From 028a10b8d2c971050a89af38912a43f5b3f1b1c1 Mon Sep 17 00:00:00 2001
From: grendervill <focuse@grandell.ru>
Date: Sat, 19 Sep 2026 20:38:46 +0300
Subject: [PATCH] =?UTF-8?q?fix(deploy):=20=D1=83=D0=B1=D1=80=D0=B0=D0=BD?=
 =?UTF-8?q?=D1=8B=20=D0=BE=D1=81=D1=82=D0=B0=D1=82=D0=BA=D0=B8=20TURN=5FSE?=
 =?UTF-8?q?CRET,=20=D0=B8=D1=81=D0=BF=D1=80=D0=B0=D0=B2=D0=BB=D0=B5=D0=BD?=
 =?UTF-8?q?=D0=B0=20=D0=BE=D1=87=D0=B8=D1=81=D1=82=D0=BA=D0=B0=20hex=20?=
 =?UTF-8?q?=D0=BF=D1=80=D0=B8=20=D0=B3=D0=B5=D0=BD=D0=B5=D1=80=D0=B0=D1=86?=
 =?UTF-8?q?=D0=B8=D0=B8=20age-=D0=BA=D0=BB=D1=8E=D1=87=D0=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/install.sh | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/deploy/install.sh b/deploy/install.sh
index 6b38f92..eacdc94 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -335,7 +335,7 @@ resolve_derived_values() {
         PROFILE_LIVEKIT_DISABLE_SIMULCAST PROFILE_LIVEKIT_USE_EXTERNAL_IP \
         GLCHAT_DATA_DIR GLCHAT_CADDY_PROFILE GLCHAT_TURN_CERT_DIR \
         GLCHAT_APP_BIND GLCHAT_LIVEKIT_BIND TLS_ENABLED \
-        TURN_DOMAIN_RESOLVED TURN_CERT_DIR TURN_RELAY_HOST_RESOLVED TURN_SECRET_RESOLVED \
+        TURN_DOMAIN_RESOLVED TURN_CERT_DIR TURN_RELAY_HOST_RESOLVED \
         TURN_RELAY_USER TURN_RELAY_PASSWORD
 }
 
@@ -499,7 +499,7 @@ install_docker() {
 generate_age_key() {
     local dst="$1"
     local raw pub
-    raw="$(openssl rand 32 | od -An -tx1 | tr -d ' \n')"
+    raw="$(openssl rand 32 | od -An -tx1 | tr -d '[:space:]')"
     if ! have age-keygen; then
         warn "age-keygen не найден: бэкапы будут без шифрования"
         return 0
@@ -753,7 +753,7 @@ TOTP_ENCRYPTION_KEY=${TOTP_ENCRYPTION_KEY}
 WEBHOOK_SECRET=${WEBHOOK_SECRET}
 LIVEKIT_API_KEY=${LIVEKIT_API_KEY}
 LIVEKIT_API_SECRET=${LIVEKIT_API_SECRET}
-TURN_SECRET=${TURN_SECRET_RESOLVED}
+
 AGE_RECIPIENT=${AGE_RECIPIENT:-}
 SQLITE_READ_POOL=${PROFILE_SQLITE_READ_POOL}
 SQLITE_CACHE_SIZE=-${PROFILE_SQLITE_CACHE_MB}000
@@ -892,7 +892,7 @@ ensure_swap() {
 
 # render_turn_relay_servers формирует YAML-список turn_servers для LiveKit:
 # UDP и TLS-эндпоинты внешнего релея (VPS), у которого есть публичный IP.
-# Секрет уже вычислен в resolve_derived_values (TURN_SECRET_RESOLVED).
+# Используются статические креденшелы coturn (username/credential).
 render_turn_relay_servers() {
     [ -n "$TURN_RELAY_HOST" ] || return 0
     printf '  turn_servers:\n'
@@ -913,7 +913,6 @@ turn_shared_secret() {
         TURN_SECRET_RESOLVED="$(env_get TURN_SECRET || true)"
     fi
     [ -n "${TURN_SECRET_RESOLVED:-}" ] || TURN_SECRET_RESOLVED="$(rand_hex 32)"
-    export TURN_SECRET_RESOLVED
     printf '%s' "$TURN_SECRET_RESOLVED"
 }