCH: 'main',
|
||||
AIRCARD_DEPLOY_SCRIPT: script,
|
||||
POLL_INTERVAL_MINUTES: '0',
|
||||
});
|
||||
const triggers = () => (fs.existsSync(record) ? fs.readFileSync(record, 'utf8').trim().split('\n') : []);
|
||||
|
||||
await waitFor(() => triggers().length === 1, 'initial-Lauf', 8000);
|
||||
assert.deepEqual(triggers(), ['initial']);
|
||||
await waitFor(() => /deploy exited with code 3/.test(output.text), 'Fehlerzeile', 5000);
|
||||
|
||||
// Der Server lebt trotz fehlgeschlagenem Lauf und nimmt signierte Pushes an.
|
||||
fs.rmSync(path.join(dir, 'fail'));
|
||||
const res = await signedPush(port, 'refs/heads/main');
|
||||
assert.equal(res.status, 202);
|
||||
await waitFor(() => triggers().length === 2, 'webhook-Lauf', 8000);
|
||||
assert.deepEqual(triggers(), ['initial', 'webhook']);
|
||||
assert.equal(child.exitCode, null);
|
||||
// Das Deploy-Skript (und damit npm) bekommt das Webhook-Secret nicht.
|
||||
assert.deepEqual(fs.readFileSync(secretSeen, 'utf8').trim().split('\n'), ['leer', 'leer']);
|
||||
|
||||
for (const line of output.text.split('\n').filter(Boolean)) {
|
||||
assert.ok(line.startsWith('[webhook]'), `Zeile beginnt nicht mit [webhook]: ${line}`);
|
||||
assert.ok(!line.includes(SECRET), 'Secret im Log');
|
||||
}
|
||||
});
|
||||
Reference in new issue
Block a user