4 Commits

Include renames

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	1dacf29d53	security(deploy): webhook secrets out of git; all exposed ones rotated ... deploy/hooks-lxc*.json in this public repo held the HMAC secrets for every auto-deploy webhook (and 106's cinny-build token), readable anonymously. Six values had been committed: the four matrix-deploy secrets, 106's lotus-deploy secret (publicly reachable through chat.lotusguild.org/hooks/lotus-deploy) and the cinny-build token. - All six rotated on the servers and in Gitea (matrix hooks 6-9, cinny hook 69). The old values are rejected. - Secrets now live in /etc/webhook/secrets.env (0600) on each LXC, loaded by a systemd drop-in that also enables webhook's -template mode; the hooks files use {{ getenv "NAME" | js }} placeholders. - The repo hooks files are now exact copies of the live ones, so they also document the *-config-deploy hooks they were missing. Those three secrets were never committed and are unchanged. - README: where the secrets live and how to rotate one. - CI `hooks-no-secrets` fails if a literal secret lands in a hooks file again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-23 22:29:52 -04:00
jaredandClaude Opus 5	d3ee2e2401	fix(lxc106): hooks.json carries matrix-deploy, cinny-build and lotus-deploy ... The host's /etc/webhook/hooks.json was replaced on 2026-05-21 with a copy containing only lotus-deploy, which dropped matrix-deploy and cinny-build; this repo's copy had the opposite gap. No push to this repo has deployed to LXC 106 since May. The tracked file is now the union of all three. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-15 22:24:13 -04:00
jaredandClaude Sonnet 4.6	7f7ddd3e3c	Switch Lotus Cinny from nightly dev to stable-release fork workflow ... - Replace nightly build script with daily upstream release checker (cinny/upstream-check.sh) — posts to Matrix as LotusBot when a new cinnyapp/cinny stable release is published - Add cinny/lotus-build.sh — merges latest release tag into the lotus branch, builds, deploys; triggered via !cinny-update webhook - Fork lives at code.lotusguild.org/LotusGuild/cinny (lotus branch, v4.11.1) - deploy/hooks-lxc106.json — adds cinny-build webhook endpoint (port 9000) - Update landing page: "dev branch / nightly" → "Lotus fork / stable releases" - Set LotusBot avatar on @hookshot_tinker-tickets Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-13 16:57:35 -04:00
jaredandClaude Sonnet 4.6	5e936b2ca1	Add auto-deployment infrastructure for all 4 LXCs ... - Per-LXC deploy scripts (lxc151-hookshot, lxc106-cinny, lxc139-landing, lxc110-draupnir) - Per-LXC webhook hook configs with unique HMAC-SHA256 secrets - Livekit graceful restart script + systemd timer (waits for zero active calls) - Fix hookshot/deploy.sh capitalization bug (Uptime-Kuma, Tinker-Tickets, etc.) Each LXC independently clones repo and runs its own deploy.sh via adnanh/webhook on port 9000. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-18 11:41:32 -04:00