Перенесены секреты из .env в SM

codebase/backend/deployment/scripts/ssl-renew.sh

@@ -1,13 +1,23 @@
 #!/bin/sh
 set -eu
 cd "$(dirname "$0")/../.."
+CONFIG_FILE=${CONFIG_FILE:-.env}
+SECRETS_LAUNCHER=${SECRETS_LAUNCHER:-deployment/secrets/han-secrets}
+
+if [ "${HAN_SECRETS_ACTIVE:-0}" != "1" ]; then
+  [ -x "$SECRETS_LAUNCHER" ] || {
+    echo "Secret launcher is required: $SECRETS_LAUNCHER" >&2
+    exit 66
+  }
+  exec "$SECRETS_LAUNCHER" run --config "$CONFIG_FILE" -- "$0" "$@"
+fi
 
 lock=/tmp/han-chat-cert-renew.lock
 exec 9>"$lock"
 flock -n 9 || { echo '{"event":"tls.renew.skipped","reason":"lock_busy"}'; exit 0; }
 
 compose() {
-  docker compose --env-file .env "$@"
+  docker compose --env-file "$CONFIG_FILE" "$@"
 }
 
 nginx_container="$(compose ps --status running --quiet nginx)"