gerrit: add ref-updated hook to poke forgejo

This has been deployed already.

Technically depends on I26531818a395de2a8bb6054d2583881fd1d5b806 as this
has been deployed on top of that.

Change-Id: I1b8d453d04f3a9a5435ae0dd6575f82d9ca10db7
Reviewed-on: https://gerrit.hackerspace.pl/c/hscloud/+/1681
Reviewed-by: informatic <informatic@hackerspace.pl>
diff --git a/devtools/gerrit/hooks/ref-updated b/devtools/gerrit/hooks/ref-updated
new file mode 100755
index 0000000..943aec8
--- /dev/null
+++ b/devtools/gerrit/hooks/ref-updated
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -e
+
+# This will be ran by Gerrit any time a new Git commit is pushed, and will make
+# Forgejo pull our changes.
+
+if [ -z "$FORGEJO_TOKEN" ]; then
+    echo "FORGEJO_TOKEN must be set" > /dev/stderr
+    exit 1
+fi
+
+# The gerrit image has no curl. But where we're going, we don't need curl.
+auth="$(echo -ne "gerrit:$FORGEJO_TOKEN" | base64)"
+openssl s_client -quiet -crlf -connect git.hackerspace.pl:443 <<EOF
+POST /api/v1/repos/hswaw/hscloud/mirror-sync HTTP/1.1
+Host: git.hackerspace.pl
+Authorization: Basic $auth
+Content-length: 0
+Connection: Close
+
+EOF