security(deploy): webhook secrets out of git; all exposed ones rotated

deploy/hooks-lxc*.json in this public repo held the HMAC secrets for
every auto-deploy webhook (and 106's cinny-build token), readable
anonymously. Six values had been committed: the four matrix-deploy
secrets, 106's lotus-deploy secret (publicly reachable through
chat.lotusguild.org/hooks/lotus-deploy) and the cinny-build token.

- All six rotated on the servers and in Gitea (matrix hooks 6-9,
  cinny hook 69). The old values are rejected.
- Secrets now live in /etc/webhook/secrets.env (0600) on each LXC, loaded
  by a systemd drop-in that also enables webhook's -template mode; the
  hooks files use {{ getenv "NAME" | js }} placeholders.
- The repo hooks files are now exact copies of the live ones, so they
  also document the *-config-deploy hooks they were missing. Those
  three secrets were never committed and are unchanged.
- README: where the secrets live and how to rotate one.
- CI `hooks-no-secrets` fails if a literal secret lands in a hooks
  file again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

deploy/hooks-lxc106.json

@@ -7,7 +7,7 @@
     "trigger-rule": {
       "match": {
         "type": "payload-hash-sha256",
-        "secret": "76dd5febd1cc3458545ce37537f4bfe26f241a9635b57a2cba183ebc9221230b",
+        "secret": "{{ getenv "MATRIX_DEPLOY_SECRET" | js }}",
         "parameter": {
           "source": "header",
           "name": "X-Gitea-Signature"
@@ -23,7 +23,7 @@
     "trigger-rule": {
       "match": {
         "type": "value",
-        "value": "a82340fc2f07e6afda097494c34aa3a4877924932a0b063a76106fdab9816ec6",
+        "value": "{{ getenv "CINNY_BUILD_TOKEN" | js }}",
         "parameter": {
           "source": "header",
           "name": "X-Build-Token"
@@ -41,7 +41,7 @@
         {
           "match": {
             "type": "payload-hash-sha256",
-            "secret": "7b333a1bf4c02aacece65de00e6d8c3e86881f1254f4efa91aeddb82b67dd50f",
+            "secret": "{{ getenv "LOTUS_DEPLOY_SECRET" | js }}",
             "parameter": {
               "source": "header",
               "name": "X-Gitea-Signature"

deploy/hooks-lxc110.json

@@ -7,12 +7,42 @@
     "trigger-rule": {
       "match": {
         "type": "payload-hash-sha256",
-        "secret": "0d23fab8743e9ee6b52cbd05a889b04c927ffa2b2b21fe50244f1a534d1a22d0",
+        "secret": "{{ getenv "MATRIX_DEPLOY_SECRET" | js }}",
         "parameter": {
           "source": "header",
           "name": "X-Gitea-Signature"
         }
       }
     }
+  },
+  {
+    "id": "110-config-deploy",
+    "execute-command": "/usr/local/bin/draupnir_deploy.sh",
+    "command-working-directory": "/opt/pve-infra",
+    "response-message": "Deploying draupnir config...",
+    "trigger-rule": {
+      "and": [
+        {
+          "match": {
+            "type": "payload-hash-sha256",
+            "secret": "{{ getenv "CONFIG_DEPLOY_SECRET" | js }}",
+            "parameter": {
+              "source": "header",
+              "name": "X-Gitea-Signature"
+            }
+          }
+        },
+        {
+          "match": {
+            "type": "value",
+            "value": "refs/heads/main",
+            "parameter": {
+              "source": "payload",
+              "name": "ref"
+            }
+          }
+        }
+      ]
+    }
   }
 ]

deploy/hooks-lxc139.json

@@ -7,12 +7,42 @@
     "trigger-rule": {
       "match": {
         "type": "payload-hash-sha256",
-        "secret": "ddea576ef03bff35f0c9d138b626b273d9e9502434e0717899a87677cd5ac267",
+        "secret": "{{ getenv "MATRIX_DEPLOY_SECRET" | js }}",
         "parameter": {
           "source": "header",
           "name": "X-Gitea-Signature"
         }
       }
     }
+  },
+  {
+    "id": "139-config-deploy",
+    "execute-command": "/usr/local/bin/nginxproxymanager_deploy.sh",
+    "command-working-directory": "/opt/pve-infra",
+    "response-message": "Deploying nginxproxymanager config...",
+    "trigger-rule": {
+      "and": [
+        {
+          "match": {
+            "type": "payload-hash-sha256",
+            "secret": "{{ getenv "CONFIG_DEPLOY_SECRET" | js }}",
+            "parameter": {
+              "source": "header",
+              "name": "X-Gitea-Signature"
+            }
+          }
+        },
+        {
+          "match": {
+            "type": "value",
+            "value": "refs/heads/main",
+            "parameter": {
+              "source": "payload",
+              "name": "ref"
+            }
+          }
+        }
+      ]
+    }
   }
 ]

deploy/hooks-lxc151.json

@@ -7,12 +7,42 @@
     "trigger-rule": {
       "match": {
         "type": "payload-hash-sha256",
-        "secret": "38ba0e66763da2096c47645cbf636ce3c2c51232e006b964e57d6bb94a32dcaa",
+        "secret": "{{ getenv "MATRIX_DEPLOY_SECRET" | js }}",
         "parameter": {
           "source": "header",
           "name": "X-Gitea-Signature"
         }
       }
     }
+  },
+  {
+    "id": "151-config-deploy",
+    "execute-command": "/usr/local/bin/matrix_deploy.sh",
+    "command-working-directory": "/opt/pve-infra",
+    "response-message": "Deploying matrix config...",
+    "trigger-rule": {
+      "and": [
+        {
+          "match": {
+            "type": "payload-hash-sha256",
+            "secret": "{{ getenv "CONFIG_DEPLOY_SECRET" | js }}",
+            "parameter": {
+              "source": "header",
+              "name": "X-Gitea-Signature"
+            }
+          }
+        },
+        {
+          "match": {
+            "type": "value",
+            "value": "refs/heads/main",
+            "parameter": {
+              "source": "payload",
+              "name": "ref"
+            }
+          }
+        }
+      ]
+    }
   }
 ]