init

2026-10-20 02:43:27 +01:00
commit 545a9b6b88
21 changed files with 3654 additions and 0 deletions
@@ -0,0 +1,68 @@
+# Copy to .env and fill in the secrets. Never commit .env.
+#
+# Three values are what a new instance needs:
+#   1. GITEA_URL      -- the instance the bot manages
+#   2. GITEA_TOKEN    -- a DEDICATED BOT ACCOUNT's token (never an admin token)
+#   3. WEBHOOK_SECRET -- the HMAC secret of the org webhook (webhooks are the
+#                        only trigger)
+# plus NETWORK_NAME, the Docker network Gitea already runs on.
+#
+# On an instance whose Gitea runs on the same Docker daemon, point GITEA_URL at
+# the name Gitea's container has ON that network, so the bot needs no egress and
+# no published port. The alias is instance-specific -- it is the Gitea
+# container's name plus its Compose service name:
+#   GITEA_URL=http://gitea:3000                # a Compose service named `gitea`
+#   GITEA_URL=http://gitea_dcntrlized:3000     # prod: /docker/org.dcntrlized.git
+#
+# NETWORK_NAME is the REAL (project-prefixed) Docker network name, not just the
+# key in Gitea's compose file -- a Compose-defined network is named
+# `<project>_<key>`. Derive it from the running Gitea container:
+#   docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} {{end}}' gitea_dcntrlized
+#   -> orgdcntrlizedgit_gitea_dcntrlized
+# deploy.sh does this for you when NETWORK_NAME is empty.
+#
+# Remote/HTTPS instance (e.g. behind a tunnel or reverse proxy):
+#   GITEA_URL=https://git.example.org
+#   NETWORK_NAME=dcntrlized_net
+GITEA_URL=
+
+# The URL a HUMAN follows from the bot's comments (commit/file links). Set this
+# whenever GITEA_URL is the internal alias so the links are clickable:
+#   GITEA_URL=http://gitea:3000
+#   GITEA_PUBLIC_URL=https://git.example.org
+# Defaults to GITEA_URL when empty.
+GITEA_PUBLIC_URL=
+
+# Bot-account token with write access to the allowlisted repositories. Scopes:
+# write:repository (clone/push/commit status) + read:issue + write:issue
+# (read the PR file list, post/update the comment).
+GITEA_TOKEN=
+
+# HMAC-SHA256 secret configured on the Gitea webhook. Generate one with:
+#   openssl rand -hex 32
+# The bot rejects any delivery whose X-Gitea-Signature does not match.
+WEBHOOK_SECRET=
+
+# Docker network that already contains Gitea (see docker-compose.yaml). This is
+# the real Docker name, project-prefixed if Gitea's compose defines it. Leave
+# empty and deploy.sh derives it from the Gitea container; set it explicitly
+# (recommended) once you know it.
+NETWORK_NAME=
+
+# Comma-separated owner/name allowlist. Nothing outside it is ever touched.
+REPOS=Dcntrlized/Maestro,Dcntrlized/KeepNote,Dcntrlized/Calendar,Dcntrlized/dcntrlized-auth,Dcntrlized/dcntrlized-db
+
+# Commit-status context. It must equal the string configured in branch
+# protection, byte for byte, or the merge gate silently never matches.
+STATUS_CONTEXT="license-bot / addlicense"
+
+LISTEN=:8080
+DRY_RUN=false
+LOG_LEVEL=info
+
+# Optional host binding for the webhook/health port (loopback by default).
+BOT_BIND=127.0.0.1
+BOT_PORT=18080
+
+# Optional: pin the image tag (default license-bot:dev, built locally).
+# LICENSE_BOT_IMAGE=registry.example/owner/license-bot:1