gitea: leave webhook registration operator-managed

services/dev/gitea.nix

@@ -21,36 +21,6 @@ let
   # nothing she does lands without darman clicking merge.
   lunaRepos = [ "darman/homelab" ];
 
-  # Forward every Gitea event to the generic Mars relay. Hermes owns the
-  # decision about which events matter and what to do with them.
-  giteaWebhookEvents = [
-    "create"
-    "delete"
-    "fork"
-    "push"
-    "issues"
-    "issue_assign"
-    "issue_label"
-    "issue_milestone"
-    "issue_comment"
-    "pull_request"
-    "pull_request_assign"
-    "pull_request_label"
-    "pull_request_milestone"
-    "pull_request_comment"
-    "pull_request_review_approved"
-    "pull_request_review_rejected"
-    "pull_request_review_comment"
-    "pull_request_sync"
-    "pull_request_review_request"
-    "wiki"
-    "repository"
-    "release"
-    "package"
-    "status"
-    "workflow_run"
-    "workflow_job"
-  ];
 in
 {
   services.gitea = {
@@ -296,44 +266,4 @@ in
     '';
   };
 
-  # Register the generic Gitea webhook. This is idempotent: it updates the
-  # existing hook for the relay target or creates it when absent. Event policy
-  # belongs to Hermes, so the source sends the complete Gitea event set.
-  systemd.services.gitea-hermes-webhook-provision = {
-    description = "Provision Gitea webhook for Hermes events";
-    after = [ "gitea.service" ];
-    requires = [ "gitea.service" ];
-    wantedBy = [ "multi-user.target" ];
-    path = [ pkgs.curl pkgs.jq ];
-    environment = {
-      TOKEN_FILE = config.sops.secrets.gitea_provisioning_token.path;
-      SECRET_FILE = config.sops.secrets.gitea_hermes_webhook_secret.path;
-    };
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      User = config.services.gitea.user;
-    };
-    script = ''
-      set -euo pipefail
-      api=http://127.0.0.1:${toString config.services.gitea.settings.server.HTTP_PORT}/api/v1
-      admin_token="$(cat "$TOKEN_FILE")"
-      secret="$(cat "$SECRET_FILE")"
-      auth=(-H "Authorization: token $admin_token")
-      target="http://mars.orbit.sol:8645/gitea"
-      body="$(jq -n --arg url "$target" --arg secret "$secret" \
-        --argjson events '${builtins.toJSON giteaWebhookEvents}' \
-        '{type: "gitea", config: {content_type: "json", url: $url, secret: $secret}, events: $events, active: true}')"
-
-      hook_id="$(curl -fsS "''${auth[@]}" "$api/repos/darman/homelab/hooks" \
-        | jq -r --arg url "$target" 'first(.[] | select(.type == "gitea" and .config.url == $url)) | .id // empty')"
-      if [ -n "$hook_id" ]; then
-        curl -fsS "''${auth[@]}" -H 'Content-Type: application/json' \
-          -X PATCH "$api/repos/darman/homelab/hooks/$hook_id" -d "$body" >/dev/null
-      else
-        curl -fsS "''${auth[@]}" -H 'Content-Type: application/json' \
-          -X POST "$api/repos/darman/homelab/hooks" -d "$body" >/dev/null
-      fi
-    '';
-  };
 }