81 lines
2.6 KiB
Nix
81 lines
2.6 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
let
|
|
relayScript = pkgs.writeText "gitea-hermes-webhook-relay.py" (
|
|
builtins.readFile ./gitea-hermes-webhook-relay.py
|
|
);
|
|
in
|
|
{
|
|
systemd.services.gitea-hermes-webhook-relay = {
|
|
description = "Normalize Gitea PR webhooks for Hermes Agent";
|
|
wantedBy = [ "multi-user.target" ];
|
|
wants = [ "network-online.target" ];
|
|
after = [
|
|
"network-online.target"
|
|
"podman-hermes-agent.service"
|
|
"tailscaled-autoconnect.service"
|
|
];
|
|
|
|
environment = {
|
|
LISTEN_HOST = "0.0.0.0";
|
|
LISTEN_PORT = "8645";
|
|
HERMES_WEBHOOK_URL = "http://127.0.0.1:8644/webhooks/gitea-events";
|
|
MAX_BODY_BYTES = "1048576";
|
|
};
|
|
|
|
serviceConfig = {
|
|
ExecStart = "${pkgs.python3}/bin/python ${relayScript}";
|
|
LoadCredential = [
|
|
"webhook_secret:${config.sops.secrets.gitea_hermes_webhook_secret.path}"
|
|
];
|
|
DynamicUser = true;
|
|
Restart = "on-failure";
|
|
RestartSec = 5;
|
|
PrivateDevices = true;
|
|
PrivateTmp = true;
|
|
ProtectHome = true;
|
|
ProtectSystem = "strict";
|
|
NoNewPrivileges = true;
|
|
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
|
|
RestrictRealtime = true;
|
|
UMask = "0077";
|
|
};
|
|
};
|
|
|
|
# The relay forwards into a generic Hermes webhook subscription. Keep the
|
|
# subscription declaratively present without putting event policy or prompt
|
|
# text in this transport unit. Hermes owns interpretation and response policy.
|
|
systemd.services.hermes-agent-webhook-route = {
|
|
description = "Configure Hermes Gitea event webhook route";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "podman-hermes-agent.service" ];
|
|
requires = [ "podman-hermes-agent.service" ];
|
|
path = [ pkgs.podman ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = ''
|
|
set -euo pipefail
|
|
|
|
# The container unit is ordered before us, but its gateway may still be
|
|
# warming up while the image initializes its persistent state directory.
|
|
for _ in $(seq 1 60); do
|
|
if podman exec hermes-agent hermes webhook list >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
|
|
podman exec hermes-agent hermes webhook remove gitea-pr-comments >/dev/null 2>&1 || true
|
|
podman exec hermes-agent hermes webhook remove gitea-events >/dev/null 2>&1 || true
|
|
podman exec hermes-agent sh -c '
|
|
hermes webhook subscribe gitea-events \
|
|
--secret "$GITEA_HERMES_WEBHOOK_SECRET" \
|
|
--description "Forward authenticated Gitea events to L.U.N.A." \
|
|
--deliver telegram --deliver-chat-id "15151223"
|
|
'
|
|
'';
|
|
};
|
|
}
|