chore: move github sponsors webhook to its own service

Signed-off-by: Xe Iaso <me@xeiaso.net>

Author: Xe

.github/workflows/earthly.yml

@@ -2,11 +2,11 @@ name: Docker
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
     # Publish semver tags as releases.
-    tags: [ 'v*.*.*' ]
+    tags: ["v*.*.*"]
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
 
 jobs:
   build:
@@ -21,7 +21,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Log into registry 
+      - name: Log into registry
         if: github.event_name != 'pull_request'
         uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
         with:
@@ -37,6 +37,7 @@ jobs:
           source: .
           push: true
           set: |
+            github-sponsor-webhook.tags=ghcr.io/xe/site/github-sponsor-webhook:latest
             patreon-saasproxy.tags=ghcr.io/xe/site/patreon-saasproxy:latest
             xesite.tags=ghcr.io/xe/site/bin:latest
 
@@ -47,7 +48,6 @@ jobs:
           source: .
           push: false
           set: |
+            github-sponsor-webhook.tags=ghcr.io/xe/site/github-sponsor-webhook:latest
             patreon-saasproxy.tags=ghcr.io/xe/site/patreon-saasproxy:latest
             xesite.tags=ghcr.io/xe/site/bin:latest
-
-  

.gitignore

@@ -11,3 +11,4 @@ cw.tar
 node_modules
 /xesite
 /xesitectl
+/github-sponsor-webhook

cmd/github-sponsor-webhook/main.go

@@ -0,0 +1,71 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"log"
+	"log/slog"
+	"net"
+	"net/http"
+	"os"
+
+	"github.com/donatj/hmacsig"
+	"github.com/facebookgo/flagenv"
+	_ "github.com/joho/godotenv/autoload"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"xeiaso.net/v4/internal"
+)
+
+var (
+	bind                 = flag.String("bind", ":8080", "Port to listen on")
+	dataDir              = flag.String("data-dir", "./var", "Directory to store data in")
+	githubSponsorsSecret = flag.String("github-sponsors-secret", "", "GitHub Sponsors secret to use for webhooks")
+	logLevel             = flag.String("log-level", "info", "Log level (debug, info, warn, error)")
+)
+
+func main() {
+	flagenv.Parse()
+	flag.Parse()
+	internal.Slog()
+
+	_ = context.Background()
+
+	ln, err := net.Listen("tcp", *bind)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	os.MkdirAll(*dataDir, 0700)
+
+	if *githubSponsorsSecret == "" {
+		slog.Error("github-sponsors-secret is required")
+		os.Exit(1)
+	}
+
+	slog.Info("starting GitHub Sponsors webhook service",
+		"bind", *bind,
+		"data_dir", *dataDir,
+	)
+
+	gsh := &GitHubSponsorsWebhook{}
+	s := hmacsig.Handler256(gsh, *githubSponsorsSecret)
+
+	mux := http.NewServeMux()
+	mux.Handle("/webhook", s)
+	mux.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"status":"ok","service":"github-sponsor-webhook"}`))
+	})
+
+	// Expose Prometheus metrics at /metrics for observability
+	mux.Handle("/metrics", promhttp.Handler())
+
+	var h http.Handler = mux
+	h = internal.CacheHeader(h)
+	h = internal.AcceptEncodingMiddleware(h)
+	h = internal.RefererMiddleware(h)
+
+	slog.Info("GitHub Sponsors webhook service ready", "bind", *bind)
+	log.Fatal(http.Serve(ln, h))
+}

cmd/xesite/github_sponsors.go cmd/github-sponsor-webhook/webhook.gocmd/xesite/github_sponsors.go renamed to cmd/github-sponsor-webhook/webhook.go

@@ -2,38 +2,65 @@ package main
 
 import (
 	"encoding/json"
-	"expvar"
 	"fmt"
 	"log/slog"
 	"net/http"
 
-	"tailscale.com/metrics"
+	"github.com/prometheus/client_golang/prometheus"
 	"xeiaso.net/v4/internal/github"
-	"xeiaso.net/v4/internal/lume"
 )
 
 var (
-	sponsorsWebhookCount = metrics.LabelMap{Label: "action"}
-	sponsorsErrorCount   = metrics.LabelMap{Label: "error_type"}
+	sponsorsWebhookCount = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "github_sponsors_webhook_total",
+			Help: "Total number of GitHub Sponsors webhook events processed, by action",
+		},
+		[]string{"action"},
+	)
+
+	sponsorsErrorCount = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "github_sponsors_webhook_errors_total",
+			Help: "Total number of GitHub Sponsors webhook errors, by error type",
+		},
+		[]string{"error_type"},
+	)
 )
 
 func init() {
-	expvar.Publish("gauge_xesite_sponsors_webhook_count", &sponsorsWebhookCount)
-	expvar.Publish("gauge_xesite_sponsors_error_count", &sponsorsErrorCount)
+	prometheus.MustRegister(sponsorsWebhookCount)
+	prometheus.MustRegister(sponsorsErrorCount)
 }
 
 // GitHubSponsorsWebhook handles GitHub Sponsors webhook events.
 type GitHubSponsorsWebhook struct {
-	fs *lume.FS
+	// No lume.FS dependency for the standalone service
 }
 
 // ServeHTTP processes incoming GitHub Sponsors webhook events.
 func (gsh *GitHubSponsorsWebhook) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// Set CORS headers for web requests
+	w.Header().Set("Access-Control-Allow-Origin", "*")
+	w.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS")
+	w.Header().Set("Access-Control-Allow-Headers", "Content-Type, X-GitHub-Event, X-Hub-Signature-256")
+
+	if r.Method == "OPTIONS" {
+		w.WriteHeader(http.StatusOK)
+		return
+	}
+
+	if r.Method != "POST" {
+		slog.Info("method not allowed", "method", r.Method)
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
 	// Check for GitHub Sponsors event header
 	eventType := r.Header.Get("X-GitHub-Event")
 	if eventType != "sponsorship" {
 		slog.Info("not a sponsorship event", "event", eventType)
-		sponsorsErrorCount.Add("invalid_event_type", 1)
+		sponsorsErrorCount.WithLabelValues("invalid_event_type").Inc()
 		http.Error(w, "Invalid event type", http.StatusBadRequest)
 		return
 	}
@@ -42,13 +69,13 @@ func (gsh *GitHubSponsorsWebhook) ServeHTTP(w http.ResponseWriter, r *http.Reque
 	var event github.SponsorsEvent
 	if err := json.NewDecoder(r.Body).Decode(&event); err != nil {
 		slog.Error("error decoding GitHub Sponsors event", "error", err)
-		sponsorsErrorCount.Add("decode_error", 1)
+		sponsorsErrorCount.WithLabelValues("decode_error").Inc()
 		http.Error(w, err.Error(), http.StatusBadRequest)
 		return
 	}
 
 	// Increment the specific action counter
-	sponsorsWebhookCount.Add(event.Action, 1)
+	sponsorsWebhookCount.WithLabelValues(event.Action).Inc()
 
 	// Log the sponsorship event
 	slog.Info("GitHub Sponsors webhook received",
@@ -57,6 +84,7 @@ func (gsh *GitHubSponsorsWebhook) ServeHTTP(w http.ResponseWriter, r *http.Reque
 		"sponsorable", event.Sponsorship.Sponsorable.Login,
 		"tier", event.Sponsorship.Tier.Name,
 		"monthly_price", event.Sponsorship.Tier.MonthlyPriceInDollars,
+		"sender", event.Sender.Login,
 	)
 
 	// Handle different sponsorship event types
@@ -73,19 +101,22 @@ func (gsh *GitHubSponsorsWebhook) ServeHTTP(w http.ResponseWriter, r *http.Reque
 		gsh.handlePendingCancellation(event)
 	default:
 		slog.Info("unhandled GitHub Sponsors event type", "action", event.Action)
-		sponsorsErrorCount.Add("unhandled_action", 1)
+		sponsorsErrorCount.WithLabelValues("unhandled_action").Inc()
 	}
 
 	// Respond with success
+	w.Header().Set("Content-Type", "text/plain")
 	fmt.Fprintln(w, "OK")
 }
 
 // handleSponsorshipCreated processes new sponsorships
 func (gsh *GitHubSponsorsWebhook) handleSponsorshipCreated(event github.SponsorsEvent) {
 	slog.Info("New sponsorship created",
 		"sponsor", event.Sponsorship.Sponsor.Login,
+		"sponsor_id", event.Sponsorship.Sponsor.ID,
 		"tier", event.Sponsorship.Tier.Name,
 		"monthly_price", event.Sponsorship.Tier.MonthlyPriceInDollars,
+		"privacy_level", event.Sponsorship.PrivacyLevel,
 	)
 	// TODO: Add sponsorship creation logic here
 	// This could include updating database records, sending notifications, etc.
@@ -95,8 +126,10 @@ func (gsh *GitHubSponsorsWebhook) handleSponsorshipCreated(event github.Sponsors
 func (gsh *GitHubSponsorsWebhook) handleSponsorshipEdited(event github.SponsorsEvent) {
 	slog.Info("Sponsorship edited",
 		"sponsor", event.Sponsorship.Sponsor.Login,
+		"sponsor_id", event.Sponsorship.Sponsor.ID,
 		"tier", event.Sponsorship.Tier.Name,
 		"monthly_price", event.Sponsorship.Tier.MonthlyPriceInDollars,
+		"privacy_level", event.Sponsorship.PrivacyLevel,
 	)
 	// TODO: Add sponsorship edit logic here
 	// This could include updating records, changing access levels, etc.
@@ -106,6 +139,7 @@ func (gsh *GitHubSponsorsWebhook) handleSponsorshipEdited(event github.SponsorsE
 func (gsh *GitHubSponsorsWebhook) handleSponsorshipCancelled(event github.SponsorsEvent) {
 	slog.Info("Sponsorship cancelled",
 		"sponsor", event.Sponsorship.Sponsor.Login,
+		"sponsor_id", event.Sponsorship.Sponsor.ID,
 		"tier", event.Sponsorship.Tier.Name,
 	)
 	// TODO: Add sponsorship cancellation logic here
@@ -116,6 +150,7 @@ func (gsh *GitHubSponsorsWebhook) handleSponsorshipCancelled(event github.Sponso
 func (gsh *GitHubSponsorsWebhook) handlePendingTierChange(event github.SponsorsEvent) {
 	slog.Info("Pending sponsorship tier change",
 		"sponsor", event.Sponsorship.Sponsor.Login,
+		"sponsor_id", event.Sponsorship.Sponsor.ID,
 		"tier", event.Sponsorship.Tier.Name,
 		"monthly_price", event.Sponsorship.Tier.MonthlyPriceInDollars,
 	)
@@ -126,7 +161,8 @@ func (gsh *GitHubSponsorsWebhook) handlePendingTierChange(event github.SponsorsE
 func (gsh *GitHubSponsorsWebhook) handlePendingCancellation(event github.SponsorsEvent) {
 	slog.Info("Pending sponsorship cancellation",
 		"sponsor", event.Sponsorship.Sponsor.Login,
+		"sponsor_id", event.Sponsorship.Sponsor.ID,
 		"tier", event.Sponsorship.Tier.Name,
 	)
 	// TODO: Add pending cancellation logic here
-}
+}

cmd/xesite/main.go

@@ -21,18 +21,17 @@ import (
 )
 
 var (
-	bind                 = flag.String("bind", ":3000", "Port to listen on")
-	devel                = flag.Bool("devel", false, "Enable development mode")
-	dataDir              = flag.String("data-dir", "./var", "Directory to store data in")
-	futureSightURL       = flag.String("future-sight-url", "", "URL to use for future sight preview deploys")
-	gitBranch            = flag.String("git-branch", "main", "Git branch to clone")
-	gitRepo              = flag.String("git-repo", "https://github.com/Xe/site", "Git repository to clone")
-	githubSecret         = flag.String("github-secret", "", "GitHub secret to use for webhooks")
-	githubSponsorsSecret = flag.String("github-sponsors-secret", "", "GitHub Sponsors secret to use for webhooks")
-	internalAPIBind      = flag.String("internal-api-bind", ":3001", "Port to listen on for the internal API")
-	miURL                = flag.String("mimi-announce-url", "", "Mi url (named mimi-announce-url for historical reasons)")
-	patreonSaasProxyURL  = flag.String("patreon-saasproxy-url", "http://xesite-patreon-saasproxy.flycast", "URL to use for the patreon saasproxy")
-	siteURL              = flag.String("site-url", "https://xeiaso.net/", "URL to use for the site")
+	bind                = flag.String("bind", ":3000", "Port to listen on")
+	devel               = flag.Bool("devel", false, "Enable development mode")
+	dataDir             = flag.String("data-dir", "./var", "Directory to store data in")
+	futureSightURL      = flag.String("future-sight-url", "", "URL to use for future sight preview deploys")
+	gitBranch           = flag.String("git-branch", "main", "Git branch to clone")
+	gitRepo             = flag.String("git-repo", "https://github.com/Xe/site", "Git repository to clone")
+	githubSecret        = flag.String("github-secret", "", "GitHub secret to use for webhooks")
+	internalAPIBind     = flag.String("internal-api-bind", ":3001", "Port to listen on for the internal API")
+	miURL               = flag.String("mimi-announce-url", "", "Mi url (named mimi-announce-url for historical reasons)")
+	patreonSaasProxyURL = flag.String("patreon-saasproxy-url", "http://xesite-patreon-saasproxy.flycast", "URL to use for the patreon saasproxy")
+	siteURL             = flag.String("site-url", "https://xeiaso.net/", "URL to use for the site")
 )
 
 func main() {
@@ -84,7 +83,6 @@ func main() {
 
 	mux := http.NewServeMux()
 	mux.Handle("/", http.FileServerFS(fs))
-	//mux.Handle("/", http.FileServer(http.FS(fs)))
 	mux.Handle("/api/defs/", http.StripPrefix("/api/defs/", http.FileServer(http.FS(pb.Proto))))
 
 	ms := pb.NewMetaServer(&MetaServer{fs}, twirp.WithServerPathPrefix("/api"))
@@ -114,11 +112,6 @@ func main() {
 	gh := &GitHubWebhook{fs: fs}
 	s := hmacsig.Handler256(gh, *githubSecret)
 	mux.Handle("/.within/hook/github", s)
-
-	gsh := &GitHubSponsorsWebhook{fs: fs}
-	ss := hmacsig.Handler256(gsh, *githubSponsorsSecret)
-	mux.Handle("/.within/hook/github-sponsors", ss)
-
 	mux.Handle("/.within/hook/patreon", &PatreonWebhook{fs: fs})
 
 	mux.HandleFunc("/static/talks/irc-why-it-failed.pdf", func(w http.ResponseWriter, r *http.Request) {

docker-bake.hcl

@@ -12,7 +12,7 @@ variable "TYPST_VERSION" { default = "0.13.1" }
 variable "UBUNTU_VERSION" { default = "24.04" }
 
 group "default" {
-  targets = [ "patreon-saasproxy", "xesite" ]
+  targets = [ "patreon-saasproxy", "xesite", "github-sponsor-webhook" ]
 }
 
 target "patreon-saasproxy" {
@@ -50,4 +50,18 @@ target "xesite" {
   tags = [
     "registry.int.xeserv.us/xe/site/bin:main"
   ]
+}
+
+target "github-sponsor-webhook" {
+  args = {
+    ALPINE_VERSION = null
+    GO_VERSION = null
+  }
+  context = "."
+  dockerfile = "./docker/github-sponsor-webhook.Dockerfile"
+  platforms = [ "linux/amd64", "linux/arm64" ]
+  pull = true
+  tags = [
+    "registry.int.xeserv.us/xe/site/github-sponsor-webhook:main"
+  ]
 }

docker/github-sponsor-webhook.Dockerfile

@@ -0,0 +1,30 @@
+ARG GO_VERSION=1.25
+ARG ALPINE_VERSION=edge
+
+FROM --platform=${BUILDPLATFORM} golang:${GO_VERSION}-alpine AS build
+
+ARG TARGETOS
+ARG TARGETARCH
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN --mount=type=cache,target=/root/.cache GOOS=${TARGETOS} GOARCH=${TARGETARCH} CGO_ENABLED=0 go build -gcflags "all=-N -l" -o /app/bin/github-sponsor-webhook ./cmd/github-sponsor-webhook
+
+FROM alpine:${ALPINE_VERSION} AS run
+WORKDIR /app
+
+RUN apk add --no-cache ca-certificates
+
+COPY --from=build /app/bin/github-sponsor-webhook /app/bin/github-sponsor-webhook
+
+EXPOSE 8080
+
+CMD ["/app/bin/github-sponsor-webhook"]
+
+LABEL org.opencontainers.image.source="https://github.com/Xe/site"
+LABEL org.opencontainers.image.title="GitHub Sponsors Webhook Service"
+LABEL org.opencontainers.image.description="Standalone webhook service for processing GitHub Sponsors events"