Перенесены секреты из .env в SM

codebase/backend/observability/docker-compose.yml

@@ -18,12 +18,13 @@ services:
       APP_ENV: ${APP_ENV:-production-like}
       RELEASE_VERSION: ${RELEASE_VERSION:-unknown}
       OTEL_REMOTE_ENDPOINT: ${OTEL_REMOTE_ENDPOINT}
-      OTEL_REMOTE_AUTH_HEADER: ${OTEL_REMOTE_AUTH_HEADER:-}
       OTEL_REMOTE_TLS_INSECURE: ${OTEL_REMOTE_TLS_INSECURE:-false}
     expose: ["4317", "4318", "13133", "8888"]
     volumes:
       - ./otel-collector.yaml:/etc/otelcol/config.yaml:ro
       - otel-queue:/var/lib/otelcol/queue
+    secrets:
+      - otel_remote_auth_header
     networks: [observability, egress]
     depends_on:
       otel-queue-init: {condition: service_completed_successfully}
@@ -38,6 +39,8 @@ services:
     user: "10001:10001"
     cap_drop: ["ALL"]
     security_opt: ["no-new-privileges:true"]
+    ulimits:
+      core: {soft: 0, hard: 0}
     mem_limit: 512m
     cpus: 0.5
     logging:
@@ -62,3 +65,7 @@ services:
     user: "10001:10001"
     cap_drop: ["ALL"]
     security_opt: ["no-new-privileges:true"]
+
+secrets:
+  otel_remote_auth_header:
+    file: ${HAN_SECRETS_DIR:-/run/han-chat/secrets}/OTEL_REMOTE_AUTH_HEADER

codebase/backend/observability/otel-collector.yaml

@@ -100,7 +100,7 @@ exporters:
   otlp/remote:
     endpoint: "${env:OTEL_REMOTE_ENDPOINT}"
     headers:
-      authorization: "${env:OTEL_REMOTE_AUTH_HEADER}"
+      authorization: ${file:/run/secrets/otel_remote_auth_header}
     tls:
       insecure: "${env:OTEL_REMOTE_TLS_INSECURE}"
     sending_queue: