Loading…
Notes
Running it
php -S 0.0.0.0:8000 is enough for local testing. In production, point Apache (mod_php, AllowOverride All) or Nginx + PHP-FPM (fastcgi_pass to the php-fpm socket) at webhook.php instead.
Environment variables
Set WEBHOOK_SECRET via SetEnv in .htaccess (Apache), fastcgi_param in the Nginx site config, or the PHP-FPM pool config's env[] — whichever matches how you're actually serving this file.
Docker deployment
A minimal image is a php:8.1-apache base with webhook.php copied in and ownership handed to www-data — no Dockerfile ships in this package since the deployment target varies too much to standardize, but that's the whole shape of it.
File permissions
deploy.sh needs chmod +x, and the PHP process (usually running as www-data) needs permission to execute it — either chown the script to www-data or add that user to a group that can run it.
Logging
Every request, signature check, and deploy attempt gets written to a log file with a timestamp — tail -f it during setup instead of guessing why a webhook silently did nothing.