From 1ba00dc6c6e19333dd90689dde44c8b9308dc36d Mon Sep 17 00:00:00 2001
From: Arne Teuke <arne_teuke@confdroid.com>
Date: Thu, 23 Oct 2025 21:11:21 +0200
Subject: [PATCH] add config files -
 https://gitlab.confdroid.com/internal/confdroid_management/-/issues/284

---
 manifests/params.pp                     |  5 +++
 manifests/r10k/webhook.pp               | 48 +++++++++++++++++++++----
 templates/r10k/hook_config.erb          | 18 ++++++++++
 templates/r10k/r10k_webhook_service.erb | 20 +++++------
 4 files changed, 73 insertions(+), 18 deletions(-)
 create mode 100644 templates/r10k/hook_config.erb

diff --git a/manifests/params.pp b/manifests/params.pp
index 0254e41..8651e03 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -203,6 +203,7 @@ class puppet_cd::params (
   $pt_puppetdb_var_dir              = '/opt/puppetlabs/server/data/puppetdb'
 ## r10k
   $pt_r10k_dir                      = "${pt_main_dir}/r10k"
+  $pt_r10k_webhook_dir              = */etc/r10k-webhook'
 
 # files
 ## puppet
@@ -232,6 +233,10 @@ class puppet_cd::params (
   $pt_r10k_file                     = "${pt_r10k_dir}/r10k.yaml"
   $pt_r10k_erb                      = 'puppet_cd/r10k/r10k.yaml.erb'
   $pt_r10k_hook_file                = '/usr/local/bin/webhook'
+  $pt_r10k_hook_config_file         = "${pt_r10k_webhook_dir}/hooks.json"
+  $pt_r10k_hook_config_erb          = 'puppet_cd/r10k/hook_config.erb'
+  $pt_r10k_hook_service_file        = '/etc/systemd/system/webhook.service'
+  $pt_r10k_hook_service_erb          = 'puppet_cd/r10k/r10k_webhook_service.erb'
 
 # service
   $pt_server_service                = 'puppetserver'
diff --git a/manifests/r10k/webhook.pp b/manifests/r10k/webhook.pp
index a70a6e6..ed69d98 100644
--- a/manifests/r10k/webhook.pp
+++ b/manifests/r10k/webhook.pp
@@ -20,11 +20,47 @@ class puppet_cd::r10k::webhook (
       source   => 'puppet:///modules/puppet_cd/webhook',
     }
 
-#    # manage service
-#    service { 'r10k-webhook':
-#      ensure    => 'running',
-#      enable    => true,
-#      subscribe => File[$pt_r10k_wh_config_file],
-#    }
+    # create the webhook config dir
+    file { $pt_r10k_webhook_dir:
+      ensure   => directory,
+      owner    => 'root',
+      group    => 'root',
+      mode     => '0755',
+      selrange => s0,
+      selrole  => object_r,
+      seltype  => etc_t,
+      seluser  => system_u,
+    }
+
+    # create webhook config
+    file { $pt_r10k_hook_config_file:
+      owner    => 'root',
+      group    => 'root',
+      mode     => '0644',
+      selrange => s0,
+      selrole  => object_r,
+      seltype  => etc_t,
+      seluser  => system_u,
+      content  => template($pt_r10k_hook_config_erb),
+    }
+
+    # create service config
+    file { $pt_r10k_hook_config_file:
+      owner    => 'root',
+      group    => 'root',
+      mode     => '0644',
+      selrange => s0,
+      selrole  => object_r,
+      seltype  => systemd_unit_file_t,
+      seluser  => system_u,
+      content  => template($pt_r10k_hook_service_erb),
+    }
+
+    # manage service
+    service { 'r10k-webhook':
+      ensure    => 'running',
+      enable    => true,
+      subscribe => File[$pt_r10k_hook_service_erb],
+    }
   }
 }
diff --git a/templates/r10k/hook_config.erb b/templates/r10k/hook_config.erb
new file mode 100644
index 0000000..228a093
--- /dev/null
+++ b/templates/r10k/hook_config.erb
@@ -0,0 +1,18 @@
+[
+  {
+    "id": "r10k-deploy",
+    "execute-command": "/usr/local/bin/r10k",
+    "command-working-directory": "/etc/puppetlabs/code",
+    "pass-arguments-to-command": [
+      { "source": "string", "name": "deploy" },
+      { "source": "string", "name": "environment" },
+      { "source": "string", "name": "-pv" }
+    ],
+    "trigger-rule": {
+      "match": {
+        "type": "payload-hash-sha1",
+        "secret": "your_webhook_secret"
+      }
+    }
+  }
+]
diff --git a/templates/r10k/r10k_webhook_service.erb b/templates/r10k/r10k_webhook_service.erb
index 821f0de..5581408 100644
--- a/templates/r10k/r10k_webhook_service.erb
+++ b/templates/r10k/r10k_webhook_service.erb
@@ -1,19 +1,15 @@
 [Unit]
-Description=r10k Webhook Server
-After=network.target haproxy.service
+Description=Webhook Service for r10k Deployment
+After=network.target
 
 [Service]
-Type=simple
+ExecStart=/usr/local/bin/webhook -hooks /etc/webhook/hooks.json -port 8088
+Restart=always
 User=puppet
 Group=puppet
-WorkingDirectory=/opt/r10k-webhook
-ExecStart=/usr/bin/python3 /opt/r10k-webhook/webhook_server.py
-Restart=always
-RestartSec=5
-Environment=R10K_WEBHOOK_SECRET=YOUR_SECRET_HERE
-LimitNOFILE=65536
-StandardOutput=journal
-StandardError=journal
+WorkingDirectory=/etc/puppetlabs/code
+StandardOutput=syslog
+StandardError=syslog
 
 [Install]
-WantedBy=multi-user.target
\ No newline at end of file
+WantedBy=multi-user.target