<?php
/**
 * deploy.php — Webhook de deploy automático para ksaldis-dt
 *
 * Gitea envía POST a esta URL al hacer push.
 * Ejecuta deploy_ksaldis.sh para actualizar el contenido.
 *
 * Configuración en Gitea:
 *   Settings → Webhooks → Add webhook (Gitea)
 *   URL: https://rmonla.duckdns.org/ksaldis-dt/deploy.php
 *   Content type: application/json
 *   Secret: ksaldis2026deploy
 *   Events: Push events
 */

define('WEBHOOK_SECRET', 'ksaldis2026deploy');

// Solo POST
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    die('Method not allowed');
}

// Verificar firma de Gitea (X-Gitea-Signature usa HMAC SHA256)
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_GITEA_SIGNATURE'] ?? '';

if ($signature) {
    $expected = hash_hmac('sha256', $payload, WEBHOOK_SECRET);
    if (!hash_equals($expected, $signature)) {
        http_response_code(403);
        die('Invalid signature');
    }
}

// Ejecutar deploy
$scriptPath = __DIR__ . '/deploy_ksaldis.sh';
$output = [];
$returnCode = 0;

exec("bash $scriptPath 2>&1", $output, $returnCode);

// Respuesta
header('Content-Type: application/json');
echo json_encode([
    'ok' => $returnCode === 0,
    'output' => implode("\n", $output),
    'time' => date('Y-m-d H:i:s')
]);