Kungani ama-webhook e-GitHub ephelelwa isikhathi ku-Jenkins engemuva kwe-VPN
I-GitHub ithumela ama-webhook ngaphakathi, ngakho i-VPN evikela i-Jenkins iyawenqaba. Dlulisela ukulethwa ngaphandle nge-relay, noma shintsha i-webhook nge-agent eyenza uphenyo.
Ikhasi lokulethwa likhombisa ukuphela kwesikhathi futhi i-Jenkins ayibhali lutho, okuwuphawu loxhumano olungakaze lufike. I-GitHub ithumela i-webhook njenge-HTTP POST ephumayo esuka engqalasizindeni yayo iya ku-payload URL oyimisile. I-VPN ivikela i-Jenkins ngokwenqaba kahle lolo hlobo loxhumano. Akukho okonakele kuzo zombili izinhlangothi. Inkinga iwumkhombandlela wesicelo.
Ukulethwa kuzama ukwenzani ngempela
I-GitHub ixazulula igama lomsingathi ku-payload URL bese ixhumana nayo isuka ku-inthanethi yomphakathi. Uma leso URL sikhomba ekhelini langasese, noma egameni elixazululwa ngaphakathi kwenethiwekhi yakho kuphela, umzamo uyehluleka ngaphambi kokuba kuthunyelwe noma yisiphi isicelo. Uma sikhomba egameni lomphakathi elilahliwe wumphetho wakho, umzamo uphela isikhathi esikhundleni salokho.
Lo mehluko ubalulekile ekuxilongeni. Ukwehluleka kwe-DNS kanye nembobo ebekiwe kokubili kubonakala sengathi akukho okwenzekile ohlangothini lwe-Jenkins, futhi kokubili kuvela ku-GitHub njengokulethwa okwehlulekile okunesizathu esihlukile esinanyathiselwe. Funda leso sizathu ngaphambi kokushintsha i-URL.
Ithimba elishaya ucingo ngaphandle alidali isilaleli. Yilowo mkhakha abantu abalindele ukuthi usebenze ngendlela ehlukile.
Izindlela ezintathu zokulungisa umkhombandlela woxhumano
Isixazululo ngasinye sishintsha ukuthi ubani oqala uxhumano, futhi kunezinhlobo ezintathu kuphela.
| Approach | Who initiates | What you give up |
|---|---|---|
| Relay service | An outbound client inside the network | A third party sees every payload |
| Reverse tunnel or ingress | The public edge, into a controlled listener | An inbound surface you must secure |
| Runner or polling | The agent, outbound to GitHub | Instant delivery, replaced by a schedule |
Uphenyo luyindlela engasemihle kakhulu futhi elula ukuyiphatha. I-relay igcina impendulo ecishe ibe ngokushesha ngaphandle kokuvula imbobo. I-runner ivamise ukuba yimpendulo efanele lapho ubumfihlo be-payload bukhipha umuntu wesithathu, ngoba umsebenzi ungasebenza kumshini osuvele ungaphakathi kwenethiwekhi.
Khetha ngokwalokho ongakwazi ukukuphatha, hhayi ngokwalokho okuzwakala kungokwesimanje.
Dlulisela ukulethwa ngaphandle nge-smee
Dala isiteshi kusevisi ye-relay bese ugcina i-URL yaso. Ngaphakathi kwenethiwekhi, faka iklayenti bese udlulisela ukulethwa endleleni i-Jenkins eyilindele. I-payload URL kuzilungiselelo zesitoreji iba i-URL yesiteshi, ngohlobo lokuqukethwe olusethelwe ku-application/json.
sudo npm install --global smee-client
smee -u CHANNEL_URL --path /github-webhook/ --port 8080Imininingwane emithathu inquma ukuthi kuzosebenza yini. Indlela kufanele ihambisane nalokho i-Jenkins ekulindele imicimbi ye-GitHub, okuyi-/github-webhook/ ngokuzenzakalela. I-Jenkins kufanele ilalele embobeni oyinikeze iklayenti. Futhi i-Jenkins URL emiswe emsebenzini kufanele ivumelane nayo leyo ndlela, kungenjalo umcimbi ufika bese ulahliwa.
Ukungafani kwe-slash yokugcina kukhiqiza i-404 efundwa njengokwehluleka kokulethwa futhi akunjalo.
Ukuyisebenzisa ukuze idle iviki
Iklayenti elingaphambili liyafa neteriminali, futhi ama-webhook asebenza usuku bese eyeka. Yinike i-unit ene-Restart=always, yisebenzise njengomsebenzisi we-Jenkins, bese ufunda i-journal ngemva kokulethwa kwangempela kokuqala. Yiso leso sinyathelo sokugcina esihlukanisa i-relay esebenzayo kweyemiswe.
[Unit]
Description=smee webhook relay
After=network.target
[Service]
Type=simple
Restart=always
RestartSec=2
User=jenkins
ExecStart=/usr/bin/smee -u CHANNEL_URL --path /github-webhook/ --port 8080
[Install]
WantedBy=multi-user.targetHlola nge-push yangempela esikhundleni senkinobho yokudlala kabusha. Ukudlala kabusha kusebenzisa i-payload egciniwe ye-relay, hhayi indlela esuka ku-GitHub iya esiteshini sakho, ngakho ingaphumelela kuyilapho ukulethwa bukhoma kusahluleka.
Khipha isexwayiso lapho i-unit ima. I-relay ewile ithule ngokwakhiwa kwayo, futhi ukuthula yikho kanye okuxazululayo.
I-relay ingabona ini, futhi nini okufanele ungayisebenzisi
I-relay iqeda i-payload, ngakho ibona amagama ezitoreji, idatha ye-commit kanye nakho konke okunye okuthwelwa umcimbi. Thatha i-URL yesiteshi njengendawo yokugcina yomphakathi. Gcina i-secret token ye-Jenkins imisiwe ukuze ukulethwa okungamanga kunqatshwe, futhi unciphise i-token esetshenziswa yi-Jenkins ibe ngconywana edingekayo.
Uma ubumfihlo be-payload bukhipha lokho, i-runner ezisingethele yona noma umhubhe ophambene oqinisekisiwe yimpendulo.
I-relay manje ingengqalasizinda, futhi ifanele ukubuyekezwa okufanayo ne-build eyiqalisayo. Phendula isiteshi uma siviza, futhi ubhale usuku owagcina ngalo uqinisekisa ukulethwa bukhoma. Faka lolo suku ku-runbook eduze kwe-URL yesiteshi. I-relay okungekho muntu oyibuyekeze unyaka iyindawo yokugcina yomphakathi okungekho muntu ongumnikazi wayo.