Add secure Node image webhook service

node-hook/src/config.mjs

@@ -0,0 +1,49 @@
+import { readFileSync } from 'node:fs';
+
+function text(name, fallback) {
+  const value = process.env[name];
+  return value === undefined || value === '' ? fallback : value;
+}
+
+function secret(name, fileName) {
+  const direct = process.env[name];
+  if (direct) {
+    return direct;
+  }
+
+  const path = process.env[fileName];
+  if (!path) {
+    throw new Error(`${name} or ${fileName} is required`);
+  }
+  return readFileSync(path, 'utf8').trim();
+}
+
+export function loadConfig() {
+  const webhookSecret = secret('GITEA_WEBHOOK_SECRET', 'GITEA_WEBHOOK_SECRET_FILE');
+  const adminSecret = secret('IMAGE_ADMIN_SECRET', 'IMAGE_ADMIN_SECRET_FILE');
+  if (webhookSecret.length < 32 || adminSecret.length < 32) {
+    throw new Error('Webhook and admin secrets must be at least 32 characters');
+  }
+
+  const allowedBranches = text('IMAGE_ALLOWED_BRANCHES', 'master')
+    .split(',')
+    .map((branch) => branch.trim())
+    .filter(Boolean);
+
+  return {
+    port: Number(text('PORT', '8081')),
+    repositoryPath: text('IMAGE_REPOSITORY_PATH', '/data/image'),
+    remoteUrl: text('IMAGE_REMOTE_URL', 'https://gitea.hided.net/devsam/image.git'),
+    repositoryFullName: text('IMAGE_REPOSITORY_FULL_NAME', 'devsam/image'),
+    defaultBranch: text('IMAGE_DEFAULT_BRANCH', 'master'),
+    allowedBranches,
+    statePath: text('IMAGE_STATE_PATH', '/var/lib/image-hook/state.json'),
+    publicBases: text('IMAGE_PUBLIC_BASES', 'https://sam.hided.net/image,https://sam-image.hided.net')
+      .split(',')
+      .map((base) => base.trim().replace(/\/$/, ''))
+      .filter(Boolean),
+    webhookSecret,
+    adminSecret,
+    maxBodyBytes: Number(text('MAX_BODY_BYTES', '1048576')),
+  };
+}