fisher/my-cd-webhook
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move receiver to port 21600, per the Port registry allocation rules

Browse Source 
The registry reserves 20000-20099 for Gitea and requires new blocks to come
from the 21500-21999 free pool, claimed only once a service is actually
listening. Also corrects the clone URL to fisher/my-cd-webhook.
This commit is contained in:
fisher
2026-08-23 07:54:44 +00:00
parent 2905718ada
commit b48e112ed7
3 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10 -6
View File
@@ -76,7 +76,7 @@ secrets.env.example template for the host-local secrets file
git push origin test
│
▼
Gitea push webhook ──► http://10.255.255.1:20090/hooks/webdev-domaindingo
Gitea push webhook ──► http://10.255.255.1:21600/hooks/webdev-domaindingo
│ (WireGuard only; never exposed publicly)
▼
adnanh/webhook verify HMAC-SHA256, require X-Gitea-Event: push,
@@ -104,7 +104,7 @@ Requires `adnanh/webhook` on `PATH` (or `WEBHOOK_BIN` set), plus `docker`,
`python3`, `curl` and `flock`.
```bash
git clone ssh://git@gitea.fisher.hu:2221/sysadmin/my-cd-webhook.git ~/S/my-cd-webhook
git clone ssh://git@gitea.fisher.hu:2221/fisher/my-cd-webhook.git ~/S/my-cd-webhook
cd ~/S/my-cd-webhook
./install/install.sh # creates the secrets template on the first run
$EDITOR ~/.config/cd-webhook/secrets.env
@@ -119,7 +119,7 @@ It prints the exact webhook URL for each repository at the end. In Gitea, under
| Field | Value |
|---|---|
| Target URL | `http://<host wg ip>:20090/hooks/<id>` |
| Target URL | `http://<host wg ip>:21600/hooks/<id>` |
| HTTP Method | `POST` |
| POST Content Type | `application/json` |
| Secret | the matching value from `secrets.env` |
@@ -162,10 +162,14 @@ changes which manifest is read, never which host this machine may act as.
## Not yet done
- **Port `20090` is not yet in the Port registry.** Register it before this goes
live on a second host.
- **Gitea (s5) must be able to reach s4 on `10.255.255.12:20090`** over
- **Port `21600` is proposed, not allocated.** The Port registry's rule is to
claim a block only once the service is deployed and listening, as part of the
same change. `21600-21699` is the lowest free block in the `21500-21999` pool;
verify it is still free on the host (`ss -lntup`) when installing, then add
both the block row and a per-project table to the registry.
- **Gitea (s5) must be able to reach s4 on `10.255.255.12:21600`** over
WireGuard. Verify before adding grindex.
- **`adnanh/webhook` is not installed on s4 or s5.** Nothing runs yet.
- **grindex is deliberately absent from the manifest.** Its stack lives at
`/home/fisher/S/traefik-systems/grindex/` on s4, which is not in git and whose
compose project names have not been verified on the host. Adding it from