Перенесены секреты из .env в SM

codebase/backend/redis/docker-compose.yml

@@ -4,17 +4,18 @@ services:
       context: .
     image: han-chat-redis:${RELEASE_VERSION:-local}
     environment:
-      REDIS_API_PASSWORD: ${REDIS_API_PASSWORD}
-      REDIS_SAFETY_PASSWORD: ${REDIS_SAFETY_PASSWORD}
-      REDIS_HEALTH_PASSWORD: ${REDIS_HEALTH_PASSWORD}
       REDIS_MAXMEMORY: ${REDIS_MAXMEMORY:-384mb}
       REDIS_EVICTION_POLICY: ${REDIS_EVICTION_POLICY:-volatile-lru}
+    secrets:
+      - redis_api_password
+      - redis_safety_password
+      - redis_health_password
     expose: ["6379"]
     volumes:
       - redis-data:/data
     networks: [backend]
     healthcheck:
-      test: ["CMD-SHELL", "redis-cli --no-auth-warning --user ops_health --pass \"$$REDIS_HEALTH_PASSWORD\" PING | grep -qx PONG"]
+      test: ["CMD-SHELL", "REDISCLI_AUTH=\"$$(cat /run/secrets/redis_health_password)\" redis-cli --user ops_health PING | grep -qx PONG"]
       interval: 10s
       timeout: 3s
       retries: 10
@@ -28,7 +29,16 @@ services:
     cap_drop: ["ALL"]
     mem_limit: 512m
     ulimits:
+      core: {soft: 0, hard: 0}
       nofile: {soft: 65536, hard: 65536}
     logging:
       driver: json-file
       options: {max-size: "50m", max-file: "5"}
+
+secrets:
+  redis_api_password:
+    file: ${HAN_SECRETS_DIR:-/run/han-chat/secrets}/REDIS_API_PASSWORD
+  redis_safety_password:
+    file: ${HAN_SECRETS_DIR:-/run/han-chat/secrets}/REDIS_SAFETY_PASSWORD
+  redis_health_password:
+    file: ${HAN_SECRETS_DIR:-/run/han-chat/secrets}/REDIS_HEALTH_PASSWORD

codebase/backend/redis/scripts/entrypoint.sh

@@ -1,17 +1,29 @@
 #!/bin/sh
 set -eu
 
-for name in REDIS_API_PASSWORD REDIS_SAFETY_PASSWORD REDIS_HEALTH_PASSWORD; do
-  eval "value=\${$name:-}"
+for item in \
+  REDIS_API_PASSWORD:redis_api_password \
+  REDIS_SAFETY_PASSWORD:redis_safety_password \
+  REDIS_HEALTH_PASSWORD:redis_health_password
+do
+  name=${item%%:*}
+  file=/run/secrets/${item#*:}
+  if [ ! -r "$file" ]; then
+    echo "redis bootstrap: missing secret file for $name" >&2
+    exit 66
+  fi
+  value=$(cat "$file")
   if [ "${#value}" -lt 16 ] || printf '%s' "$value" | grep -Eq '[[:space:]]'; then
     echo "redis bootstrap: $name must be at least 16 characters without whitespace" >&2
     exit 64
   fi
+  export "$name=$value"
 done
 
 umask 077
 envsubst '${REDIS_API_PASSWORD} ${REDIS_SAFETY_PASSWORD} ${REDIS_HEALTH_PASSWORD}' \
   < /etc/han-redis/users.acl.template > /tmp/users.acl
+unset REDIS_API_PASSWORD REDIS_SAFETY_PASSWORD REDIS_HEALTH_PASSWORD
 
 exec redis-server /etc/han-redis/redis.conf \
   --aclfile /tmp/users.acl \