Правки различные

VM1_app/codebase/backend/scripts/validate-env

@@ -197,14 +197,29 @@ def validate_shared(env: dict[str, str], errors: list[str]) -> None:
             errors.append(f"{key}: ожидается http URL с Docker DNS service name")
     if not env.get("KEYCLOAK_INTERNAL_URL", "").rstrip("/").endswith("/auth"):
         errors.append("KEYCLOAK_INTERNAL_URL: внутренний URL должен заканчиваться на /auth")
-    if env.get("MESSAGE_SAFETY_URL", "").rstrip("/") != "https://processing.internal:8443":
+    safety_url = env.get("MESSAGE_SAFETY_URL", "").rstrip("/")
+    parsed_safety_url = urlparse(safety_url)
+    try:
+        safety_port = parsed_safety_url.port
+    except ValueError:
+        safety_port = None
+    safety_host = parsed_safety_url.hostname or ""
+    if (
+        parsed_safety_url.scheme != "https"
+        or safety_port != 8443
+        or not re.fullmatch(r"[A-Za-z0-9.-]+", safety_host)
+        or safety_host.lower() in {"message-safety", "localhost", "127.0.0.1"}
+        or parsed_safety_url.path
+        or parsed_safety_url.params
+        or parsed_safety_url.query
+        or parsed_safety_url.fragment
+    ):
         errors.append(
             "MESSAGE_SAFETY_URL: ожидается remote TLS endpoint "
-            "https://processing.internal:8443"
+            "https://<private VM2 hostname>:8443, не local/stub service"
         )
     try:
         extra_host, extra_ip = env.get("MESSAGE_SAFETY_EXTRA_HOST", "").rsplit("=", 1)
-        safety_host = urlparse(env.get("MESSAGE_SAFETY_URL", "")).hostname
         address = ipaddress.ip_address(extra_ip)
         if extra_host != safety_host or not address.is_private:
             raise ValueError