chore(devops): env sync to server + SERVICE_ENV secret for CD (parked, not merged)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -0,0 +1,55 @@
+name: CD
+
+# Every merge into dev → lint + tests → deploy to the shared server (dev.meditron.tenvex.ru / meditron.tenvex.ru).
+# Secrets: DEPLOY_SSH_KEY (private key of the `ptsr-deploy` user), DEPLOY_HOST (user@host).
+on:
+  push:
+    branches: [dev]
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-dev
+  cancel-in-progress: false
+
+jobs:
+  test:
+    name: ruff · pytest
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v3
+        with:
+          version: "0.8.4"
+      - run: uv sync --frozen
+      - run: uv run ruff check .
+      - run: uv run pytest -q
+
+  deploy:
+    name: deploy dev
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: ssh key
+        run: |
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          printf '%s\n' "${{ secrets.SERVICE_ENV }}" > ~/service.env
+          chmod 600 ~/service.env
+      - name: deploy
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_SSH_OPTS: "-i /root/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=20"
+        run: |
+          export DEPLOY_SSH_OPTS="${DEPLOY_SSH_OPTS//\/root\/.ssh/$HOME/.ssh}"
+          export SERVICE_ENV_FILE="$HOME/service.env"
+          infra/deploy/deploy.sh HEAD
+      - name: smoke
+        run: |
+          sleep 10
+          for u in https://dev.meditron.tenvex.ru/ https://dev.meditron.tenvex.ru/api/v1/demo/personas https://dev.meditron.tenvex.ru/doctor/; do
+            code=$(curl -s -o /dev/null -w '%{http_code}' -m 20 "$u"); echo "$u -> $code"; [ "$code" = 200 ]
+          done

Makefile

@@ -1,4 +1,4 @@
-.PHONY: install up down logs seed demo-reset lint fmt test
+.PHONY: install up down logs seed demo-reset lint fmt test env-sync deploy
 
 install:
 	uv sync
@@ -30,3 +30,9 @@ fmt:
 
 test:
 	uv run pytest -q
+
+env-sync:
+	infra/deploy/env-sync.sh .env
+
+deploy:
+	infra/deploy/deploy.sh origin/dev

infra/deploy/deploy.sh

@@ -1,24 +1,44 @@
 #!/usr/bin/env bash
-# Deploy origin/dev to the shared server (ssh alias `vobot`, dir /srv/ptsr). Run from a clean checkout:
+# Deploy a git ref to the shared server (dir /srv/ptsr). Used by hand and by CD (.gitea/workflows/deploy.yml).
 #   infra/deploy/deploy.sh [git-ref]        default: origin/dev
+# Env: DEPLOY_HOST (ssh host/alias, default `vobot`), DEPLOY_SSH_OPTS (extra ssh/scp options).
 # Keeps /srv/ptsr/.env (secrets live only on the server) and the Postgres volume.
+# The host drops some ssh connections (rate limiting) — every remote step is retried.
 set -euo pipefail
 REF=${1:-origin/dev}
 HOST=${DEPLOY_HOST:-vobot}
+OPTS=${DEPLOY_SSH_OPTS:-}
 DIR=/srv/ptsr
-git fetch -q origin || true
+git fetch -q origin 2>/dev/null || true
 SHA=$(git rev-parse --short "$REF")
+TGZ=$(mktemp --suffix=.tgz)
+trap 'rm -f "$TGZ"' EXIT
+git archive --format=tar.gz -o "$TGZ" "$REF"
+
+retry() { local n=0; until "$@"; do n=$((n + 1)); [ $n -ge 5 ] && return 1; echo "retry $n: $1" >&2; sleep $((n * 10)); done; }
+
 echo "deploy $REF ($SHA) -> $HOST:$DIR"
-git archive --format=tar "$REF" | ssh "$HOST" "rm -rf $DIR/app.new && mkdir -p $DIR/app.new && tar -x -C $DIR/app.new"
-ssh "$HOST" bash -s <<SH
+# shellcheck disable=SC2086
+retry scp -q $OPTS "$TGZ" "$HOST:$DIR/release.tgz"
+# Service variables managed via the SERVICE_ENV secret (infra/deploy/env-sync.sh) — merged before the restart.
+if [ -n "${SERVICE_ENV_FILE:-}" ] && [ -s "$SERVICE_ENV_FILE" ]; then
+  # shellcheck disable=SC2086
+  retry scp -q $OPTS "$SERVICE_ENV_FILE" "$HOST:$DIR/service.env"
+fi
+# shellcheck disable=SC2086
+retry ssh $OPTS "$HOST" "bash -s" <<SH
 set -euo pipefail
 cd $DIR
+rm -rf app.new && mkdir app.new && tar -xzf release.tgz -C app.new && rm -f release.tgz
+cp app.new/infra/deploy/env_merge.py env_merge.py
+if [ -s service.env ]; then rc=0; python3 env_merge.py .env service.env || rc=\$?; rm -f service.env; [ "\$rc" = 0 ] || [ "\$rc" = 3 ]; fi
 cp .env app.new/.env
 rm -rf app.old; [ -d app ] && mv app app.old; mv app.new app
+chmod 755 $DIR
 cd app
 echo "$SHA" > REVISION
-docker run --rm -v "\$PWD/web:/w" -w /w node:20-alpine sh -c "npm ci --no-audit --no-fund >/dev/null && npm run build >/dev/null"
+docker run --rm --user "\$(id -u):\$(id -g)" -e HOME=/tmp -e npm_config_cache=/tmp/.npm -v "\$PWD/web:/w" -w /w node:20-alpine sh -c "npm ci --no-audit --no-fund >/dev/null && npm run build >/dev/null"
 docker compose -p ptsr -f docker-compose.yml -f infra/deploy/docker-compose.server.yml up -d --build </dev/null
 for i in \$(seq 1 40); do curl -sf 127.0.0.1:8010/health >/dev/null && break; sleep 3; done
-curl -sf 127.0.0.1:8010/health && echo " api ok"
+curl -sf 127.0.0.1:8010/health >/dev/null && echo "api ok @ $SHA"
 SH

infra/deploy/env-sync.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Sync service variables from the local .env to the server — now and for every future deploy.
+#   make env-sync            (or infra/deploy/env-sync.sh [path/to/.env])
+# 1. Filters the local env: drops GITEA_*, empty values and server-managed keys (DB passwords, PSEUDO_KEY, URLs).
+# 2. Stores the result as the Gitea Actions secret SERVICE_ENV → CD merges it into /srv/ptsr/.env on each deploy.
+# 3. Applies it on the server right away and recreates app + dashboard if anything changed.
+# Values are never printed; only key names.
+set -euo pipefail
+SRC=${1:-.env}
+HOST=${DEPLOY_HOST:-vobot}
+OPTS=${DEPLOY_SSH_OPTS:-}
+DIR=/srv/ptsr
+HERE=$(cd "$(dirname "$0")" && pwd)
+[ -f "$SRC" ] || { echo "no $SRC"; exit 1; }
+# Values without inline comments / trailing spaces ("KEY=value   # коммент" → "value").
+val() { grep -E "^$1=" "$SRC" | tail -1 | cut -d= -f2- | sed -E 's/[[:space:]]+#.*$//; s/[[:space:]]+$//' || true; }
+GITEA_URL=$(val GITEA_URL)
+GITEA_REPO=$(val GITEA_REPO)
+GITEA_TOKEN=$(val GITEA_TOKEN)
+export GITEA_URL GITEA_REPO GITEA_TOKEN
+
+OUT=$(mktemp)
+trap 'rm -f "$OUT"' EXIT
+sed -E 's/[[:space:]]+#.*$//; s/[[:space:]]+$//' "$SRC" \
+  | grep -E '^[A-Z_][A-Z0-9_]*=.+' \
+  | grep -vE '^(GITEA_[A-Z_]*|POSTGRES_PASSWORD|IDENTITY_DB_PASSWORD|CLINICAL_DB_PASSWORD|PSEUDO_KEY|PUBLIC_URL|IDENTITY_DB_URL|CLINICAL_DB_URL|API_BASE_URL)=' \
+  > "$OUT" || true
+echo "keys: $(cut -d= -f1 "$OUT" | tr '\n' ' ')"
+[ -s "$OUT" ] || { echo "nothing to sync"; exit 0; }
+
+if [ -n "$GITEA_TOKEN" ] && [ -n "$GITEA_URL" ] && [ -n "$GITEA_REPO" ]; then
+  python3 - "$OUT" <<'PY'
+import json, os, sys, urllib.request
+url = f"{os.environ['GITEA_URL']}/api/v1/repos/{os.environ['GITEA_REPO']}/actions/secrets/SERVICE_ENV"
+body = json.dumps({"data": open(sys.argv[1]).read()}).encode()
+req = urllib.request.Request(url, method="PUT", data=body,
+                             headers={"Authorization": f"token {os.environ['GITEA_TOKEN']}",
+                                      "Content-Type": "application/json"})
+print("gitea secret SERVICE_ENV:", urllib.request.urlopen(req).status)
+PY
+else
+  echo "GITEA_* not set in $SRC — skipping the CD secret (server-only sync)"
+fi
+
+retry() { local n=0; until "$@"; do n=$((n + 1)); [ $n -ge 5 ] && return 1; sleep $((n * 10)); done; }
+# shellcheck disable=SC2086
+retry scp -q $OPTS "$OUT" "$HOST:$DIR/service.env"
+# shellcheck disable=SC2086
+retry scp -q $OPTS "$HERE/env_merge.py" "$HOST:$DIR/env_merge.py"
+# shellcheck disable=SC2086
+retry ssh $OPTS "$HOST" "bash -s" <<SH
+set -euo pipefail
+cd $DIR
+rc=0; python3 env_merge.py .env service.env || rc=\$?
+rm -f service.env
+if [ "\$rc" = 0 ]; then
+  cp .env app/.env
+  cd app && docker compose -p ptsr -f docker-compose.yml -f infra/deploy/docker-compose.server.yml up -d --force-recreate app dashboard </dev/null 2>&1 | tail -2
+  for i in \$(seq 1 30); do curl -sf 127.0.0.1:8010/health >/dev/null && break; sleep 2; done
+  curl -sf 127.0.0.1:8010/health >/dev/null && echo "api ok"
+elif [ "\$rc" != 3 ]; then
+  exit "\$rc"
+fi
+SH

infra/deploy/env_merge.py

@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Merge service variables into the server env file (runs on the server, stdlib only).
+
+    env_merge.py TARGET SOURCE
+
+Keys from SOURCE overwrite / add to TARGET; keys only in TARGET stay (server-generated secrets: DB passwords,
+PSEUDO_KEY, PUBLIC_URL). Protected keys are never taken from SOURCE. Prints changed key NAMES only (no values).
+Exit code: 0 = changed, 3 = nothing changed.
+"""
+
+import os
+import sys
+import tempfile
+
+PROTECTED = {
+    "POSTGRES_PASSWORD",
+    "IDENTITY_DB_PASSWORD",
+    "CLINICAL_DB_PASSWORD",
+    "PSEUDO_KEY",
+    "PUBLIC_URL",
+    "IDENTITY_DB_URL",
+    "CLINICAL_DB_URL",
+    "API_BASE_URL",
+}
+
+
+def parse(path: str) -> list[tuple[str | None, str]]:
+    """Lines as (key, raw_line); comments/blank lines have key None. Keeps order and comments."""
+    out: list[tuple[str | None, str]] = []
+    with open(path, encoding="utf-8") as f:
+        for raw in f.read().splitlines():
+            line = raw.strip()
+            key = line.split("=", 1)[0].strip() if line and not line.startswith("#") and "=" in line else None
+            out.append((key, raw))
+    return out
+
+
+def merge(target: str, source: str) -> list[str]:
+    lines = parse(target)
+    incoming = {
+        k: raw
+        for k, raw in parse(source)
+        if k and k not in PROTECTED and not k.startswith("GITEA_") and raw.split("=", 1)[1].strip()
+    }
+    changed: list[str] = []
+    seen: set[str] = set()
+    for i, (k, raw) in enumerate(lines):
+        if k in incoming:
+            seen.add(k)
+            if raw != incoming[k]:
+                lines[i] = (k, incoming[k])
+                changed.append(k)
+    for k, raw in incoming.items():
+        if k not in seen:
+            lines.append((k, raw))
+            changed.append(k)
+    if changed:
+        fd, tmp = tempfile.mkstemp(dir=os.path.dirname(os.path.abspath(target)))
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            f.write("\n".join(raw for _, raw in lines) + "\n")
+        st = os.stat(target)
+        os.chmod(tmp, 0o600)
+        if os.geteuid() == 0:
+            os.chown(tmp, st.st_uid, st.st_gid)
+        os.replace(tmp, target)
+    return changed
+
+
+def main() -> int:
+    changed = merge(sys.argv[1], sys.argv[2])
+    if not changed:
+        print("env: no changes")
+        return 3
+    print("env: updated " + ", ".join(sorted(changed)))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

tests/test_env_merge.py

@@ -0,0 +1,21 @@
+import importlib.util
+from pathlib import Path
+
+spec = importlib.util.spec_from_file_location("env_merge", Path("infra/deploy/env_merge.py"))
+env_merge = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(env_merge)
+
+
+def test_merge_updates_adds_and_protects(tmp_path):
+    target = tmp_path / "server.env"
+    target.write_text("# server\nPSEUDO_KEY=server-secret\nCHAT_AGENT=off\nTZ=Europe/Moscow\n")
+    source = tmp_path / "service.env"
+    source.write_text("CHAT_AGENT=gigachat\nINTAKE_DEMO=true\nPSEUDO_KEY=evil\nGITEA_TOKEN=x\nEMPTY=\n")
+    changed = env_merge.merge(str(target), str(source))
+    assert sorted(changed) == ["CHAT_AGENT", "INTAKE_DEMO"]
+    text = target.read_text()
+    assert "PSEUDO_KEY=server-secret" in text and "evil" not in text
+    assert "CHAT_AGENT=gigachat" in text and "INTAKE_DEMO=true" in text and "TZ=Europe/Moscow" in text
+    assert "GITEA_TOKEN" not in text and "EMPTY" not in text
+    assert text.startswith("# server\n")
+    assert env_merge.merge(str(target), str(source)) == []  # idempotent