# systemd unit for the docs deploy webhook receiver (agent host).
#
# Install:
#   sudo cp publishing/webhook-receiver.service /etc/systemd/system/
#   sudo systemctl daemon-reload && sudo systemctl enable --now docs-deploy-webhook
#
# The ExecStartPre lines narrow the webhook port to the Cloudron box (which
# hosts git.inference.coop); the receiver additionally checks the source address
# and the payload signature, so a scanner hitting the port gets nothing.

[Unit]
Description=Inference docs: Gitea webhook -> build -> Surfer deploy
After=network-online.target
Wants=network-online.target

[Service]
User=ubuntu
WorkingDirectory=/home/ubuntu/.docs-publisher
Environment=DOCS_REPO_DIR=/home/ubuntu/.docs-publisher
ExecStartPre=+/bin/sh -c '/usr/sbin/iptables -C INPUT -i lo -p tcp --dport 8787 -j ACCEPT 2>/dev/null || /usr/sbin/iptables -I INPUT 1 -i lo -p tcp --dport 8787 -j ACCEPT'
ExecStartPre=+/bin/sh -c '/usr/sbin/iptables -C INPUT -p tcp --dport 8787 -s 179.237.86.116 -j ACCEPT 2>/dev/null || /usr/sbin/iptables -I INPUT 2 -p tcp --dport 8787 -s 179.237.86.116 -j ACCEPT'
ExecStartPre=+/bin/sh -c '/usr/sbin/iptables -C INPUT -p tcp --dport 8787 ! -s 179.237.86.116 -j DROP 2>/dev/null || /usr/sbin/iptables -I INPUT 3 -p tcp --dport 8787 ! -s 179.237.86.116 -j DROP'
ExecStartPre=+/bin/sh -c '/usr/sbin/ip6tables -C INPUT -p tcp --dport 8787 -j DROP 2>/dev/null || /usr/sbin/ip6tables -I INPUT -p tcp --dport 8787 -j DROP'
ExecStart=/home/ubuntu/.docs-publisher/.venv-docs/bin/python /home/ubuntu/.docs-publisher/publishing/webhook-receiver.py
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target