How this site deploys itself

When I push to GitHub, this happens:

1. GitHub sends a POST to /_deploy, signed with a shared secret (HMAC-SHA256).
2. Apache hands that one path to a small Node listener on localhost.
3. The listener checks the signature in constant time. Anything unsigned gets a 401.
4. On a valid push it runs git reset, npm ci and astro build, then rsyncs the output into the web root.

If the build fails, nothing is copied, so a broken push never takes the site down.

const expected = 'sha256=' + createHmac('sha256', SECRET).update(body).digest('hex');
return timingSafeEqual(Buffer.from(header), Buffer.from(expected));