Перенесены секреты из .env в SM

codebase/backend/redis/scripts/entrypoint.sh

@@ -1,17 +1,29 @@
 #!/bin/sh
 set -eu
 
-for name in REDIS_API_PASSWORD REDIS_SAFETY_PASSWORD REDIS_HEALTH_PASSWORD; do
-  eval "value=\${$name:-}"
+for item in \
+  REDIS_API_PASSWORD:redis_api_password \
+  REDIS_SAFETY_PASSWORD:redis_safety_password \
+  REDIS_HEALTH_PASSWORD:redis_health_password
+do
+  name=${item%%:*}
+  file=/run/secrets/${item#*:}
+  if [ ! -r "$file" ]; then
+    echo "redis bootstrap: missing secret file for $name" >&2
+    exit 66
+  fi
+  value=$(cat "$file")
   if [ "${#value}" -lt 16 ] || printf '%s' "$value" | grep -Eq '[[:space:]]'; then
     echo "redis bootstrap: $name must be at least 16 characters without whitespace" >&2
     exit 64
   fi
+  export "$name=$value"
 done
 
 umask 077
 envsubst '${REDIS_API_PASSWORD} ${REDIS_SAFETY_PASSWORD} ${REDIS_HEALTH_PASSWORD}' \
   < /etc/han-redis/users.acl.template > /tmp/users.acl
+unset REDIS_API_PASSWORD REDIS_SAFETY_PASSWORD REDIS_HEALTH_PASSWORD
 
 exec redis-server /etc/han-redis/redis.conf \
   --aclfile /tmp/users.acl \