mars: add generic Gitea webhook relay

2026-08-23 01:45:18 +00:00
parent 3c1f3e5fc3
commit 806cec77e8
7 changed files with 333 additions and 0 deletions
@@ -37,6 +37,19 @@ scripts/                   # deploy, edit_secrets
 Hosts compose by importing `common.nix` + whichever `services/*` modules they
 run. Each service module opens its own firewall ports.

+## Gitea PR comment relay
+
+Mars includes a small HMAC-validating relay for Gitea webhooks. It normalizes
+Gitea headers and forwards every authenticated JSON event to Hermes over
+localhost; Hermes owns event selection, repository policy, and response
+behavior. Jupiter's Gitea provisioning service registers the webhook
+idempotently at `http://mars.orbit.sol:8645/gitea`.
+
+Before deploying either host, add the same random
+`gitea_hermes_webhook_secret` value to both `secrets/mars.yaml` and
+`secrets/jupiter.yaml` with `sops --set`. The value is intentionally not
+included in the repository.
+
 ## Test in VirtualBox (no hardware needed)

 ```