fix: inject IM internal secret in production

.gitea/workflows/deploy.yml

@@ -49,8 +49,10 @@ jobs:
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
           DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          OLONS_IM_INTERNAL_SECRET: ${{ secrets.OLONS_IM_INTERNAL_SECRET }}
         run: |
           set -euo pipefail
+          test -n "$OLONS_IM_INTERNAL_SECRET"
           install -d -m 700 "$HOME/.ssh"
           KEY_FILE="$(mktemp "$HOME/.ssh/olns-deploy.XXXXXX")"
           cleanup() {
@@ -64,5 +66,31 @@ jobs:
           SSH_ARGS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=yes)
           printf '%s' "$REGISTRY_TOKEN" | ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
             "docker login git.olns.shop -u admin --password-stdin"
-          ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
+          printf '%s' "$OLONS_IM_INTERNAL_SECRET" | ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" '
-            "cd /opt/olns && docker compose pull olons-server && docker compose up -d --no-deps --wait olons-server"
+            set -euo pipefail
+            umask 077
+            secret="$(cat)"
+            test -n "$secret"
+            printf "OLONS_IM_INTERNAL_SECRET=%s\n" "$secret" > /opt/olns/.env.olons-server
+            cat > /opt/olns/compose.olons-server-secret.yaml <<"YAML"
+          services:
+            olons-server:
+              env_file:
+                - .env.olons-server
+          YAML
+          '
+          ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" '
+            set -euo pipefail
+            cd /opt/olns
+            base_file=""
+            for candidate in compose.yaml compose.yml docker-compose.yaml docker-compose.yml; do
+              if [ -f "$candidate" ]; then
+                base_file="$candidate"
+                break
+              fi
+            done
+            test -n "$base_file"
+            docker compose -f "$base_file" -f compose.olons-server-secret.yaml pull olons-server
+            docker compose -f "$base_file" -f compose.olons-server-secret.yaml up -d --no-deps --wait olons-server
+            docker compose -f "$base_file" -f compose.olons-server-secret.yaml exec -T olons-server sh -c '"'"'test -n "$OLONS_IM_INTERNAL_SECRET"'"'"'
+          '