From 09d79f6587266d2cdc7ade0d3bdd0804ed7c4b7b Mon Sep 17 00:00:00 2001
From: Peter Smit <petersmit@moneybird.com>
Date: Thu, 16 Jan 2025 16:26:39 +0100
Subject: [PATCH] Add updater container (spannend hoor)

---
 docker-compose.yml         |  1 +
 update                     |  3 --
 updater/.env.example       |  2 ++
 updater/Dockerfile         | 16 +++++++++
 updater/docker-compose.yml |  9 +++++
 updater/webhook.php        | 71 ++++++++++++++++++++++++++++++++++++++
 6 files changed, 99 insertions(+), 3 deletions(-)
 delete mode 100755 update
 create mode 100644 updater/.env.example
 create mode 100644 updater/Dockerfile
 create mode 100644 updater/docker-compose.yml
 create mode 100644 updater/webhook.php

diff --git a/docker-compose.yml b/docker-compose.yml
index 0bc386d..1d53dad 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,4 +5,5 @@ include:
   - paperless/docker-compose.yml
   - pingvin/docker-compose.yml
   - pocketid/docker-compose.yml
+  - updater/docker-compose.yml
   - vaultwarden/docker-compose.yml
\ No newline at end of file
diff --git a/update b/update
deleted file mode 100755
index 7557b5d..0000000
--- a/update
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/bash
-cd /data/docker-config
-git pull && docker compose up -d
diff --git a/updater/.env.example b/updater/.env.example
new file mode 100644
index 0000000..19d2ac6
--- /dev/null
+++ b/updater/.env.example
@@ -0,0 +1,2 @@
+GITEA_WEBHOOK_SECRET=
+DOCKER_CONFIG_DIR=
\ No newline at end of file
diff --git a/updater/Dockerfile b/updater/Dockerfile
new file mode 100644
index 0000000..4d9942c
--- /dev/null
+++ b/updater/Dockerfile
@@ -0,0 +1,16 @@
+# Use the official PHP image with Apache
+FROM php:8.1-apache
+
+# Install git and docker-compose
+RUN apt-get update && \
+    apt-get install -y git docker-compose && \
+    rm -rf /var/lib/apt/lists/*
+
+# Copy the PHP file to the Apache document root
+COPY webhook.php /var/www/html/index.php
+
+# Expose port 80
+EXPOSE 80
+
+# Start Apache server
+CMD ["apache2-foreground"]
\ No newline at end of file
diff --git a/updater/docker-compose.yml b/updater/docker-compose.yml
new file mode 100644
index 0000000..fa74e92
--- /dev/null
+++ b/updater/docker-compose.yml
@@ -0,0 +1,9 @@
+services:
+  updater:
+    build: .
+    ports:
+      - "6969:80"
+    env_file:
+      - .env
+    volumes:
+      - ${DOCKER_CONFIG_DIR}:/config
\ No newline at end of file
diff --git a/updater/webhook.php b/updater/webhook.php
new file mode 100644
index 0000000..cb7f490
--- /dev/null
+++ b/updater/webhook.php
@@ -0,0 +1,71 @@
+<?php
+
+error_log(date('Y-m-d H:i:s'). "\t received request from " . $_SERVER['REMOTE_ADDR']);
+
+
+$secret_key = getenv('GITEA_WEBHOOK_SECRET');
+if (empty($secret_key)) {
+    error_log('FAILED - secret key missing from environment');
+    exit();
+}
+
+// check for POST request
+if ($_SERVER['REQUEST_METHOD'] != 'POST') {
+    error_log('FAILED - not POST - ' . $_SERVER['REQUEST_METHOD']);
+    exit();
+}
+
+// get content type
+$content_type = isset($_SERVER['CONTENT_TYPE']) ? strtolower(trim($_SERVER['CONTENT_TYPE'])) : '';
+
+if ($content_type != 'application/json') {
+    error_log('FAILED - not application/json - ' . $content_type);
+    exit();
+}
+
+// get payload
+$payload = trim(file_get_contents("php://input"));
+
+if (empty($payload)) {
+    error_log('FAILED - no payload');
+    exit();
+}
+
+// get header signature
+$header_signature = isset($_SERVER['HTTP_X_GITEA_SIGNATURE']) ? $_SERVER['HTTP_X_GITEA_SIGNATURE'] : '';
+
+if (empty($header_signature)) {
+    error_log('FAILED - header signature missing');
+    exit();
+}
+
+// calculate payload signature
+$payload_signature = hash_hmac('sha256', $payload, $secret_key);
+
+// check payload signature against header signature
+if ($header_signature !== $payload_signature) {
+    error_log('FAILED - payload signature');
+    exit();
+}
+
+// convert json to array
+$decoded = json_decode($payload, true);
+
+// check for json decode errors
+if (json_last_error() !== JSON_ERROR_NONE) {
+    error_log('FAILED - json decode - ' . json_last_error());
+    exit();
+}
+
+// success, log something without error_log
+error_log('SUCCESS - ' . $decoded['ref']);
+
+chdir('/config');
+exec('git pull');
+exec('docker compose up -d --quiet-pull > /proc/1/fd/1 2>/proc/1/fd/2 &');
+
+// send return code and text message
+http_response_code(200);
+echo 'lekker pik';
+
+