From 89a4a3991b37784a2c262143256bac905d47af49 Mon Sep 17 00:00:00 2001 From: TZGyn Date: Sun, 25 Oct 2026 14:43:02 +0800 Subject: [PATCH] Document Gitea webhook verification details --- AGENTS.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 5d210bd..bd9de7f 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -48,6 +48,14 @@ what we take vs. skip). Never vendor it into the build. in project Personal, `https://tunnel.tzgyn.dev`, deploy-key source on the shared `gitea` key, push to `main` auto-deploys via the Gitea webhook. Redeploy with `POST /api/v1/deploy?uuid=` (the GET form is gone). + Webhook details when debugging: Coolify's *manual* Gitea webhook verifies + `X-Hub-Signature-256` (HMAC-SHA256 hex of the raw body with the app's + `manual_webhook_secret_gitea`; Gitea sends this header natively) and + matches apps by `repository.full_name` against the app's `git_repository` + after canonicalization — the `:22222` port in the scp-style URL is ignored, + so it matches fine. A curl replay needs `X-Gitea-Event: push` and the + signature header, or it answers "No matching application or invalid + signature." This Coolify version stores `custom_labels` **base64-encoded** and does *not* merge its generated Traefik labels for API-created apps: the full label set must live in `custom_labels` (mirror a working app's generated