diff options
Diffstat (limited to 'roles/git/files/runner-zola/webhook.sh')
| -rwxr-xr-x | roles/git/files/runner-zola/webhook.sh | 21 |
1 files changed, 18 insertions, 3 deletions
diff --git a/roles/git/files/runner-zola/webhook.sh b/roles/git/files/runner-zola/webhook.sh index 1c10685..b874233 100755 --- a/roles/git/files/runner-zola/webhook.sh +++ b/roles/git/files/runner-zola/webhook.sh @@ -18,9 +18,24 @@ while true; do REF=${REF:-main} if [ ! -d blog ]; then - # Use non-redirected port as redirection is handled via PREROUTING - # iptables rules and if this hook runs on the same machine the request - # packages will not go through the routing chain. + # Use non-redirected port to clone repository as the runner executes on + # the same machine as the webserver. + # + # We use a NAT:PREROUTING chain to implement the redirection (dnat). + # However as described by the netfilter packet flow and the connection + # tracking system (CONNTRACK), the NAT hooks are only traversed for NEW + # connections. + # For packages originating from the local machine, the connection will + # be seen as NEW by the CONNTRACK system on the OUTPUT path and hence + # the NAT:OUTPUT hooks will be traversed. + # Once the package is looped-back and arrives at the PREROUTING path, + # the NAT:PREROUTING rules wont be traversed as the package is already + # known to the CONNTRACK system (not NEW). + # + # We could additionally implement dnat for lo interface on the OUTPUT + # path as described here, but we dont do it and just use the actual + # port here :^) + # https://unix.stackexchange.com/questions/618229/nftables-destination-nat-block-local-access-to-port git clone https://git.memzero.de:8443/blog fi git -C blog submodule init |