From c274abdfa128c68d1f95a67725ffd30d9be9633b Mon Sep 17 00:00:00 2001
From: grendervill <focuse@grandell.ru>
Date: Sat, 19 Sep 2026 20:32:37 +0300
Subject: [PATCH] =?UTF-8?q?fix(deploy):=20=D0=BF=D0=BE=D0=B4=D1=81=D1=82?=
 =?UTF-8?q?=D0=B0=D0=BD=D0=BE=D0=B2=D0=BA=D0=B0=20=D0=B7=D0=BD=D0=B0=D1=87?=
 =?UTF-8?q?=D0=B5=D0=BD=D0=B8=D0=B9=20=D0=B2=20.env=20=D1=87=D0=B5=D1=80?=
 =?UTF-8?q?=D0=B5=D0=B7=20python3=20(sed=20=D0=BB=D0=BE=D0=BC=D0=B0=D0=BB?=
 =?UTF-8?q?=D1=81=D1=8F=20=D0=BD=D0=B0=20@=20=D0=B2=20=D0=BF=D0=B0=D1=80?=
 =?UTF-8?q?=D0=BE=D0=BB=D1=8F=D1=85)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/install.sh | 183 ++++++++++++++++++++++++++--------------------
 1 file changed, 102 insertions(+), 81 deletions(-)

diff --git a/deploy/install.sh b/deploy/install.sh
index 272b973..6139e38 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -697,88 +697,109 @@ ADMIN_EMAIL=@ADMIN_EMAIL@
 ADMIN_PASSWORD=@ADMIN_PASSWORD@
 ENVEOF
 
-    local pairs=(
-        "DOMAIN=${DOMAIN}"
-        "FILES_DOMAIN=${FILES_DOMAIN_RESOLVED}"
-        "INSTANCE_NAME=${INSTANCE_NAME}"
-        "MAIN_GUILD_NAME=${MAIN_GUILD_NAME}"
-        "PROFILE=${PROFILE_RESOLVED}"
-        "PROXY_MODE=${PROXY_MODE}"
-        "IMAGE_TAG=${IMAGE_TAG}"
-        "APP_IMAGE=${APP_IMAGE}"
-        "CADDY_IMAGE_TAG=${CADDY_IMAGE_TAG}"
-        "LIVEKIT_IMAGE_TAG=${LIVEKIT_IMAGE_TAG}"
-        "LOG_LEVEL=${LOG_LEVEL}"
-        "TLS_ENABLED=${TLS_ENABLED}"
-        "SKIP_TLS=${SKIP_TLS}"
-        "TLS_BY_PROXY=${TLS_BY_PROXY}"
-        "GLCHAT_DATA_DIR=${GLCHAT_DATA_DIR}"
-        "CADDY_PROFILE=${CADDY_PROFILE}"
-        "GLCHAT_TURN_CERT_DIR=${TURN_CERT_DIR}"
-        "GLCHAT_APP_BIND=${APP_BIND_ADDR}"
-        "GLCHAT_LIVEKIT_BIND=${LIVEKIT_BIND_ADDR}"
-        "APP_PORT=${APP_PORT}"
-        "LIVEKIT_WS_PORT=${LIVEKIT_WS_PORT}"
-        "LIVEKIT_TCP_PORT=${LIVEKIT_TCP_PORT}"
-        "LIVEKIT_UDP_PORT=${LIVEKIT_UDP_PORT}"
-        "HTTP_PORT=${HTTP_PORT}"
-        "HTTPS_PORT=${HTTPS_PORT}"
-        "SSH_PORT=${SSH_PORT}"
-        "TURN_ENABLED=${TURN_ENABLED}"
-        "TURN_DOMAIN=${TURN_DOMAIN_RESOLVED}"
-        "TURN_UDP_PORT=${TURN_UDP_PORT}"
-        "TURN_TLS_PORT=${TURN_TLS_PORT}"
-        "TURN_EXTERNAL_TLS=${TURN_EXTERNAL_TLS}"
-        "TURN_RELAY_START=${TURN_RELAY_START}"
-        "TURN_RELAY_END=${TURN_RELAY_END}"
-        "TURN_RELAY_HOST=${TURN_RELAY_HOST_RESOLVED}"
-        "TURN_RELAY_PORT=${TURN_RELAY_PORT}"
-        "TURN_RELAY_TLS_PORT=${TURN_RELAY_TLS_PORT}"
-        "SESSION_PEPPER=${SESSION_PEPPER}"
-        "MASTER_KEY=${MASTER_KEY}"
-        "TOTP_ENCRYPTION_KEY=${TOTP_ENCRYPTION_KEY}"
-        "WEBHOOK_SECRET=${WEBHOOK_SECRET}"
-        "LIVEKIT_API_KEY=${LIVEKIT_API_KEY}"
-        "LIVEKIT_API_SECRET=${LIVEKIT_API_SECRET}"
-        "TURN_SECRET=${TURN_SECRET_RESOLVED}"
-        "AGE_RECIPIENT=${AGE_RECIPIENT:-}"
-        "SQLITE_READ_POOL=${PROFILE_SQLITE_READ_POOL}"
-        "SQLITE_CACHE_SIZE=-${PROFILE_SQLITE_CACHE_MB}000"
-        "SQLITE_MMAP_SIZE=$((PROFILE_SQLITE_MMAP_MB * 1024 * 1024))"
-        "GOMAXPROCS=${PROFILE_GOMAXPROCS}"
-        "LRU_CACHE_ENTRIES=${PROFILE_LRU_ENTRIES}"
-        "MAX_UPLOAD_SIZE=$((EFFECTIVE_UPLOAD_MB * 1024 * 1024))"
-        "PROFILE_UPLOAD_MB=${EFFECTIVE_UPLOAD_MB}"
-        "APP_CPUS=${PROFILE_APP_CPUS}"
-        "APP_MEMORY_LIMIT=${PROFILE_APP_LIMIT}"
-        "LIVEKIT_CPUS=${PROFILE_LIVEKIT_CPUS}"
-        "LIVEKIT_MEMORY_LIMIT=${PROFILE_LIVEKIT_LIMIT}"
-        "LIVEKIT_MAX_PARTICIPANTS=${PROFILE_LIVEKIT_MAX_PARTICIPANTS}"
-        "LIVEKIT_MAX_VIDEO=${PROFILE_LIVEKIT_MAX_VIDEO}"
-        "LIVEKIT_DISABLE_SIMULCAST=${PROFILE_LIVEKIT_DISABLE_SIMULCAST}"
-        "LIVEKIT_USE_EXTERNAL_IP=${PROFILE_LIVEKIT_USE_EXTERNAL_IP}"
-        "SHARE_SOFT=${PROFILE_SHARE_SOFT}"
-        "SHARE_MAX=${PROFILE_SHARE_MAX}"
-        "BACKUP_KEEP=${PROFILE_BACKUP_KEEP}"
-        "SWAP_SIZE=${PROFILE_SWAP_GB}"
-        "REGISTRATION_ENABLED=${REGISTRATION_ENABLED}"
-        "ANTI_BOT_ENABLED=${ANTI_BOT_ENABLED:-false}"
-        "FAIL2BAN_ENABLED=${ENABLE_FAIL2BAN}"
-        "UFW_ENABLED=${ENABLE_UFW}"
-        "NFTABLES_ENABLED=${ENABLE_NFTABLES}"
-        "SSH_HARDENING=${SSH_HARDENING}"
-        "ADMIN_EMAIL=${ADMIN_EMAIL}"
-        "ADMIN_PASSWORD=${ADMIN_PASSWORD}"
-    )
+    # Подстановка через python3: значения содержат @, /, пробелы и кавычки,
+    # поэтому sed с произвольным разделителем ненадёжен.
+    command -v python3 >/dev/null 2>&1 || die "для генерации .env нужен python3"
+    local pairs_file
+    pairs_file="$(mktemp)"
+    cat >"$pairs_file" <<PAIREOF
+DOMAIN=${DOMAIN}
+FILES_DOMAIN=${FILES_DOMAIN_RESOLVED}
+INSTANCE_NAME=${INSTANCE_NAME}
+MAIN_GUILD_NAME=${MAIN_GUILD_NAME}
+PROFILE=${PROFILE_RESOLVED}
+PROXY_MODE=${PROXY_MODE}
+IMAGE_TAG=${IMAGE_TAG}
+APP_IMAGE=${APP_IMAGE}
+CADDY_IMAGE_TAG=${CADDY_IMAGE_TAG}
+LIVEKIT_IMAGE_TAG=${LIVEKIT_IMAGE_TAG}
+LOG_LEVEL=${LOG_LEVEL}
+TLS_ENABLED=${TLS_ENABLED}
+SKIP_TLS=${SKIP_TLS}
+TLS_BY_PROXY=${TLS_BY_PROXY}
+GLCHAT_DATA_DIR=${GLCHAT_DATA_DIR}
+CADDY_PROFILE=${CADDY_PROFILE}
+GLCHAT_TURN_CERT_DIR=${TURN_CERT_DIR}
+GLCHAT_APP_BIND=${APP_BIND_ADDR}
+GLCHAT_LIVEKIT_BIND=${LIVEKIT_BIND_ADDR}
+APP_PORT=${APP_PORT}
+LIVEKIT_WS_PORT=${LIVEKIT_WS_PORT}
+LIVEKIT_TCP_PORT=${LIVEKIT_TCP_PORT}
+LIVEKIT_UDP_PORT=${LIVEKIT_UDP_PORT}
+HTTP_PORT=${HTTP_PORT}
+HTTPS_PORT=${HTTPS_PORT}
+SSH_PORT=${SSH_PORT}
+TURN_ENABLED=${TURN_ENABLED}
+TURN_DOMAIN=${TURN_DOMAIN_RESOLVED}
+TURN_UDP_PORT=${TURN_UDP_PORT}
+TURN_TLS_PORT=${TURN_TLS_PORT}
+TURN_EXTERNAL_TLS=${TURN_EXTERNAL_TLS}
+TURN_RELAY_START=${TURN_RELAY_START}
+TURN_RELAY_END=${TURN_RELAY_END}
+TURN_RELAY_HOST=${TURN_RELAY_HOST_RESOLVED}
+TURN_RELAY_PORT=${TURN_RELAY_PORT}
+TURN_RELAY_TLS_PORT=${TURN_RELAY_TLS_PORT}
+SESSION_PEPPER=${SESSION_PEPPER}
+MASTER_KEY=${MASTER_KEY}
+TOTP_ENCRYPTION_KEY=${TOTP_ENCRYPTION_KEY}
+WEBHOOK_SECRET=${WEBHOOK_SECRET}
+LIVEKIT_API_KEY=${LIVEKIT_API_KEY}
+LIVEKIT_API_SECRET=${LIVEKIT_API_SECRET}
+TURN_SECRET=${TURN_SECRET_RESOLVED}
+AGE_RECIPIENT=${AGE_RECIPIENT:-}
+SQLITE_READ_POOL=${PROFILE_SQLITE_READ_POOL}
+SQLITE_CACHE_SIZE=-${PROFILE_SQLITE_CACHE_MB}000
+SQLITE_MMAP_SIZE=$((PROFILE_SQLITE_MMAP_MB * 1024 * 1024))
+GOMAXPROCS=${PROFILE_GOMAXPROCS}
+LRU_CACHE_ENTRIES=${PROFILE_LRU_ENTRIES}
+MAX_UPLOAD_SIZE=$((EFFECTIVE_UPLOAD_MB * 1024 * 1024))
+PROFILE_UPLOAD_MB=${EFFECTIVE_UPLOAD_MB}
+APP_CPUS=${PROFILE_APP_CPUS}
+APP_MEMORY_LIMIT=${PROFILE_APP_LIMIT}
+LIVEKIT_CPUS=${PROFILE_LIVEKIT_CPUS}
+LIVEKIT_MEMORY_LIMIT=${PROFILE_LIVEKIT_LIMIT}
+LIVEKIT_MAX_PARTICIPANTS=${PROFILE_LIVEKIT_MAX_PARTICIPANTS}
+LIVEKIT_MAX_VIDEO=${PROFILE_LIVEKIT_MAX_VIDEO}
+LIVEKIT_DISABLE_SIMULCAST=${PROFILE_LIVEKIT_DISABLE_SIMULCAST}
+LIVEKIT_USE_EXTERNAL_IP=${PROFILE_LIVEKIT_USE_EXTERNAL_IP}
+SHARE_SOFT=${PROFILE_SHARE_SOFT}
+SHARE_MAX=${PROFILE_SHARE_MAX}
+BACKUP_KEEP=${PROFILE_BACKUP_KEEP}
+SWAP_SIZE=${PROFILE_SWAP_GB}
+REGISTRATION_ENABLED=${REGISTRATION_ENABLED}
+ANTI_BOT_ENABLED=${ANTI_BOT_ENABLED:-false}
+FAIL2BAN_ENABLED=${ENABLE_FAIL2BAN}
+UFW_ENABLED=${ENABLE_UFW}
+NFTABLES_ENABLED=${ENABLE_NFTABLES}
+SSH_HARDENING=${SSH_HARDENING}
+ADMIN_EMAIL=${ADMIN_EMAIL}
+ADMIN_PASSWORD=${ADMIN_PASSWORD}
+PAIREOF
 
-    local sed_args=()
-    local pair key value
-    for pair in "${pairs[@]}"; do
-        key="${pair%%=*}"
-        value="${pair#*=}"
-        sed_args+=(-e "s@@${key}@@${value}@g")
-    done
-    sed -i.bak "${sed_args[@]}" "$tmp"
+    python3 - "$tmp" "$pairs_file" <<'PYEOF'
+import sys
+
+template_path, pairs_path = sys.argv[1], sys.argv[2]
+template = open(template_path, encoding="utf-8").read()
+values = {}
+for line in open(pairs_path, encoding="utf-8"):
+    line = line.rstrip("
+")
+    if "=" not in line:
+        continue
+    key, value = line.split("=", 1)
+    values[key] = value
+
+for key, value in values.items():
+    template = template.replace("@" + key + "@", value)
+
+leftovers = [t for t in __import__("re").findall(r"@[A-Z_]{2,}@", template)]
+open(template_path, "w", encoding="utf-8").write(template)
+if leftovers:
+    print("незаполненные плейсхолдеры: " + ", ".join(sorted(set(leftovers))), file=sys.stderr)
+    sys.exit(1)
+PYEOF
+    rm -f "$pairs_file"
 
     install -m 600 "$tmp" "$GLCHAT_ENV_FILE"
     rm -f "$tmp" "$tmp.bak"