{ config, pkgs, ... }:
{
  # Auto-pull receiver for the statically hosted sites now served from
  # blunix (website, launcher). Tailnet-only: Forgejo lives on pinix and
  # reaches this over the mesh, never over the public interface.
  networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 9000 ];

  services.webhook = {
    enable = true;
    user = "drone";
    group = "users";
    port = 9000;
    ip = config.tailnetIPs.blunix;
    verbose = false;
    openFirewall = false;

    hooks = {
      gitpull-website = {
        command-working-directory = "/var/www/website";
        execute-command = "/etc/scripts/gitpull-website.sh";
      };

      gitpull-launcher = {
        command-working-directory = "/var/www/launcher";
        execute-command = "/etc/scripts/gitpull-launcher.sh";
      };
    };
  };

  environment.etc."scripts/gitpull-website.sh".source =
    pkgs.writeShellScript "gitpull-website.sh" ''
      #!/run/current-system/sw/bin/bash
      export PATH=/run/current-system/sw/bin:$PATH
      /run/current-system/sw/bin/git -C /var/www/website pull

      COMMIT=$(/run/current-system/sw/bin/git -C /var/www/website rev-parse HEAD)
      DEPLOYED_AT=$(${pkgs.coreutils}/bin/date -u +%Y-%m-%dT%H:%M:%SZ)
      printf '{"commit":"%s","deployedAt":"%s"}\n' "$COMMIT" "$DEPLOYED_AT" \
        > /var/www/website/version.json
    '';

  environment.etc."scripts/gitpull-launcher.sh".source =
    pkgs.writeShellScript "gitpull-launcher.sh" ''
      #!/run/current-system/sw/bin/bash
      export PATH=/run/current-system/sw/bin:$PATH
      /run/current-system/sw/bin/git -C /var/www/launcher pull
    '';
}