Перенесены секреты из .env в SM

2026-07-30 19:22:48 +03:00
parent 049c45db5c
commit e24ed9d8ef
58 changed files with 3350 additions and 1054 deletions
@@ -1,83 +1,123 @@
-x-no-sms-secrets: &no-sms-secrets
-  SMS_DATABASE_URL: ""
-  SMS_SERVICE_TOKEN: ""
-  KEYCLOAK_SMS_SERVICE_TOKEN: ""
-  IDGTL_SMS_API_KEY: ""
-  IDGTL_SMS_CALLBACK_USERNAME: ""
-  IDGTL_SMS_CALLBACK_PASSWORD: ""
+x-api-job-secrets: &api-job-secrets
+  - api_database_url
+  - api_redis_url
+  - api_redis_realtime_url
+  - message_safety_service_token
+  - bitrix_local_app_internal_token
+  - bitrix_api_inbox_token
+  - keycloak_settings_bridge_token
+  - selectel_s3_access_key
+  - selectel_s3_secret_key
+  - cursor_hmac_secret
+
+x-api-job-environment: &api-job-environment
+  HAN_SECRET_VARS: >-
+    DATABASE_URL REDIS_URL REDIS_REALTIME_URL MESSAGE_SAFETY_SERVICE_TOKEN
+    BITRIX_LOCAL_APP_INTERNAL_TOKEN BITRIX_API_INBOX_TOKEN
+    KEYCLOAK_SETTINGS_BRIDGE_TOKEN SELECTEL_S3_ACCESS_KEY SELECTEL_S3_SECRET_KEY
+    CURSOR_HMAC_SECRET
+  DATABASE_URL_FILE: /run/secrets/api_database_url
+  REDIS_URL_FILE: /run/secrets/api_redis_url
+  REDIS_REALTIME_URL_FILE: /run/secrets/api_redis_realtime_url
+  MESSAGE_SAFETY_SERVICE_TOKEN_FILE: /run/secrets/message_safety_service_token
+  BITRIX_LOCAL_APP_INTERNAL_TOKEN_FILE: /run/secrets/bitrix_local_app_internal_token
+  BITRIX_API_INBOX_TOKEN_FILE: /run/secrets/bitrix_api_inbox_token
+  KEYCLOAK_SETTINGS_BRIDGE_TOKEN_FILE: /run/secrets/keycloak_settings_bridge_token
+  SELECTEL_S3_ACCESS_KEY_FILE: /run/secrets/selectel_s3_access_key
+  SELECTEL_S3_SECRET_KEY_FILE: /run/secrets/selectel_s3_secret_key
+  CURSOR_HMAC_SECRET_FILE: /run/secrets/cursor_hmac_secret
+  APP_ENV: ${APP_ENV:-production-like}
+  LOG_LEVEL: ${LOG_LEVEL:-INFO}
+  KEYCLOAK_PUBLIC_URL: ${KEYCLOAK_PUBLIC_URL}
+  KEYCLOAK_INTERNAL_URL: ${KEYCLOAK_INTERNAL_URL:-http://keycloak:8080/auth}
+  KEYCLOAK_REALM: ${KEYCLOAK_REALM:-han-chat}
+  KEYCLOAK_AUDIENCE: ${KEYCLOAK_AUDIENCE:-han-chat-api}
+  MESSAGE_SAFETY_URL: ${MESSAGE_SAFETY_URL:-http://message-safety:8080}
+  MESSAGE_SAFETY_POST_TIMEOUT_SEC: ${MESSAGE_SAFETY_POST_TIMEOUT_SEC:-5}
+  MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC: ${MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC:-2}
+  MESSAGE_SAFETY_TASK_POLL_MAX_SEC: ${MESSAGE_SAFETY_TASK_POLL_MAX_SEC:-300}
+  BITRIX_LOCAL_APP_BASE_URL: ${BITRIX_LOCAL_APP_BASE_URL:-http://bitrix-local-app:8080}
+  BITRIX_LOCAL_APP_HTTP_TIMEOUT_SEC: ${BITRIX_LOCAL_APP_HTTP_TIMEOUT_SEC:-20}
+  SELECTEL_S3_ENDPOINT_URL: ${SELECTEL_S3_ENDPOINT_URL}
+  SELECTEL_S3_BUCKET_DOCUMENTS: ${SELECTEL_S3_BUCKET_DOCUMENTS}
+  SELECTEL_S3_BUCKET_ATTACHMENTS: ${SELECTEL_S3_BUCKET_ATTACHMENTS}
+  SELECTEL_S3_BUCKET_QUARANTINE: ${SELECTEL_S3_BUCKET_QUARANTINE}
+  TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-127.0.0.1/32}

 services:
  migrate-api:
    image: ${API_BACKEND_IMAGE:-han-chat-api-backend:local}
    profiles: ["ops"]
-    env_file:
-      - path: ../.env
-        required: false
-    environment: *no-sms-secrets
-    entrypoint: []
+    environment:
+      HAN_SECRET_VARS: DATABASE_URL
+      DATABASE_URL_FILE: /run/secrets/api_database_url
+    secrets:
+      - api_database_url
    command: ["alembic", "upgrade", "head"]
    volumes:
      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
    networks: [backend, egress]
    restart: "no"
    security_opt: ["no-new-privileges:true"]
+    ulimits:
+      core: {soft: 0, hard: 0}

  migrate-bitrix-local:
    image: ${BITRIX_LOCAL_APP_IMAGE:-han-chat-bitrix-local-app:local}
    profiles: ["ops"]
-    env_file:
-      - path: ../.env
-        required: false
-    environment: *no-sms-secrets
-    entrypoint: []
+    environment:
+      HAN_SECRET_VARS: BITRIX_DATABASE_URL
+      BITRIX_DATABASE_URL_FILE: /run/secrets/bitrix_database_url
+    secrets:
+      - bitrix_database_url
    command: ["alembic", "upgrade", "head"]
    volumes:
      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
    networks: [backend, egress]
    restart: "no"
    security_opt: ["no-new-privileges:true"]
+    ulimits:
+      core: {soft: 0, hard: 0}

  migrate-bitrix-sync:
    image: ${BITRIX_SYNC_IMAGE:-han-chat-bitrix-sync:local}
    profiles: ["ops"]
-    env_file:
-      - path: ../.env
-        required: false
-    environment: *no-sms-secrets
-    entrypoint: []
+    environment:
+      HAN_SECRET_VARS: BITRIX_SYNC_DATABASE_URL
+      BITRIX_SYNC_DATABASE_URL_FILE: /run/secrets/bitrix_sync_database_url
+    secrets:
+      - bitrix_sync_database_url
    command: ["alembic", "upgrade", "head"]
    volumes:
      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
    networks: [backend, egress]
    restart: "no"
    security_opt: ["no-new-privileges:true"]
+    ulimits:
+      core: {soft: 0, hard: 0}

  migrate-sms:
    image: ${SMS_SERVICE_IMAGE:-han-chat-sms-service:local}
    profiles: ["ops"]
    environment:
-      SMS_DATABASE_URL: ${SMS_DATABASE_URL}
-      SMS_SERVICE_TOKEN: ${SMS_SERVICE_TOKEN}
-      IDGTL_SMS_BASE_URL: ${IDGTL_SMS_BASE_URL:-https://direct.i-dgtl.ru}
-      IDGTL_SMS_CALLBACK_PUBLIC_URL: ${IDGTL_SMS_CALLBACK_PUBLIC_URL}
-      IDGTL_SMS_CALLBACK_USERNAME: ${IDGTL_SMS_CALLBACK_USERNAME}
-      IDGTL_SMS_CALLBACK_PASSWORD: ${IDGTL_SMS_CALLBACK_PASSWORD}
-    entrypoint: []
+      HAN_SECRET_VARS: SMS_DATABASE_URL
+      SMS_DATABASE_URL_FILE: /run/secrets/sms_database_url
+    secrets:
+      - sms_database_url
    command: ["alembic", "upgrade", "head"]
    volumes:
      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
    networks: [backend, egress]
    restart: "no"
    security_opt: ["no-new-privileges:true"]
+    ulimits:
+      core: {soft: 0, hard: 0}

  seed-settings:
    image: ${API_BACKEND_IMAGE:-han-chat-api-backend:local}
    profiles: ["ops"]
-    env_file:
-      - path: ../.env
-        required: false
-    environment: *no-sms-secrets
-    entrypoint: []
+    environment: *api-job-environment
+    secrets: *api-job-secrets
    command:
      - /bin/sh
      - -ec
@@ -91,6 +131,8 @@ services:
    networks: [backend, egress]
    restart: "no"
    security_opt: ["no-new-privileges:true"]
+    ulimits:
+      core: {soft: 0, hard: 0}

  toolbox:
    image: curlimages/curl:8.11.1