feat(compose): use one secret bundle for local services

docker/core-entrypoint.sh

@@ -1,6 +1,12 @@
 #!/bin/sh
 set -eu
 
+if [ -r /app/docker/secret-policy.sh ]; then
+  . /app/docker/secret-policy.sh
+else
+  . "$(CDPATH= cd -- "$(dirname -- "$0")/../deploy/vector" && pwd)/secret-policy.sh"
+fi
+
 if [ -n "${PI_PROVIDER_API_KEY:-}" ]; then
   echo "PI_PROVIDER_API_KEY is unsupported; configure THT_MODEL_API_KEY_FILE" >&2
   exit 2
@@ -24,6 +30,49 @@ load_secret THT_DWH_API_KEY THT_DWH_API_KEY_FILE
 load_secret THT_VEC_API_KEY THT_VEC_API_KEY_FILE
 load_secret THT_VEC_WRITE_API_KEY THT_VEC_WRITE_API_KEY_FILE
 
+secret_tmp_dir=
+cleanup_secret_tmp() {
+  if [ -n "${secret_tmp_dir:-}" ]; then rm -rf "$secret_tmp_dir"; fi
+}
+trap cleanup_secret_tmp EXIT HUP INT TERM
+
+bundle=${THT_SECRETS_FILE:-}
+if [ -n "$bundle" ] && [ -r "$bundle" ]; then
+  # REST adapters consume these values while the harness is running.  They are
+  # loaded here (before `tht` starts), not only in the backend/Pi process.
+  load_bundle_env() {
+    env_name=$1
+    key=$2
+    value=$(read_bundle_secret "$bundle" "$key" 2>/dev/null || true)
+    if [ -n "$value" ]; then export "$env_name=$value"; fi
+  }
+  load_bundle_env THT_DWH_API_KEY THT_DWH_API_KEY
+  load_bundle_env THT_VEC_API_KEY THT_VEC_API_KEY
+  load_bundle_env THT_VEC_WRITE_API_KEY THT_VEC_WRITE_API_KEY
+  load_bundle_env THT_SSL_CA THT_SSL_CA
+  if [ -z "${THT_SSL_CA:-}" ]; then load_bundle_env THT_SSL_CA THT_CA; fi
+
+  # DatabaseConfig intentionally accepts password_file paths.  Materialize
+  # short-lived 0600 files so workspace interpolation never puts a password in
+  # YAML, a URL, or the container's immutable Config.Env.
+  umask 077
+  secret_tmp_dir=$(mktemp -d "${TMPDIR:-/tmp}/thothii-secrets.XXXXXX")
+  materialize_password() {
+    env_name=$1
+    key=$2
+    value=$(read_bundle_secret "$bundle" "$key" 2>/dev/null || true)
+    if [ -n "$value" ]; then
+      file="$secret_tmp_dir/$key"
+      printf '%s' "$value" >"$file"
+      export "$env_name=$file"
+    fi
+  }
+  materialize_password THT_VECTOR_BOOTSTRAP_PASSWORD_FILE THT_VECTOR_BOOTSTRAP_PASSWORD
+  materialize_password THT_VECTOR_MIGRATOR_PASSWORD_FILE THT_VECTOR_MIGRATOR_PASSWORD
+  materialize_password THT_VECTOR_READER_PASSWORD_FILE THT_VECTOR_READER_PASSWORD
+  materialize_password THT_VECTOR_WRITER_PASSWORD_FILE THT_VECTOR_WRITER_PASSWORD
+fi
+
 case "${1:-server}" in
   server)
     shift || true