host
bed3fc0dff
Projects gain repo_url (validated: https:// or git@ only, no userinfo/password, no file:// or local paths; old DBs get the column via idempotent ALTER in both SQLite and Postgres init). Worker resolves a project's repo_url to a local checkout under --repos-dir (default ./repos) before dispatch: clone if absent, verify remote origin matches and fetch if present, never force reset/clean, never push (push needs write credentials the control plane does not store). Resolve failure fails the task with a clear error, never completed. Docker workers need repos_dir under a same-path extra mount (e.g. /var/lib/codex-app-server/repos). Also: driver-missing test is now mocked instead of depending on the host really having no psycopg driver installed. Deploy package: Caddyfile template exposing only /webhooks/* and /oauth/* (tasks/projects/admin stay 403) plus a webhook-secret generator script that never prints the secret. Tests: host 27 pass, cloud 286 pass (8 skipped are environment-dependent real-Postgres tests).
28 lines
1.3 KiB
Caddyfile
28 lines
1.3 KiB
Caddyfile
# 公网入口模板：只暴露 webhook 与 OAuth 回调，任务/项目/管理 API 不对外。
|
|
# 使用前把 <DOMAIN> 换成你自己的域名，把 <EMAIL> 换成 Let's Encrypt 联系邮箱。
|
|
# 部署侧在主机上装 Caddy 后，把本文件放到 /etc/caddy/Caddyfile 并 reload。
|
|
# 控制面本身仍只监听 127.0.0.1:8765，不直接对外；Caddy 只做反向代理 + TLS。
|
|
# GitHub webhook 与 OAuth 回调都要求 https 且证书有效，Caddy 的自动证书满足这一点；
|
|
# 自签名证书不行，GitHub 会拒绝送达，浏览器也会拦截 OAuth 回调。
|
|
|
|
<DOMAIN> {
|
|
encode gzip
|
|
tls <EMAIL>
|
|
|
|
# GitHub webhook：签名校验在控制面做（GITHUB_WEBHOOK_SECRET），Caddy 只转发。
|
|
@github path /webhooks/github
|
|
reverse_proxy @github 127.0.0.1:8765
|
|
|
|
# Slack webhook（目前只有解析，未接执行；先留着入口，执行接通后再用）。
|
|
@slack path /webhooks/slack
|
|
reverse_proxy @slack 127.0.0.1:8765
|
|
|
|
# OAuth 浏览器登录/回调：回调 URL 必须与 OAuth App 里填的完全一致，
|
|
# 即 https://<DOMAIN>/oauth/<provider>/callback。
|
|
@oauth path /oauth/*
|
|
reverse_proxy @oauth 127.0.0.1:8765
|
|
|
|
# 其余一切（/tasks、/projects、/admin/*、/metrics 等）一律不对公网开放。
|
|
respond "forbidden" 403
|
|
}
|