From aa0e17f1f1aa533eac98072d8c6b35f2821f3e37 Mon Sep 17 00:00:00 2001
From: richjohnrambo <richjohnrambo@gmail.com>
Date: Mon, 19 Oct 2026 13:13:08 +0800
Subject: [PATCH] fix: inject IM internal secret in production

---
 .gitea/workflows/deploy.yml | 32 ++++++++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index d63b378..c700c3e 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -49,8 +49,10 @@ jobs:
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
           DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          OLONS_IM_INTERNAL_SECRET: ${{ secrets.OLONS_IM_INTERNAL_SECRET }}
         run: |
           set -euo pipefail
+          test -n "$OLONS_IM_INTERNAL_SECRET"
           install -d -m 700 "$HOME/.ssh"
           KEY_FILE="$(mktemp "$HOME/.ssh/olns-deploy.XXXXXX")"
           cleanup() {
@@ -64,5 +66,31 @@ jobs:
           SSH_ARGS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=yes)
           printf '%s' "$REGISTRY_TOKEN" | ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
             "docker login git.olns.shop -u admin --password-stdin"
-          ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
-            "cd /opt/olns && docker compose pull olons-server && docker compose up -d --no-deps --wait olons-server"
+          printf '%s' "$OLONS_IM_INTERNAL_SECRET" | ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" '
+            set -euo pipefail
+            umask 077
+            secret="$(cat)"
+            test -n "$secret"
+            printf "OLONS_IM_INTERNAL_SECRET=%s\n" "$secret" > /opt/olns/.env.olons-server
+            cat > /opt/olns/compose.olons-server-secret.yaml <<"YAML"
+          services:
+            olons-server:
+              env_file:
+                - .env.olons-server
+          YAML
+          '
+          ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" '
+            set -euo pipefail
+            cd /opt/olns
+            base_file=""
+            for candidate in compose.yaml compose.yml docker-compose.yaml docker-compose.yml; do
+              if [ -f "$candidate" ]; then
+                base_file="$candidate"
+                break
+              fi
+            done
+            test -n "$base_file"
+            docker compose -f "$base_file" -f compose.olons-server-secret.yaml pull olons-server
+            docker compose -f "$base_file" -f compose.olons-server-secret.yaml up -d --no-deps --wait olons-server
+            docker compose -f "$base_file" -f compose.olons-server-secret.yaml exec -T olons-server sh -c '"'"'test -n "$OLONS_IM_INTERNAL_SECRET"'"'"'
+          '