Merge branch 'master' into cd/goreleaser

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: taigrr

.gitignore

@@ -7,3 +7,4 @@ config.toml
 config.yaml
 config.json
 *.env
+.crush

README.md

@@ -34,7 +34,7 @@ signal-cli -a +1YOURNUMBER updateProfile --avatar assets/octocat.png
 ### 2. Run signal-cli daemon
 
 ```bash
-signal-cli -a +1YOURNUMBER daemon --http 127.0.0.1:8080 --no-receive-stdout
+signal-cli -a +1YOURNUMBER daemon --http 127.0.0.1:8081 --no-receive-stdout
 ```
 
 ### 3. Configure
@@ -49,7 +49,7 @@ webhook_secret = "your-secret-here"
 listen_addr = ":9900"
 
 # signal-cli JSON-RPC endpoint
-signal_url = "http://127.0.0.1:8080"
+signal_url = "http://127.0.0.1:8081"
 
 # signal-cli account (phone number registered with signal-cli)
 signal_account = "+1YOURNUMBER"
@@ -122,6 +122,23 @@ sudo nginx -t && sudo systemctl reload nginx
 
 Edit the service files first to set your phone number and paths. The signal-cli daemon listens on `127.0.0.1:8081` (not 8080, to avoid conflicts). Update `signal_url` in your config.toml to match.
 
+### SSL with Certbot
+
+Install certbot and the nginx plugin, then request a certificate:
+
+```bash
+# Install certbot (Debian/Ubuntu)
+sudo apt install certbot python3-certbot-nginx
+
+# Request certificate (certbot auto-configures nginx)
+sudo certbot --nginx -d ghwebhook.example.com
+
+# Verify auto-renewal is enabled
+sudo systemctl status certbot.timer
+```
+
+Certbot will automatically modify the nginx config to enable SSL and set up renewal. The signal-cli daemon listens on `127.0.0.1:8081` (not 8080, to avoid conflicts). Update `signal_url` in your config.toml to match.
+
 ## Dependencies
 
 - [cbrgm/githubevents](https://github.com/cbrgm/githubevents) — GitHub webhook event handling

config.example.toml

@@ -5,10 +5,10 @@ webhook_secret = ""
 listen_addr = ":9900"
 
 # signal-cli JSON-RPC endpoint
-signal_url = "http://127.0.0.1:8080"
+signal_url = "http://127.0.0.1:8081"
 
 # signal-cli account (phone number registered with signal-cli)
-signal_account = "+1234567890"
+signal_account = "+YOURNUMBER"
 
 # Signal recipient UUID for DM notifications
 signal_recipient = ""

deploy/github-to-signal.nginx.conf

@@ -1,9 +1,12 @@
 server {
-    listen 443 ssl;
-    server_name ghooks.org;
 
-    ssl_certificate     /etc/letsencrypt/live/ghwebhook.example.com/fullchain.pem;
+    listen 80;
-    ssl_certificate_key /etc/letsencrypt/live/ghwebhook.example.com/privkey.pem;
+    # listen 443 ssl;
+    server_name ghwebhook.example.com;
+
+    # let certbot handle the SSL setup and renewal
+    # ssl_certificate     /etc/letsencrypt/live/ghwebhook.example.com/fullchain.pem;
+    # ssl_certificate_key /etc/letsencrypt/live/ghwebhook.example.com/privkey.pem;
 
     location /webhook {
         proxy_pass http://127.0.0.1:9900;

deploy/signal-cli-bot.service

@@ -5,7 +5,7 @@ Wants=network-online.target
 
 [Service]
 Type=exec
-ExecStart=/usr/local/bin/signal-cli -a +18134455076 daemon --http 127.0.0.1:8081 --no-receive-stdout
+ExecStart=/usr/local/bin/signal-cli -a +YOURNUMBER daemon --http 127.0.0.1:8081 --no-receive-stdout
 Restart=on-failure
 RestartSec=5