host
bed3fc0dff
Projects gain repo_url (validated: https:// or git@ only, no userinfo/password, no file:// or local paths; old DBs get the column via idempotent ALTER in both SQLite and Postgres init). Worker resolves a project's repo_url to a local checkout under --repos-dir (default ./repos) before dispatch: clone if absent, verify remote origin matches and fetch if present, never force reset/clean, never push (push needs write credentials the control plane does not store). Resolve failure fails the task with a clear error, never completed. Docker workers need repos_dir under a same-path extra mount (e.g. /var/lib/codex-app-server/repos). Also: driver-missing test is now mocked instead of depending on the host really having no psycopg driver installed. Deploy package: Caddyfile template exposing only /webhooks/* and /oauth/* (tasks/projects/admin stay 403) plus a webhook-secret generator script that never prints the secret. Tests: host 27 pass, cloud 286 pass (8 skipped are environment-dependent real-Postgres tests).
19 lines
1.1 KiB
Bash
Executable File
19 lines
1.1 KiB
Bash
Executable File
#!/bin/sh
|
|
# 在主机上生成 GitHub webhook secret 并写入 /etc/codex-app-server/env，绝不打印 secret。
|
|
# 用法（主机 root 执行）：sh deploy/setup-webhook-secret.sh
|
|
# 效果：若 env 文件里已有 GITHUB_WEBHOOK_SECRET 则不动它并退出（避免轮换后 GitHub 端旧 secret 失效）；
|
|
# 否则生成 32 字节随机 hex，追加到 env 文件，重启 codex-cloud-server。
|
|
# 生成的 secret 只存在主机 env 文件里（0600 root），不要把它发回聊天、不要写进仓库。
|
|
set -eu
|
|
ENV_FILE=/etc/codex-app-server/env
|
|
if grep -q '^GITHUB_WEBHOOK_SECRET=' "$ENV_FILE" 2>/dev/null; then
|
|
echo "GITHUB_WEBHOOK_SECRET already set, leaving it unchanged."
|
|
exit 0
|
|
fi
|
|
SECRET=$(openssl rand -hex 32)
|
|
printf 'GITHUB_WEBHOOK_SECRET=%s\n' "$SECRET" >> "$ENV_FILE"
|
|
chmod 600 "$ENV_FILE"
|
|
systemctl restart codex-cloud-server
|
|
echo "Webhook secret generated and stored in $ENV_FILE only; server restarted."
|
|
echo "Next step: paste the same secret into GitHub repo Settings -> Webhooks -> Secret (the value is on the host only, read it from $ENV_FILE as root if you need to copy it)."
|