git_pull.sh

#!/bin/bash
set -e

# Pull from git
cd /home/ubuntu/jorianwoltjer.com
git reset --hard origin/main
git clean -f
git pull
# Rebuild and start container
export DOCKER_BUILDKIT=1
export COMPOSE_DOCKER_CLI_BUILD=1
screen -d -m docker-compose up --build -d
screen -ls

git_push.php

<?php
// Source (changed): https://gist.github.com/cowboy/619858?permalink_comment_id=2823402#gistcomment-2823402

// GitHub Webhook Secret: Keep it the same with the 'Secret' field on your Webhooks / Manage webhook page of your respostory.
$secret = "";
assert($secret !== "");

// Header deliveried from GitHub
$signature = $_SERVER['HTTP_X_HUB_SIGNATURE_256'];

if ($_SERVER['REQUEST_METHOD'] === "POST" && $signature) {
  $hash = "sha256=".hash_hmac('sha256', file_get_contents("php://input"), $secret);
  if (strcmp($signature, $hash) === 0) {
    header("Content-Type: text/plain");
    // Set your repository owner's user here, and path to git_pull.sh script
    echo shell_exec("sudo -u ubuntu /var/www/git_pull.sh 2>&1");
    exit();
  }
}

http_response_code(403);

nginx.conf

server {
        listen 80;
        listen [::]:80;
        server_name jorianwoltjer.com;

        location / {
                proxy_pass http://127.0.0.1:81;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
        }

        location = /git_push {
                fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
                include fastcgi_params;
                fastcgi_param SCRIPT_FILENAME /var/www/git_push.php;
        }
}

sudoers

# Custom: required for www-data to run git
www-data ALL = (ubuntu) NOPASSWD : /var/www/git_pull.sh