mars: add generic Gitea webhook relay

hosts/mars/configuration.nix

@@ -12,6 +12,7 @@
     ../../services/containers.nix
     ../../services/vpn/tailscale.nix
     ../../services/monitoring/node-exporter.nix
+    ../../services/dev/gitea-hermes-webhook-relay.nix
   ];
 
   networking.hostName = "mars";

hosts/mars/secrets.nix

@@ -28,11 +28,21 @@
   sops.secrets.opencode_go_api_key = { };
   sops.secrets.telegram_bot_token = { };
   sops.secrets.hermes_dashboard_oidc_client_secret = { };
+  sops.secrets.gitea_hermes_webhook_secret = {
+    # Add the same value to secrets/mars.yaml before deploying Mars.
+    restartUnits = [
+      "gitea-hermes-webhook-relay.service"
+      "hermes-agent-webhook-route.service"
+    ];
+  };
   sops.templates."hermes-agent.env".content = ''
     OPENCODE_GO_API_KEY=${config.sops.placeholder.opencode_go_api_key}
     TELEGRAM_BOT_TOKEN=${config.sops.placeholder.telegram_bot_token}
     TELEGRAM_HOME_CHANNEL=15151223
     TELEGRAM_ALLOWED_USERS=15151223
+    WEBHOOK_ENABLED=true
+    WEBHOOK_PORT=8644
+    GITEA_HERMES_WEBHOOK_SECRET=${config.sops.placeholder.gitea_hermes_webhook_secret}
     HERMES_DASHBOARD_OIDC_CLIENT_SECRET=${config.sops.placeholder.hermes_dashboard_oidc_client_secret}
   '';