fisher
3a6fafb5c7
Replaces the per-project deploy scripts and self-contained webhook receivers with one manifest-driven implementation that lives outside the application repositories and can be updated independently of them. First targets: domaindingo test and prod on s5.
34 lines
988 B
Desktop File
34 lines
988 B
Desktop File
[Unit]
|
|
Description=Continuous deployment webhook receiver (adnanh/webhook)
|
|
Documentation=https://github.com/adnanh/webhook
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
|
|
# Placeholders are substituted by install/install.sh from targets.json.
|
|
# -hotreload picks up a re-rendered hooks file without a restart, so adding an
|
|
# environment is `cd-render-hooks` and nothing else.
|
|
# -nopanic keeps the daemon alive if the hooks file is momentarily unreadable
|
|
# mid-write rather than exiting and taking every other target down with it.
|
|
ExecStart=@WEBHOOK_BIN@ \
|
|
-hooks @HOOKS_FILE@ \
|
|
-ip @BIND@ \
|
|
-port @PORT@ \
|
|
-hotreload \
|
|
-nopanic
|
|
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
|
|
# The deploy itself is a child process that talks to the user's Docker socket,
|
|
# so this stays deliberately unsandboxed apart from the cheap wins below.
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
ProtectControlGroups=yes
|
|
ProtectKernelTunables=yes
|
|
|
|
[Install]
|
|
WantedBy=default.target
|