Исправлены ошибки в ходе раскатки

codebase/backend/deployment/DEPLOYMENT_GUIDE.ru.md

@@ -300,16 +300,23 @@ HAN_PG_PORT=6432
 HAN_PG_DATABASE=han_chat
 PG_CA_HOST_PATH=/opt/han-chat/backend/secrets/pg/ca.pem
 
-DATABASE_URL=postgresql+asyncpg://han_app:<PASSWORD>@<PG_HOST>:6432/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem&options=-csearch_path%3Dhan_app
-BITRIX_DATABASE_URL=postgresql://bitrix_local_app:<PASSWORD>@<PG_HOST>:6432/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem&options=-csearch_path%3Dbitrix_local
-BITRIX_SYNC_DATABASE_URL=postgresql://bitrix_sync_user:<PASSWORD>@<PG_HOST>:6432/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem&options=-csearch_path%3Dbitrix_sync
-MESSAGE_SAFETY_DATABASE_URL=postgresql://message_safety_app:<PASSWORD>@<PG_HOST>:6432/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem&options=-csearch_path%3Dmessage_safety
+DATABASE_URL=postgresql+asyncpg://han_app:<PASSWORD>@<PG_HOST>:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
+BITRIX_DATABASE_URL=postgresql://bitrix_local_app:<PASSWORD>@<PG_HOST>:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
+BITRIX_SYNC_DATABASE_URL=postgresql://bitrix_sync_user:<PASSWORD>@<PG_HOST>:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
+MESSAGE_SAFETY_DATABASE_URL=postgresql://message_safety_app:<PASSWORD>@<PG_HOST>:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
 
-KEYCLOAK_DB_URL=jdbc:postgresql://<PG_HOST>:6432/han_chat?currentSchema=keycloak&sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
+KEYCLOAK_DB_URL=jdbc:postgresql://<PG_HOST>:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
+KEYCLOAK_DB_SCHEMA=keycloak
 KEYCLOAK_DB_USERNAME=keycloak_user
 KEYCLOAK_DB_PASSWORD=<PASSWORD>
 ```
 
+Порт `5433` используется с PgBouncer в режиме `session`. Не добавляйте
+`options=-csearch_path...` или JDBC-параметр `currentSchema`: они передают
+startup parameter `search_path`, который Selectel PgBouncer отклоняет. Для
+Keycloak схема задаётся отдельно через `KEYCLOAK_DB_SCHEMA`.
+Для каждой сервисной роли заранее задайте database-level `search_path`.
+
 Если пароль содержит `@`, `:`, `/`, `?`, `#` или `%`, его необходимо
 URL-кодировать внутри PostgreSQL URL.
 

codebase/backend/deployment/docker-compose.jobs.yml

@@ -9,7 +9,7 @@ services:
     command: ["alembic", "upgrade", "head"]
     volumes:
       - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
-    networks: [backend]
+    networks: [backend, egress]
     restart: "no"
     security_opt: ["no-new-privileges:true"]
 
@@ -23,7 +23,7 @@ services:
     command: ["alembic", "upgrade", "head"]
     volumes:
       - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
-    networks: [backend]
+    networks: [backend, egress]
     restart: "no"
     security_opt: ["no-new-privileges:true"]
 
@@ -37,7 +37,7 @@ services:
     command: ["alembic", "upgrade", "head"]
     volumes:
       - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
-    networks: [backend]
+    networks: [backend, egress]
     restart: "no"
     security_opt: ["no-new-privileges:true"]
 
@@ -58,7 +58,7 @@ services:
     volumes:
       - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
       - ./app-settings.production-like.yaml:/deployment/app-settings.production-like.yaml:ro
-    networks: [backend]
+    networks: [backend, egress]
     restart: "no"
     security_opt: ["no-new-privileges:true"]
 
@@ -66,7 +66,7 @@ services:
     image: curlimages/curl:8.11.1
     profiles: ["ops"]
     entrypoint: ["sleep", "infinity"]
-    networks: [backend, observability]
+    networks: [backend, observability, egress]
     restart: "no"
     cap_drop: ["ALL"]
     security_opt: ["no-new-privileges:true"]

codebase/backend/deployment/scripts/smoke.sh

@@ -4,9 +4,32 @@ cd "$(dirname "$0")/../.."
 
 ENV_FILE=${ENV_FILE:-.env}
 ./scripts/validate-env "$ENV_FILE"
-set -a
-. "./$ENV_FILE"
-set +a
+
+env_value() {
+  python3 - "$ENV_FILE" "$1" <<'PY'
+import sys
+from pathlib import Path
+
+path, wanted = sys.argv[1:]
+for raw in Path(path).read_text(encoding="utf-8").splitlines():
+    line = raw.strip()
+    if not line or line.startswith("#") or "=" not in line:
+        continue
+    key, value = line.split("=", 1)
+    if key.strip() == wanted:
+        value = value.strip()
+        if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
+            value = value[1:-1]
+        print(value)
+        break
+else:
+    raise SystemExit(f"missing environment variable: {wanted}")
+PY
+}
+
+PUBLIC_HOST=$(env_value PUBLIC_HOST)
+PUBLIC_WEB_URL=$(env_value PUBLIC_WEB_URL)
+KEYCLOAK_REALM=$(env_value KEYCLOAK_REALM)
 
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT