From d5c733767bf3938b9c731dfc10ab5f882e41f086 Mon Sep 17 00:00:00 2001
From: Andre Challier <andre.challier@challier.org>
Date: Wed, 27 Mar 2024 13:06:19 +0100
Subject: [PATCH] Changed to docker-compose deployment

---
 Dockerfile                      |  2 +-
 README.md                       |  6 +-
 docker-compose.yml              | 27 +++++++--
 entrypoint.sh                   |  5 --
 nginx.conf.dist                 | 14 -----
 webhook-git-2.Dockerfile        | 18 ++++++
 webhook-git.Dockerfile          | 11 ++++
 webhook.php                     | 54 ------------------
 webhooks-git/Dockerfile         |  0
 webhooks-git/hooks.json.example | 99 +++++++++++++++++++++++++++++++++
 10 files changed, 157 insertions(+), 79 deletions(-)
 delete mode 100644 entrypoint.sh
 delete mode 100644 nginx.conf.dist
 create mode 100644 webhook-git-2.Dockerfile
 create mode 100644 webhook-git.Dockerfile
 delete mode 100644 webhook.php
 create mode 100644 webhooks-git/Dockerfile
 create mode 100644 webhooks-git/hooks.json.example

diff --git a/Dockerfile b/Dockerfile
index 8cc70e6..96b3be3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM nginx
+FROM jkaninda/nginx-php-fpm
 
 # Install git and ssh-keygen
 RUN apt-get update && \
diff --git a/README.md b/README.md
index 6d44d3d..63d4872 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,7 @@
 # Docker Nginx Git
 
-This is a container to serve static pages from a git repository.
\ No newline at end of file
+This is a container to serve static pages from two git repositories. One repository holds the static sites, the other holds an assets-folder.
+
+From the static sites repository all branches are initially loaded to `$HTML_FOLDER/branches/<branchname>`, the assets folder is initially loaded to `$HTML_FOLDER/assets`.
+
+On a push to some branch on the static sites repository, this branches folder is deleted and cloned again. The assets folder is only updated if the push happened on the `main` branch.
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
index 4f063da..79401d4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,8 +1,27 @@
-version: '3'
+version: '3.8'
 
 services:
-  my-container:
-    image: <image_name>:<tag_name>
+  nginx:
+    image: nginx:latest
     ports:
       - "80:80"
-    # Add other configuration options as needed
+    volumes:
+      - static-files: /usr/share/nginx/html
+      - webhooks-git-ssh: /root/.ssh
+      - webhooks-git-data: /etc/webhook/
+
+  webhooks-git:
+    build:
+      context: ./webhooks-git
+      dockerfile: Dockerfile
+    volumes:
+      - static-files:/etc/static-files
+
+volumes:
+  static-files:
+    external: true
+  webhooks-git-ssh:
+    external: true
+  webhooks-git-data:
+    external: true
+
diff --git a/entrypoint.sh b/entrypoint.sh
deleted file mode 100644
index 6ae5c72..0000000
--- a/entrypoint.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/bash
-
-echo "Starting Nginx git publisher on $NGINX_SERVER_NAME"
-echo $SSH_KEY_PATH
-nginx -g daemon off;
\ No newline at end of file
diff --git a/nginx.conf.dist b/nginx.conf.dist
deleted file mode 100644
index 6cea608..0000000
--- a/nginx.conf.dist
+++ /dev/null
@@ -1,14 +0,0 @@
-events {}
-
-http {
-    server {
-        listen 80;
-        server_name ${NGINX_SERVER_NAME};
-
-        location / {
-            root /usr/share/nginx/html;
-            index index.html;
-        }
-    }
-
-}
diff --git a/webhook-git-2.Dockerfile b/webhook-git-2.Dockerfile
new file mode 100644
index 0000000..c3b9633
--- /dev/null
+++ b/webhook-git-2.Dockerfile
@@ -0,0 +1,18 @@
+# Dockerfile for https://github.com/adnanh/webhook
+FROM        golang:alpine AS build
+MAINTAINER  Almir Dzinovic <almir@dzinovic.net>
+WORKDIR     /go/src/github.com/adnanh/webhook
+ENV         WEBHOOK_VERSION 2.8.1
+RUN         apk add --update -t build-deps curl libc-dev gcc libgcc git openssh-client bash nano
+RUN         curl -L --silent -o webhook.tar.gz https://github.com/adnanh/webhook/archive/${WEBHOOK_VERSION}.tar.gz && \
+            tar -xzf webhook.tar.gz --strip 1
+RUN         go get -d -v
+RUN         CGO_ENABLED=0 go build -ldflags="-s -w" -o /usr/local/bin/webhook
+
+FROM        alpine
+RUN         apk --no-cache add git openssh-client bash nano
+COPY        --from=build /usr/local/bin/webhook /usr/local/bin/webhook
+WORKDIR     /etc/webhook
+EXPOSE      9000
+ENTRYPOINT  ["/usr/local/bin/webhook"]
+CMD ["-verbose", "-hooks=/etc/webhook/hooks.yaml", "-hotreload"]
\ No newline at end of file
diff --git a/webhook-git.Dockerfile b/webhook-git.Dockerfile
new file mode 100644
index 0000000..b60e120
--- /dev/null
+++ b/webhook-git.Dockerfile
@@ -0,0 +1,11 @@
+# Dockerfile for https://github.com/adnanh/webhook
+FROM        almir/webhook
+COPY        hooks.json.example /etc/webhook/hooks.json
+
+FROM        alpine
+RUN         apk --no-cache add git openssh-client bash nano
+COPY        --from=build /usr/local/bin/webhook /usr/local/bin/webhook
+WORKDIR     /etc/webhook
+EXPOSE      9000
+ENTRYPOINT  ["/usr/local/bin/webhook"]
+CMD ["-verbose", "-hooks=/etc/webhook/hooks.json", "-hotreload"]
\ No newline at end of file
diff --git a/webhook.php b/webhook.php
deleted file mode 100644
index f407212..0000000
--- a/webhook.php
+++ /dev/null
@@ -1,54 +0,0 @@
-<?php
-
-$secret_key = '1234';
-
-// check for POST request
-if ($_SERVER['REQUEST_METHOD'] != 'POST') {
-    error_log('FAILED - not POST - '. $_SERVER['REQUEST_METHOD']);
-    exit();
-}
-
-// get content type
-$content_type = isset($_SERVER['CONTENT_TYPE']) ? strtolower(trim($_SERVER['CONTENT_TYPE'])) : '';
-
-if ($content_type != 'application/json') {
-    error_log('FAILED - not application/json - '. $content_type);
-    exit();
-}
-
-// get payload
-$payload = trim(file_get_contents("php://input"));
-
-if (empty($payload)) {
-    error_log('FAILED - no payload');
-    exit();
-}
-
-// get header signature
-$header_signature = isset($_SERVER['HTTP_X_GITEA_SIGNATURE']) ? $_SERVER['HTTP_X_GITEA_SIGNATURE'] : '';
-
-if (empty($header_signature)) {
-    error_log('FAILED - header signature missing');
-    exit();
-}
-
-// calculate payload signature
-$payload_signature = hash_hmac('sha256', $payload, $secret_key, false);
-
-// check payload signature against header signature
-if ($header_signature !== $payload_signature) {
-    error_log('FAILED - payload signature');
-    exit();
-}
-
-// convert json to array
-$decoded = json_decode($payload, true);
-
-// check for json decode errors
-if (json_last_error() !== JSON_ERROR_NONE) {
-    error_log('FAILED - json decode - '. json_last_error());
-    exit();
-}
-
-// success, do something
-file_put_contents("payload.json", $decoded);
\ No newline at end of file
diff --git a/webhooks-git/Dockerfile b/webhooks-git/Dockerfile
new file mode 100644
index 0000000..e69de29
diff --git a/webhooks-git/hooks.json.example b/webhooks-git/hooks.json.example
new file mode 100644
index 0000000..01cf15a
--- /dev/null
+++ b/webhooks-git/hooks.json.example
@@ -0,0 +1,99 @@
+[
+  {
+    "id": "programm-webhook",
+    "http-methods": ["PUSH"],
+    "execute-command": "/etc/webhook/programm-hook.sh",
+    "command-working-directory": "/etc/webhook/",
+    "response-message": "I got the payload!",
+    "response-headers":
+    [
+      {
+        "name": "Access-Control-Allow-Origin",
+        "value": "*"
+      }
+    ],
+    "pass-arguments-to-command":
+    [
+      {
+        "source": "payload",
+        "name": "ref"
+      },
+      {
+        "source": "payload",
+        "name": "repository.name"
+      }
+    ],
+    "trigger-rule":
+    {
+      "and":
+      [
+        {
+          "match":
+          {
+            "type": "payload-hmac-sha1",
+            "secret": "1234",
+            "parameter":
+            {
+              "source": "header",
+              "name": "X-Hub-Signature"
+            }
+          }
+        }
+      ]
+    }
+  },
+  {
+    "id": "assets-webhook",
+    "execute-command": "/etc/webhook/assets-hook.sh",
+    "command-working-directory": "/etc/webhook/",
+    "response-message": "I got the payload!",
+    "response-headers":
+    [
+      {
+        "name": "Access-Control-Allow-Origin",
+        "value": "*"
+      }
+    ],
+    "pass-arguments-to-command":
+    [
+      {
+        "source": "payload",
+        "name": "repository.name"
+      },
+      {
+        "source": "payload",
+        "name": "ref"
+      }
+    ],
+    "trigger-rule":
+    {
+      "and":
+      [
+        {
+          "match":
+          {
+            "type": "payload-hmac-sha256",
+            "secret": "1234",
+            "parameter":
+            {
+              "source": "header",
+              "name": "X-Hub-Signature-256"
+            }
+          }
+        },
+        {
+          "match":
+          {
+            "type":"value",
+            "value": "refs/heads/main",
+            "parameter":
+            {
+              "source": "payload",
+              "name": "ref"
+            }
+          }
+        }
+      ]
+    }
+  }
+]
\ No newline at end of file