Add secure Node image webhook service

2026-08-06 11:21:54 +00:00
parent 24073326b3
commit f04b81c606
22 changed files with 1116 additions and 0 deletions
@@ -0,0 +1,17 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -lt 1 ] || [ "$#" -gt 2 ]; then
+    echo "Usage: $0 <branch> [commit]" >&2
+    exit 2
+fi
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+repository_dir=$(CDPATH= cd -- "$script_dir/../.." && pwd)
+branch=$1
+commit=${2:-}
+set -- deploy --branch "$branch"
+if [ -n "$commit" ]; then
+    set -- "$@" --commit "$commit"
+fi
+exec docker compose --project-directory "$repository_dir" exec -T image-hook node src/admin-cli.mjs "$@"
@@ -0,0 +1,53 @@
+#!/bin/sh
+set -eu
+
+action=${1:-check}
+source_cidr=${CADDY_SOURCE_CIDR:-}
+image_port=${IMAGE_PORT:-8191}
+chain=SAM_IMAGE_INGRESS
+
+case "$image_port" in
+    ''|*[!0-9]*) echo "IMAGE_PORT must be numeric" >&2; exit 2 ;;
+esac
+
+require_root() {
+    if [ "$(id -u)" -ne 0 ]; then
+        echo "Run this action as root." >&2
+        exit 1
+    fi
+}
+
+case "$action" in
+    check)
+        iptables -S DOCKER-USER 2>/dev/null | grep -F "$chain" || true
+        iptables -S "$chain" 2>/dev/null || true
+        ;;
+    apply)
+        require_root
+        if [ -z "$source_cidr" ]; then
+            echo "CADDY_SOURCE_CIDR is required" >&2
+            exit 2
+        fi
+        iptables -n -L DOCKER-USER >/dev/null
+        iptables -n -L "$chain" >/dev/null 2>&1 || iptables -N "$chain"
+        iptables -F "$chain"
+        iptables -A "$chain" -s "$source_cidr" -j ACCEPT
+        iptables -A "$chain" -j DROP
+        iptables -C DOCKER-USER -p tcp -m conntrack --ctorigdstport "$image_port" -j "$chain" 2>/dev/null \
+            || iptables -I DOCKER-USER 1 -p tcp -m conntrack --ctorigdstport "$image_port" -j "$chain"
+        ;;
+    remove)
+        require_root
+        while iptables -C DOCKER-USER -p tcp -m conntrack --ctorigdstport "$image_port" -j "$chain" 2>/dev/null; do
+            iptables -D DOCKER-USER -p tcp -m conntrack --ctorigdstport "$image_port" -j "$chain"
+        done
+        if iptables -n -L "$chain" >/dev/null 2>&1; then
+            iptables -F "$chain"
+            iptables -X "$chain"
+        fi
+        ;;
+    *)
+        echo "Usage: $0 [check|apply|remove]" >&2
+        exit 2
+        ;;
+esac
@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+repository_dir=$(CDPATH= cd -- "$script_dir/../.." && pwd)
+secret_dir="$repository_dir/secrets"
+state_dir="$repository_dir/runtime-data"
+
+umask 077
+mkdir -p "$secret_dir"
+mkdir -p "$state_dir"
+for name in gitea_webhook_secret image_admin_secret; do
+    path="$secret_dir/$name"
+    if [ ! -e "$path" ]; then
+        openssl rand -hex 32 > "$path"
+    fi
+    chmod 600 "$path"
+done
+chmod 700 "$state_dir"
+
+echo "Secret files are ready in $secret_dir (values not printed)."