From c5cb06676eeb80f205bbfbabf9d9e7917bc6f5f9 Mon Sep 17 00:00:00 2001
From: Ubergeek <ubergeek@yourtilde.com>
Date: Fri, 22 Mar 2019 00:34:33 +0000
Subject: [PATCH] Ok, giving up, splitting the hooks

---
 ansible-hook.php | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 www-hook.php     | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 92 insertions(+)
 create mode 100644 ansible-hook.php
 create mode 100644 www-hook.php

diff --git a/ansible-hook.php b/ansible-hook.php
new file mode 100644
index 0000000..090d0ac
--- /dev/null
+++ b/ansible-hook.php
@@ -0,0 +1,46 @@
+<?php
+/* gitea deploy webhook */
+
+/* security */
+$access_token     = 'abcdefg';
+$www_lastrun      = '/dev/shm/www-hook-last-run';
+$www_dropfile     = '/dev/shm/run-www';
+$remoteip         = $_SERVER['REMOTE_ADDR'];
+$allowedip        = "195.201.242.48";
+$ratelimit        = 300;
+
+/* get json data */
+$json = file_get_contents('php://input');
+$data = json_decode($json, true);
+
+$client_token = $data["secret"];
+if ($client_token === $access_token)
+{
+    http_response_code(403);
+    echo "HTTP 403 - Forbidden, P1.";
+    die();
+}
+
+if ($remoteip != $allowedip)
+{
+    http_response_code(403);
+    echo "HTTP 403 - Forbidden, P2.";
+    //echo '\n' . $remoteip . " " . $allowedip;
+    die();
+}
+
+syslog(LOG_INFO, 'WWW Webhook recieved.');
+        if ( time () - filemtime ( $www_lastrun ) > $ratelimit ) {
+                touch ( $www_dropfile );
+                touch ( $www_lastrun );
+                echo "HTTP 200 - WWW webhook recieved.";
+                die();
+        }
+        else {
+                http_response_code(429);
+                echo "HTTP 429 - Rate Limited.";
+                die();
+                }
+        die();
+
+?>
diff --git a/www-hook.php b/www-hook.php
new file mode 100644
index 0000000..e1787a3
--- /dev/null
+++ b/www-hook.php
@@ -0,0 +1,46 @@
+<?php
+/* gitea deploy webhook */
+
+/* security */
+$access_token     = 'abcdefg';
+$ansible_lastrun  = '/dev/shm/ansible-hook-last-run';
+$ansible_dropfile = '/dev/shm/run-ansible';
+$remoteip         = $_SERVER['REMOTE_ADDR'];
+$allowedip        = "195.201.242.48";
+$ratelimit        = 300;
+
+/* get json data */
+$json = file_get_contents('php://input');
+$data = json_decode($json, true);
+
+$client_token = $data["secret"];
+if ($client_token === $access_token)
+{
+    http_response_code(403);
+    echo "HTTP 403 - Forbidden, P1.";
+    die();
+}
+
+if ($remoteip != $allowedip)
+{
+    http_response_code(403);
+    echo "HTTP 403 - Forbidden, P2.";
+    //echo '\n' . $remoteip . " " . $allowedip;
+    die();
+}
+
+syslog(LOG_INFO, 'Ansible Webhook recieved.');
+        if ( time () - filemtime ( $ansible_lastrun ) > $ratelimit ) {
+                touch ( $ansible_dropfile );
+                touch ( $ansible_lastrun );
+                echo "HTTP 200 - Ansible webhook recieved.";
+                die();
+        }
+        else {
+                http_response_code(429);
+                echo "HTTP 429 - Rate Limited.";
+                die();
+                }
+        die();
+
+?>