Перенесены секреты из .env в SM

codebase/backend/deployment/scripts/backup.sh

@@ -1,10 +1,22 @@
 #!/bin/sh
 set -eu
+cd "$(dirname "$0")/../.."
+CONFIG_FILE=${CONFIG_FILE:-.env}
+SECRETS_LAUNCHER=${SECRETS_LAUNCHER:-deployment/secrets/han-secrets}
 
-if [ -z "${PG_BACKUP_DSN:-}" ]; then
-  echo "PG_BACKUP_DSN is required (managed PostgreSQL TLS DSN, supplied via secure environment)." >&2
+if [ "${HAN_SECRETS_ACTIVE:-0}" != "1" ]; then
+  [ -x "$SECRETS_LAUNCHER" ] || {
+    echo "Secret launcher is required: $SECRETS_LAUNCHER" >&2
+    exit 66
+  }
+  exec "$SECRETS_LAUNCHER" run --config "$CONFIG_FILE" -- "$0" "$@"
+fi
+
+if [ -z "${PG_BACKUP_DSN_FILE:-}" ] || [ ! -r "$PG_BACKUP_DSN_FILE" ]; then
+  echo "PG_BACKUP_DSN_FILE is required from the secret launcher." >&2
   exit 64
 fi
+PG_BACKUP_DSN=$(cat "$PG_BACKUP_DSN_FILE")
 case "$PG_BACKUP_DSN" in
   *sslmode=verify-full*sslrootcert=*) ;;
   *) echo "PG_BACKUP_DSN must enforce sslmode=verify-full and sslrootcert." >&2; exit 64 ;;
@@ -16,7 +28,9 @@ mkdir -p "$output_dir"
 stamp=$(date -u +%Y%m%dT%H%M%SZ)
 archive="$output_dir/han-chat-$stamp.dump"
 
-pg_dump --dbname="$PG_BACKUP_DSN" --format=custom --no-owner --no-privileges --file="$archive"
+PGDATABASE="$PG_BACKUP_DSN" pg_dump \
+  --format=custom --no-owner --no-privileges --file="$archive"
+unset PG_BACKUP_DSN
 pg_restore --list "$archive" >/dev/null
 sha256sum "$archive" > "$archive.sha256"
 chmod 600 "$archive" "$archive.sha256"