Add templates and logic to set up manifests for Github webhook receiver (#308)

Co-authored-by: Devin Buhl <onedr0p@users.noreply.github.com>

configure.sh

@@ -71,6 +71,7 @@ main() {
         # generate ansible hosts file and secrets
         generate_ansible_hosts
         generate_ansible_host_secrets
+        setup_github_webhook
     fi
 }
 
@@ -165,6 +166,7 @@ verify_binaries() {
     _has_binary "helm"
     _has_binary "ipcalc"
     _has_binary "jq"
+    _has_binary "yq"
     _has_binary "sops"
     _has_binary "ssh"
     _has_binary "task"
@@ -206,6 +208,32 @@ verify_git_repository() {
     export GIT_TERMINAL_PROMPT=1
 }
 
+setup_github_webhook() {
+    WEBHOOK_SECRET="${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET:-ignored}"
+
+    if [[ "${WEBHOOK_SECRET}" != "ignored" ]]; then
+        if [[ "${WEBHOOK_SECRET}" == "generated" ]]; then
+            WEBHOOK_SECRET="$(openssl rand -base64 30)"
+        fi
+
+        export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="${WEBHOOK_SECRET}"
+        _log "INFO" "Using GitHub Token '${WEBHOOK_SECRET}' for Flux"
+
+        cp -rf  "${PROJECT_DIR}/tmpl/cluster/flux-system" "${PROJECT_DIR}/cluster/apps/"
+
+        WEBHOOK_DIR="${PROJECT_DIR}/cluster/apps/flux-system/webhooks/github/"
+
+        envsubst < "${WEBHOOK_DIR}/receiver.yaml" | tee "${WEBHOOK_DIR}/receiver.yaml" > /dev/null
+        envsubst < "${WEBHOOK_DIR}/secret.sops.yaml" | tee "${WEBHOOK_DIR}/secret.sops.yaml" > /dev/null
+
+        sops --encrypt --in-place "${WEBHOOK_DIR}/secret.sops.yaml"
+
+        if [[ $(yq eval --no-doc 'contains({"resources": ["flux-system"]})' "${PROJECT_DIR}/cluster/apps/kustomization.yaml") == false ]]; then
+            yq -i '.resources += [ "flux-system" ]' "${PROJECT_DIR}/cluster/apps/kustomization.yaml"
+        fi
+    fi
+}
+
 verify_cloudflare() {
     local account_zone=
     local errors=