mars: add generic Gitea webhook relay

services/dev/gitea.nix

@@ -264,4 +264,43 @@ in
       '') lunaRepos}
     '';
   };
+
+  # Register the HomeLab PR-comment webhook on Gitea. This is idempotent: it
+  # updates the existing hook for the relay target or creates it when absent.
+  systemd.services.gitea-hermes-webhook-provision = {
+    description = "Provision Gitea webhook for Hermes PR comments";
+    after = [ "gitea.service" ];
+    requires = [ "gitea.service" ];
+    wantedBy = [ "multi-user.target" ];
+    path = [ pkgs.curl pkgs.jq ];
+    environment = {
+      TOKEN_FILE = config.sops.secrets.gitea_provisioning_token.path;
+      SECRET_FILE = config.sops.secrets.gitea_hermes_webhook_secret.path;
+    };
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      User = config.services.gitea.user;
+    };
+    script = ''
+      set -euo pipefail
+      api=http://127.0.0.1:${toString config.services.gitea.settings.server.HTTP_PORT}/api/v1
+      admin_token="$(cat "$TOKEN_FILE")"
+      secret="$(cat "$SECRET_FILE")"
+      auth=(-H "Authorization: token $admin_token")
+      target="http://mars.orbit.sol:8645/gitea"
+      body="$(jq -n --arg url "$target" --arg secret "$secret" \
+        '{type: "gitea", config: {content_type: "json", url: $url, secret: $secret}, events: ["pull_request_comment", "pull_request_review_comment"], active: true}')"
+
+      hook_id="$(curl -fsS "''${auth[@]}" "$api/repos/darman/homelab/hooks" \
+        | jq -r --arg url "$target" 'first(.[] | select(.type == "gitea" and .config.url == $url)) | .id // empty')"
+      if [ -n "$hook_id" ]; then
+        curl -fsS "''${auth[@]}" -H 'Content-Type: application/json' \
+          -X PATCH "$api/repos/darman/homelab/hooks/$hook_id" -d "$body" >/dev/null
+      else
+        curl -fsS "''${auth[@]}" -H 'Content-Type: application/json' \
+          -X POST "$api/repos/darman/homelab/hooks" -d "$body" >/dev/null
+      fi
+    '';
+  };
 }