Merge pull request 'Initial dev deployment [infra]' (#743) from dev-742 into main

Reviewed-on: #743 [infra]

.woodpecker/bff.yml

@@ -5,7 +5,6 @@ matrix:
       BFF_MONGO_SECRET_PATH: sendico/db
       BFF_API_SECRET_PATH: sendico/api/endpoint
       BFF_VAULT_SECRET_PATH: sendico/edge/bff/vault
-      BFF_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -21,9 +20,10 @@ when:
         - api/payments/methods/go.sum
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/bff.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/billing_documents.yml

@@ -3,7 +3,6 @@ matrix:
     - DOCUMENTS_IMAGE_PATH: billing/documents
       DOCUMENTS_DOCKERFILE: ci/prod/compose/billing_documents.dockerfile
       DOCUMENTS_MONGO_SECRET_PATH: sendico/db
-      DOCUMENTS_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -16,9 +15,10 @@ when:
         - api/billing/documents/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/billing_documents.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/billing_fees.yml

@@ -3,7 +3,6 @@ matrix:
     - FEES_IMAGE_PATH: billing/fees
       FEES_DOCKERFILE: ci/prod/compose/billing_fees.dockerfile
       FEES_MONGO_SECRET_PATH: sendico/db
-      FEES_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -16,9 +15,10 @@ when:
         - api/billing/fees/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/billing_fees.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/callbacks.yml

@@ -4,7 +4,6 @@ matrix:
       CALLBACKS_DOCKERFILE: ci/prod/compose/callbacks.dockerfile
       CALLBACKS_MONGO_SECRET_PATH: sendico/db
       CALLBACKS_VAULT_SECRET_PATH: sendico/edge/callbacks/vault
-      CALLBACKS_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -17,9 +16,10 @@ when:
         - api/edge/callbacks/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/callbacks.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/db.yml

@@ -46,9 +46,11 @@ steps:
       - apk add --no-cache bash openssh-client rsync coreutils
       - mkdir -p /root/.ssh
       - install -m 600 secrets/SSH_KEY /root/.ssh/id_rsa
-      - sed -i 's/\r$//' ./ci/prod/.env.runtime
+      - . ./ci/scripts/common/runtime_env.sh
+      - export RUNTIME_ENV_FILE="$(resolve_runtime_env_file "$(resolve_runtime_env_name)")"
+      - sed -i 's/\r$//' "${RUNTIME_ENV_FILE}"
       - set -a
-      - . ./ci/prod/.env.runtime
+      - . "${RUNTIME_ENV_FILE}"
       - . ./.env.version
       - set +a
       - bash ci/prod/scripts/bootstrap/network.sh

.woodpecker/discovery.yml

@@ -2,7 +2,6 @@ matrix:
   include:
     - DISCOVERY_IMAGE_PATH: discovery/service
       DISCOVERY_DOCKERFILE: ci/prod/compose/discovery.dockerfile
-      DISCOVERY_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -15,9 +14,10 @@ when:
         - api/discovery/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/discovery.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/frontend.yml

@@ -2,7 +2,6 @@ matrix:
   include:
     - FRONTEND_IMAGE_PATH: frontend/service
       FRONTEND_DOCKERFILE: ci/prod/compose/frontend.dockerfile
-      FRONTEND_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -17,9 +16,10 @@ when:
         - api/proto/**
         - frontend/**
         - interface/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/frontend.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/fx_ingestor.yml

@@ -6,7 +6,6 @@ matrix:
       FX_DEPLOY_TARGET: ingestor
       FX_MONGO_SECRET_PATH: sendico/db
       FX_NEEDS_NATS: "true"
-      FX_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -20,9 +19,10 @@ when:
         - api/fx/storage/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/fx_ingestor.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/fx_oracle.yml

@@ -6,7 +6,6 @@ matrix:
       FX_DEPLOY_TARGET: oracle
       FX_MONGO_SECRET_PATH: sendico/db
       FX_NEEDS_NATS: "true"
-      FX_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -20,9 +19,10 @@ when:
         - api/fx/storage/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/fx_oracle.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 
 steps:

.woodpecker/gateway_chain.yml

@@ -6,7 +6,6 @@ matrix:
       CHAIN_GATEWAY_RPC_SECRET_PATH: sendico/gateway/chain
       CHAIN_GATEWAY_WALLET_SECRET_PATH: sendico/gateway/chain/wallet
       CHAIN_GATEWAY_VAULT_SECRET_PATH: sendico/gateway/chain/vault
-      CHAIN_GATEWAY_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -20,9 +19,10 @@ when:
         - api/gateway/common/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/gateway_chain.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/gateway_mntx.yml

@@ -2,7 +2,6 @@ matrix:
   include:
     - MNTX_GATEWAY_IMAGE_PATH: gateway/mntx
       MNTX_GATEWAY_DOCKERFILE: ci/prod/compose/mntx_gateway.dockerfile
-      MNTX_GATEWAY_ENV: prod
       MNTX_GATEWAY_MONETIX_SECRET_PATH: sendico/gateway/monetix
       MNTX_GATEWAY_NATS_SECRET_PATH: sendico/nats
       MNTX_GATEWAY_MONGO_SECRET_PATH: sendico/db
@@ -19,9 +18,10 @@ when:
         - api/gateway/common/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/gateway_mntx.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/gateway_tgsettle.yml

@@ -3,7 +3,6 @@ matrix:
     - TGSETTLE_GATEWAY_IMAGE_PATH: gateway/tgsettle
       TGSETTLE_GATEWAY_DOCKERFILE: ci/prod/compose/tgsettle_gateway.dockerfile
       TGSETTLE_GATEWAY_MONGO_SECRET_PATH: sendico/db
-      TGSETTLE_GATEWAY_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -17,9 +16,10 @@ when:
         - api/gateway/common/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/gateway_tgsettle.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/gateway_tron.yml

@@ -6,7 +6,6 @@ matrix:
       TRON_GATEWAY_RPC_SECRET_PATH: sendico/gateway/tron
       TRON_GATEWAY_WALLET_SECRET_PATH: sendico/gateway/tron/wallet
       TRON_GATEWAY_VAULT_SECRET_PATH: sendico/gateway/tron/vault
-      TRON_GATEWAY_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -20,9 +19,10 @@ when:
         - api/gateway/common/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/gateway_tron.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/ledger.yml

@@ -3,7 +3,6 @@ matrix:
     - LEDGER_IMAGE_PATH: ledger/service
       LEDGER_DOCKERFILE: ci/prod/compose/ledger.dockerfile
       LEDGER_MONGO_SECRET_PATH: sendico/db
-      LEDGER_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -16,9 +15,10 @@ when:
         - api/ledger/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/ledger.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/nats.yml

@@ -45,9 +45,11 @@ steps:
       - apk add --no-cache bash openssh-client rsync coreutils curl sed python3
       - mkdir -p /root/.ssh
       - install -m 600 secrets/SSH_KEY /root/.ssh/id_rsa
-      - sed -i 's/\r$//' ./ci/prod/.env.runtime
+      - . ./ci/scripts/common/runtime_env.sh
+      - export RUNTIME_ENV_FILE="$(resolve_runtime_env_file "$(resolve_runtime_env_name)")"
+      - sed -i 's/\r$//' "${RUNTIME_ENV_FILE}"
       - set -a
-      - . ./ci/prod/.env.runtime
+      - . "${RUNTIME_ENV_FILE}"
       - . ./.env.version
       - set +a
       - export NATS_USER="$(./ci/vlt kv_get kv sendico/nats user)"

.woodpecker/notification.yml

@@ -6,7 +6,6 @@ matrix:
       NOTIFICATION_MAIL_SECRET_PATH: sendico/notification/mail
       NOTIFICATION_API_SECRET_PATH: sendico/api/endpoint
       NOTIFICATION_TELEGRAM_SECRET_PATH: sendico/notification/telegram
-      NOTIFICATION_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -19,9 +18,10 @@ when:
         - api/notification/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/notification.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/payments_methods.yml

@@ -3,7 +3,6 @@ matrix:
     - PAYMENTS_METHODS_IMAGE_PATH: payments/methods
       PAYMENTS_METHODS_DOCKERFILE: ci/prod/compose/payments_methods.dockerfile
       PAYMENTS_METHODS_MONGO_SECRET_PATH: sendico/db
-      PAYMENTS_METHODS_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -17,9 +16,10 @@ when:
         - api/payments/storage/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/payments_methods.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/payments_orchestrator.yml

@@ -3,7 +3,6 @@ matrix:
     - PAYMENTS_IMAGE_PATH: payments/orchestrator
       PAYMENTS_DOCKERFILE: ci/prod/compose/payments_orchestrator.dockerfile
       PAYMENTS_MONGO_SECRET_PATH: sendico/db
-      PAYMENTS_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -17,9 +16,10 @@ when:
         - api/payments/storage/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/payments_orchestrator.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

.woodpecker/payments_quotation.yml

@@ -3,7 +3,6 @@ matrix:
     - PAYMENTS_QUOTATION_IMAGE_PATH: payments/quotation
       PAYMENTS_QUOTATION_DOCKERFILE: ci/prod/compose/payments_quotation.dockerfile
       PAYMENTS_QUOTATION_MONGO_SECRET_PATH: sendico/db
-      PAYMENTS_QUOTATION_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -17,9 +16,10 @@ when:
         - api/payments/storage/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/payments_quotation.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version

README.md

@@ -110,6 +110,19 @@ make test-backend   # Run Go backend tests only
 make test-frontend  # Run Flutter tests only
 ```
 
+## Release Flow
+
+- Pushes to `main` build and deploy changed application services to the dev server.
+- Tags matching `v*` trigger a full production rebuild and deployment from that exact tagged revision.
+- Infrastructure workflows for `db` and `nats` remain separately controlled.
+
+Example production release:
+
+```bash
+git tag -a v1.4.0 <commit-sha>
+git push origin v1.4.0
+```
+
 ### Backend CI Bypass Tags
 
 Backend Woodpecker module pipelines now run both lint and tests before image build/deploy.

ci/devserver/.env.runtime

@@ -0,0 +1,9 @@
+# Overrides for the shared prod-style runtime when deploying main to the dev server.
+
+AMPLI_ENVIRONMENT=development
+API_PROTOCOL=http
+SERVICE_HOST=178.57.67.136
+WS_PROTOCOL=ws
+
+SSH_HOST=178.57.67.136
+SSH_USER=cloud

ci/prod/compose/bff.yml

@@ -24,7 +24,7 @@ services:
     container_name: sendico-bff
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/bff/service:${APP_V}
+    image: ${REGISTRY_URL}/bff/service:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       AMPLI_ENVIRONMENT: ${AMPLI_ENVIRONMENT}

ci/prod/compose/billing_documents.yml

@@ -16,7 +16,7 @@ services:
     container_name: sendico-billing-documents
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/billing/documents:${APP_V}
+    image: ${REGISTRY_URL}/billing/documents:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       DOCUMENTS_MONGO_HOST: ${DOCUMENTS_MONGO_HOST}

ci/prod/compose/billing_fees.yml

@@ -16,7 +16,7 @@ services:
     container_name: sendico-billing-fees
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/billing/fees:${APP_V}
+    image: ${REGISTRY_URL}/billing/fees:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       FEES_MONGO_HOST: ${FEES_MONGO_HOST}

ci/prod/compose/callbacks.yml

@@ -24,7 +24,7 @@ services:
     container_name: sendico-callbacks
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/edge/callbacks:${APP_V}
+    image: ${REGISTRY_URL}/edge/callbacks:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       CALLBACKS_MONGO_HOST: ${CALLBACKS_MONGO_HOST}

ci/prod/compose/chain_gateway.yml

@@ -24,7 +24,7 @@ services:
     container_name: sendico-chain-gateway
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/gateway/chain:${APP_V}
+    image: ${REGISTRY_URL}/gateway/chain:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       CHAIN_GATEWAY_MONGO_HOST: ${CHAIN_GATEWAY_MONGO_HOST}

ci/prod/compose/discovery.yml

@@ -16,7 +16,7 @@ services:
     container_name: sendico-discovery
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/discovery/service:${APP_V}
+    image: ${REGISTRY_URL}/discovery/service:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       NATS_URL: ${NATS_URL}

ci/prod/compose/frontend.yml

@@ -19,7 +19,7 @@ services:
     <<: *common-env
     container_name: sendico-frontend
     restart: unless-stopped
-    image: ${REGISTRY_URL}/frontend/service:${APP_V}
+    image: ${REGISTRY_URL}/frontend/service:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       WS_PROTOCOL: ${WS_PROTOCOL}

ci/prod/compose/fx_ingestor.yml

@@ -16,7 +16,7 @@ services:
     container_name: sendico-fx-ingestor
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/fx/ingestor:${APP_V}
+    image: ${REGISTRY_URL}/fx/ingestor:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       FX_MONGO_HOST: ${FX_MONGO_HOST}

ci/prod/compose/fx_oracle.yml

@@ -16,7 +16,7 @@ services:
     container_name: sendico-fx-oracle
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/fx/oracle:${APP_V}
+    image: ${REGISTRY_URL}/fx/oracle:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       FX_MONGO_HOST: ${FX_MONGO_HOST}

ci/prod/compose/ledger.yml

@@ -16,7 +16,7 @@ services:
     container_name: sendico-ledger
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/ledger/service:${APP_V}
+    image: ${REGISTRY_URL}/ledger/service:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       LEDGER_MONGO_HOST: ${LEDGER_MONGO_HOST}

ci/prod/compose/mntx_gateway.yml

@@ -16,7 +16,7 @@ services:
     container_name: sendico-mntx-gateway
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/gateway/mntx:${APP_V}
+    image: ${REGISTRY_URL}/gateway/mntx:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       MNTX_GATEWAY_MONGO_HOST: ${MNTX_GATEWAY_MONGO_HOST}

ci/prod/compose/notification.yml

@@ -16,7 +16,7 @@ services:
     container_name: sendico-notification
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/notification/service:${APP_V}
+    image: ${REGISTRY_URL}/notification/service:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       AMPLI_ENVIRONMENT: ${AMPLI_ENVIRONMENT}

ci/prod/compose/payments_methods.yml

@@ -16,7 +16,7 @@ services:
     container_name: sendico-payments-methods
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/payments/methods:${APP_V}
+    image: ${REGISTRY_URL}/payments/methods:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       PAYMENTS_MONGO_HOST: ${PAYMENTS_MONGO_HOST}

ci/prod/compose/payments_orchestrator.yml

@@ -16,7 +16,7 @@ services:
     container_name: sendico-payments-orchestrator
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/payments/orchestrator:${APP_V}
+    image: ${REGISTRY_URL}/payments/orchestrator:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       PAYMENTS_MONGO_HOST: ${PAYMENTS_MONGO_HOST}

ci/prod/compose/payments_quotation.yml

@@ -16,7 +16,7 @@ services:
     container_name: sendico-payments-quotation
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/payments/quotation:${APP_V}
+    image: ${REGISTRY_URL}/payments/quotation:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       PAYMENTS_MONGO_HOST: ${PAYMENTS_MONGO_HOST}

ci/prod/compose/tgsettle_gateway.yml

@@ -16,7 +16,7 @@ services:
     container_name: sendico-tgsettle-gateway
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/gateway/tgsettle:${APP_V}
+    image: ${REGISTRY_URL}/gateway/tgsettle:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       TGSETTLE_GATEWAY_MONGO_HOST: ${TGSETTLE_GATEWAY_MONGO_HOST}

ci/prod/compose/tron_gateway.yml

@@ -24,7 +24,7 @@ services:
     container_name: sendico-tron-gateway
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/gateway/tron:${APP_V}
+    image: ${REGISTRY_URL}/gateway/tron:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       TRON_GATEWAY_MONGO_HOST: ${TRON_GATEWAY_MONGO_HOST}

ci/prod/scripts/deploy/bff.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-bff] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${BFF_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="bff.yml"
 SERVICE_NAMES="${BFF_SERVICE_NAME}"
 
@@ -68,7 +69,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -112,6 +113,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/billing_documents.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-billing-documents] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${DOCUMENTS_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="billing_documents.yml"
 SERVICE_NAMES="${DOCUMENTS_SERVICE_NAME}"
 
@@ -72,7 +73,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -118,6 +119,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/billing_fees.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-billing-fees] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${FEES_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="billing_fees.yml"
 SERVICE_NAMES="${FEES_SERVICE_NAME}"
 
@@ -62,7 +63,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -103,6 +104,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/callbacks.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-callbacks] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${CALLBACKS_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="callbacks.yml"
 SERVICE_NAMES="${CALLBACKS_SERVICE_NAME}"
 
@@ -66,7 +67,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -109,6 +110,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/chain_gateway.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-chain-gateway] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${CHAIN_GATEWAY_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="chain_gateway.yml"
 SERVICE_NAMES="${CHAIN_GATEWAY_SERVICE_NAME}"
 
@@ -72,7 +73,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/compose/secrets ${REMOTE_DIR}/env"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -118,6 +119,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/db.sh

@@ -15,6 +15,7 @@ trap 'echo "[deploy-db] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${DB_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 
 # SSH options: quiet by default; add -vv in debug mode
 SSH_OPTS=(
@@ -37,7 +38,7 @@ ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 # Sync compose bundle and runtime env to the remote host
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/    "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 
 # Deploy on remote: pass AppRole creds ONLY to compose invocations.
 # The vault-agent container writes them into tmpfs and unsets them internally.

ci/prod/scripts/deploy/discovery.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-discovery] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${DISCOVERY_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="discovery.yml"
 SERVICE_NAMES="${DISCOVERY_SERVICE_NAME}"
 
@@ -58,7 +59,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -97,6 +98,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/frontend.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-frontend] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${FRONTEND_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="frontend.yml"
 SERVICE_NAMES="${FRONTEND_SERVICE_NAME}"
 
@@ -37,7 +38,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -73,6 +74,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 COMPOSE_PROJECT_NAME="$COMPOSE_PROJECT"
 export COMPOSE_PROJECT_NAME
 read -r -a SERVICES <<<"${SERVICES_LINE}"

ci/prod/scripts/deploy/fx.sh

@@ -15,6 +15,7 @@ SERVICE="$1"
 : "${SSH_HOST:?missing SSH_HOST}"
 
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 
 case "$SERVICE" in
   ingestor)
@@ -88,7 +89,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -129,6 +130,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/ledger.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-ledger] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${LEDGER_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="ledger.yml"
 SERVICE_NAMES="${LEDGER_SERVICE_NAME}"
 
@@ -62,7 +63,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -103,6 +104,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/mntx_gateway.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-mntx-gateway] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${MNTX_GATEWAY_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="mntx_gateway.yml"
 SERVICE_NAMES="${MNTX_GATEWAY_SERVICE_NAME}"
 
@@ -66,7 +67,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/compose ${REMOTE_DIR}/env"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -109,6 +110,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/nats.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-nats] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${NATS_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 
 SSH_OPTS=(
   -i /root/.ssh/id_rsa
@@ -31,7 +32,7 @@ ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/nats.yml "$REMOTE_TARGET:${REMOTE_DIR}/compose/nats.yml"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/nats.dockerfile "$REMOTE_TARGET:${REMOTE_DIR}/compose/nats.dockerfile"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" \
   REMOTE_DIR="$REMOTE_DIR" \

ci/prod/scripts/deploy/notification.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-notification] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${NOTIFICATION_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="notification.yml"
 SERVICE_NAMES="${NOTIFICATION_SERVICE_NAME}"
 
@@ -73,7 +74,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -120,6 +121,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/payments_methods.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-payments-methods] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${PAYMENTS_METHODS_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="payments_methods.yml"
 SERVICE_NAMES="${PAYMENTS_METHODS_SERVICE_NAME}"
 
@@ -62,7 +63,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -103,6 +104,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/payments_orchestrator.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-payments-orchestrator] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${PAYMENTS_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="payments_orchestrator.yml"
 SERVICE_NAMES="${PAYMENTS_SERVICE_NAME}"
 
@@ -62,7 +63,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -103,6 +104,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/payments_quotation.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-payments-quotation] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${PAYMENTS_QUOTATION_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="payments_quotation.yml"
 SERVICE_NAMES="${PAYMENTS_QUOTATION_SERVICE_NAME}"
 
@@ -62,7 +63,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -103,6 +104,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/tgsettle_gateway.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-tgsettle-gateway] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${TGSETTLE_GATEWAY_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="tgsettle_gateway.yml"
 SERVICE_NAMES="${TGSETTLE_GATEWAY_SERVICE_NAME}"
 
@@ -62,7 +63,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -103,6 +104,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/prod/scripts/deploy/tron_gateway.sh

@@ -12,6 +12,7 @@ trap 'echo "[deploy-tron-gateway] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${TRON_GATEWAY_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="tron_gateway.yml"
 SERVICE_NAMES="${TRON_GATEWAY_SERVICE_NAME}"
 
@@ -74,7 +75,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/compose/secrets ${REMOTE_DIR}/env"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -122,6 +123,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else

ci/scripts/bff/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-BFF_ENV_NAME="${BFF_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${BFF_ENV_NAME}/.env.runtime"
+BFF_ENV_NAME="${BFF_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${BFF_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[bff-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${BFF_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${BFF_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${BFF_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/bff/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-BFF_ENV_NAME="${BFF_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${BFF_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[bff-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+BFF_ENV_NAME="${BFF_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${BFF_ENV_NAME}"
 
 BFF_MONGO_SECRET_PATH="${BFF_MONGO_SECRET_PATH:?missing BFF_MONGO_SECRET_PATH}"
 BFF_API_SECRET_PATH="${BFF_API_SECRET_PATH:?missing BFF_API_SECRET_PATH}"

ci/scripts/billing_documents/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-DOCUMENTS_ENV_NAME="${DOCUMENTS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${DOCUMENTS_ENV_NAME}/.env.runtime"
+DOCUMENTS_ENV_NAME="${DOCUMENTS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${DOCUMENTS_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[billing-documents-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${DOCUMENTS_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${DOCUMENTS_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${DOCUMENTS_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/billing_documents/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-DOCUMENTS_ENV_NAME="${DOCUMENTS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${DOCUMENTS_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[billing-documents-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+DOCUMENTS_ENV_NAME="${DOCUMENTS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${DOCUMENTS_ENV_NAME}"
 
 DOCUMENTS_MONGO_SECRET_PATH="${DOCUMENTS_MONGO_SECRET_PATH:?missing DOCUMENTS_MONGO_SECRET_PATH}"
 

ci/scripts/billing_fees/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-FEES_ENV_NAME="${FEES_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${FEES_ENV_NAME}/.env.runtime"
+FEES_ENV_NAME="${FEES_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${FEES_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[billing-fees-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${FEES_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${FEES_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${FEES_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/billing_fees/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-FEES_ENV_NAME="${FEES_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${FEES_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[billing-fees-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+FEES_ENV_NAME="${FEES_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${FEES_ENV_NAME}"
 
 FEES_MONGO_SECRET_PATH="${FEES_MONGO_SECRET_PATH:?missing FEES_MONGO_SECRET_PATH}"
 

ci/scripts/callbacks/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-CALLBACKS_ENV_NAME="${CALLBACKS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${CALLBACKS_ENV_NAME}/.env.runtime"
+CALLBACKS_ENV_NAME="${CALLBACKS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${CALLBACKS_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[callbacks-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${CALLBACKS_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${CALLBACKS_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${CALLBACKS_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/callbacks/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-CALLBACKS_ENV_NAME="${CALLBACKS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${CALLBACKS_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[callbacks-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+CALLBACKS_ENV_NAME="${CALLBACKS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${CALLBACKS_ENV_NAME}"
 
 CALLBACKS_MONGO_SECRET_PATH="${CALLBACKS_MONGO_SECRET_PATH:?missing CALLBACKS_MONGO_SECRET_PATH}"
 CALLBACKS_VAULT_SECRET_PATH="${CALLBACKS_VAULT_SECRET_PATH:?missing CALLBACKS_VAULT_SECRET_PATH}"

ci/scripts/chain_gateway/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-CHAIN_GATEWAY_ENV_NAME="${CHAIN_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${CHAIN_GATEWAY_ENV_NAME}/.env.runtime"
+CHAIN_GATEWAY_ENV_NAME="${CHAIN_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${CHAIN_GATEWAY_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[chain-gateway-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -93,7 +85,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${CHAIN_GATEWAY_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${CHAIN_GATEWAY_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${CHAIN_GATEWAY_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/chain_gateway/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-CHAIN_GATEWAY_ENV_NAME="${CHAIN_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${CHAIN_GATEWAY_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[chain-gateway-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+CHAIN_GATEWAY_ENV_NAME="${CHAIN_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${CHAIN_GATEWAY_ENV_NAME}"
 
 CHAIN_GATEWAY_MONGO_SECRET_PATH="${CHAIN_GATEWAY_MONGO_SECRET_PATH:?missing CHAIN_GATEWAY_MONGO_SECRET_PATH}"
 CHAIN_GATEWAY_RPC_SECRET_PATH="${CHAIN_GATEWAY_RPC_SECRET_PATH:?missing CHAIN_GATEWAY_RPC_SECRET_PATH}"

ci/scripts/common/runtime_env.sh

@@ -0,0 +1,103 @@
+#!/bin/sh
+
+runtime_ci_event() {
+  if [ -n "${CI_PIPELINE_EVENT:-}" ]; then
+    printf '%s\n' "${CI_PIPELINE_EVENT}"
+    return
+  fi
+
+  if [ -n "${WOODPECKER_BUILD_EVENT:-}" ]; then
+    printf '%s\n' "${WOODPECKER_BUILD_EVENT}"
+    return
+  fi
+
+  printf 'local\n'
+}
+
+resolve_runtime_env_name() {
+  if [ -n "${CI_TARGET_ENV:-}" ]; then
+    printf '%s\n' "${CI_TARGET_ENV}"
+    return
+  fi
+
+  case "$(runtime_ci_event)" in
+    push)
+      printf 'devserver\n'
+      ;;
+    tag)
+      printf 'prod\n'
+      ;;
+    *)
+      printf 'prod\n'
+      ;;
+  esac
+}
+
+normalize_env_file() {
+  file="$1"
+  tmp="${file}.tmp.$$"
+  tr -d '\r' <"$file" >"$tmp"
+  mv "$tmp" "$file"
+}
+
+load_env_file() {
+  file="$1"
+  while IFS= read -r line || [ -n "$line" ]; do
+    case "$line" in
+      ''|\#*) continue ;;
+    esac
+    key="${line%%=*}"
+    value="${line#*=}"
+    key="$(printf '%s' "$key" | tr -d '[:space:]')"
+    value="${value#"${value%%[![:space:]]*}"}"
+    value="${value%"${value##*[![:space:]]}"}"
+    export "$key=$value"
+  done <"$file"
+}
+
+resolve_runtime_env_file() {
+  env_name="$1"
+  override_file="./ci/${env_name}/.env.runtime"
+
+  if [ ! -f "${override_file}" ]; then
+    echo "[runtime-env] runtime env file not found: ${override_file}" >&2
+    return 1
+  fi
+
+  if [ "${env_name}" = "prod" ]; then
+    printf '%s\n' "${override_file}"
+    return
+  fi
+
+  base_file="./ci/prod/.env.runtime"
+  if [ ! -f "${base_file}" ]; then
+    printf '%s\n' "${override_file}"
+    return
+  fi
+
+  merged_file="$(mktemp "${TMPDIR:-/tmp}/sendico-runtime.${env_name}.XXXXXX")"
+  cat "${base_file}" >"${merged_file}"
+  printf '\n' >>"${merged_file}"
+  cat "${override_file}" >>"${merged_file}"
+  printf '%s\n' "${merged_file}"
+}
+
+load_runtime_env_bundle() {
+  env_name="$1"
+  runtime_file="$(resolve_runtime_env_file "${env_name}")"
+
+  normalize_env_file "${runtime_file}"
+  normalize_env_file ./.env.version
+
+  load_env_file "${runtime_file}"
+  load_env_file ./.env.version
+
+  export CI_RUNTIME_ENV_NAME="${env_name}"
+  export RUNTIME_ENV_FILE="${runtime_file}"
+}
+
+compute_image_tag() {
+  : "${APP_V:?missing APP_V}"
+  : "${GIT_REV:?missing GIT_REV}"
+  printf '%s-%s\n' "${APP_V}" "${GIT_REV}"
+}

ci/scripts/discovery/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-DISCOVERY_ENV_NAME="${DISCOVERY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${DISCOVERY_ENV_NAME}/.env.runtime"
+DISCOVERY_ENV_NAME="${DISCOVERY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${DISCOVERY_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[discovery-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${DISCOVERY_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${DISCOVERY_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${DISCOVERY_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/discovery/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-DISCOVERY_ENV_NAME="${DISCOVERY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${DISCOVERY_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[discovery-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+DISCOVERY_ENV_NAME="${DISCOVERY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${DISCOVERY_ENV_NAME}"
 
 load_nats_env
 

ci/scripts/frontend/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-FRONTEND_ENV_NAME="${FRONTEND_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${FRONTEND_ENV_NAME}/.env.runtime"
+FRONTEND_ENV_NAME="${FRONTEND_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${FRONTEND_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[frontend-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${FRONTEND_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${FRONTEND_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${FRONTEND_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/frontend/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,8 @@ load_env_file() {
   done <"$file"
 }
 
-FRONTEND_ENV_NAME="${FRONTEND_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${FRONTEND_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[frontend-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+FRONTEND_ENV_NAME="${FRONTEND_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${FRONTEND_ENV_NAME}"
 
 if [ ! -s .env.version ]; then
   echo ".env.version is missing; run version step first" >&2

ci/scripts/fx/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-FX_ENV_NAME="${FX_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${FX_ENV_NAME}/.env.runtime"
+FX_ENV_NAME="${FX_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${FX_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[fx-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${FX_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${FX_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${FX_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/fx/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-FX_ENV_NAME="${FX_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${FX_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[fx-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+FX_ENV_NAME="${FX_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${FX_ENV_NAME}"
 
 FX_MONGO_SECRET_PATH="${FX_MONGO_SECRET_PATH:?missing FX_MONGO_SECRET_PATH}"
 FX_DEPLOY_TARGET="${FX_DEPLOY_TARGET:?missing FX_DEPLOY_TARGET}"

ci/scripts/ledger/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-LEDGER_ENV_NAME="${LEDGER_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${LEDGER_ENV_NAME}/.env.runtime"
+LEDGER_ENV_NAME="${LEDGER_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${LEDGER_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[ledger-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${LEDGER_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${LEDGER_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${LEDGER_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/ledger/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-LEDGER_ENV_NAME="${LEDGER_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${LEDGER_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[ledger-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+LEDGER_ENV_NAME="${LEDGER_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${LEDGER_ENV_NAME}"
 
 LEDGER_MONGO_SECRET_PATH="${LEDGER_MONGO_SECRET_PATH:?missing LEDGER_MONGO_SECRET_PATH}"
 

ci/scripts/mntx/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-MNTX_GATEWAY_ENV_NAME="${MNTX_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${MNTX_GATEWAY_ENV_NAME}/.env.runtime"
+MNTX_GATEWAY_ENV_NAME="${MNTX_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${MNTX_GATEWAY_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[mntx-gateway-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -93,7 +85,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${MNTX_GATEWAY_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${MNTX_GATEWAY_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${MNTX_GATEWAY_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/mntx/deploy.sh

@@ -32,24 +32,14 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-MNTX_GATEWAY_ENV_NAME="${MNTX_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${MNTX_GATEWAY_ENV_NAME}/.env.runtime"
+MNTX_GATEWAY_ENV_NAME="${MNTX_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${MNTX_GATEWAY_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[mntx-gateway-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
 if [ ! -f ./.env.version ]; then
   echo "[mntx-gateway-deploy] .env.version is missing; run version step first" >&2
   exit 1
 fi
 
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
-
 MNTX_GATEWAY_MONGO_SECRET_PATH="${MNTX_GATEWAY_MONGO_SECRET_PATH:?missing MNTX_GATEWAY_MONGO_SECRET_PATH}"
 MNTX_GATEWAY_MONETIX_SECRET_PATH="${MNTX_GATEWAY_MONETIX_SECRET_PATH:-sendico/gateway/monetix}"
 MNTX_GATEWAY_NATS_SECRET_PATH="${MNTX_GATEWAY_NATS_SECRET_PATH:-sendico/nats}"

ci/scripts/notification/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-NOTIFICATION_ENV_NAME="${NOTIFICATION_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${NOTIFICATION_ENV_NAME}/.env.runtime"
+NOTIFICATION_ENV_NAME="${NOTIFICATION_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${NOTIFICATION_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[notification-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${NOTIFICATION_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${NOTIFICATION_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${NOTIFICATION_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/notification/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-NOTIFICATION_ENV_NAME="${NOTIFICATION_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${NOTIFICATION_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[notification-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+NOTIFICATION_ENV_NAME="${NOTIFICATION_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${NOTIFICATION_ENV_NAME}"
 
 NOTIFICATION_MONGO_SECRET_PATH="${NOTIFICATION_MONGO_SECRET_PATH:?missing NOTIFICATION_MONGO_SECRET_PATH}"
 NOTIFICATION_MAIL_SECRET_PATH="${NOTIFICATION_MAIL_SECRET_PATH:?missing NOTIFICATION_MAIL_SECRET_PATH}"

ci/scripts/payments_methods/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-PAYMENTS_METHODS_ENV_NAME="${PAYMENTS_METHODS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${PAYMENTS_METHODS_ENV_NAME}/.env.runtime"
+PAYMENTS_METHODS_ENV_NAME="${PAYMENTS_METHODS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${PAYMENTS_METHODS_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[payments-methods-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${PAYMENTS_METHODS_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${PAYMENTS_METHODS_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${PAYMENTS_METHODS_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/payments_methods/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-PAYMENTS_METHODS_ENV_NAME="${PAYMENTS_METHODS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${PAYMENTS_METHODS_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[payments-methods-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+PAYMENTS_METHODS_ENV_NAME="${PAYMENTS_METHODS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${PAYMENTS_METHODS_ENV_NAME}"
 
 PAYMENTS_METHODS_MONGO_SECRET_PATH="${PAYMENTS_METHODS_MONGO_SECRET_PATH:?missing PAYMENTS_METHODS_MONGO_SECRET_PATH}"
 

ci/scripts/payments_orchestrator/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-PAYMENTS_ENV_NAME="${PAYMENTS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${PAYMENTS_ENV_NAME}/.env.runtime"
+PAYMENTS_ENV_NAME="${PAYMENTS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${PAYMENTS_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[payments-orchestrator-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${PAYMENTS_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${PAYMENTS_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${PAYMENTS_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/payments_orchestrator/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-PAYMENTS_ENV_NAME="${PAYMENTS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${PAYMENTS_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[payments-orchestrator-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+PAYMENTS_ENV_NAME="${PAYMENTS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${PAYMENTS_ENV_NAME}"
 
 PAYMENTS_MONGO_SECRET_PATH="${PAYMENTS_MONGO_SECRET_PATH:?missing PAYMENTS_MONGO_SECRET_PATH}"
 

ci/scripts/payments_quotation/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-PAYMENTS_QUOTATION_ENV_NAME="${PAYMENTS_QUOTATION_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${PAYMENTS_QUOTATION_ENV_NAME}/.env.runtime"
+PAYMENTS_QUOTATION_ENV_NAME="${PAYMENTS_QUOTATION_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${PAYMENTS_QUOTATION_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[payments-quotation-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${PAYMENTS_QUOTATION_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${PAYMENTS_QUOTATION_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${PAYMENTS_QUOTATION_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/payments_quotation/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-PAYMENTS_QUOTATION_ENV_NAME="${PAYMENTS_QUOTATION_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${PAYMENTS_QUOTATION_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[payments-quotation-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+PAYMENTS_QUOTATION_ENV_NAME="${PAYMENTS_QUOTATION_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${PAYMENTS_QUOTATION_ENV_NAME}"
 
 PAYMENTS_QUOTATION_MONGO_SECRET_PATH="${PAYMENTS_QUOTATION_MONGO_SECRET_PATH:?missing PAYMENTS_QUOTATION_MONGO_SECRET_PATH}"
 

ci/scripts/tgsettle/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-TGSETTLE_GATEWAY_ENV_NAME="${TGSETTLE_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${TGSETTLE_GATEWAY_ENV_NAME}/.env.runtime"
+TGSETTLE_GATEWAY_ENV_NAME="${TGSETTLE_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${TGSETTLE_GATEWAY_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[tgsettle-gateway-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -93,7 +85,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${TGSETTLE_GATEWAY_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${TGSETTLE_GATEWAY_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${TGSETTLE_GATEWAY_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/tgsettle/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-TGSETTLE_GATEWAY_ENV_NAME="${TGSETTLE_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${TGSETTLE_GATEWAY_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[tgsettle-gateway-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+TGSETTLE_GATEWAY_ENV_NAME="${TGSETTLE_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${TGSETTLE_GATEWAY_ENV_NAME}"
 
 TGSETTLE_GATEWAY_MONGO_SECRET_PATH="${TGSETTLE_GATEWAY_MONGO_SECRET_PATH:?missing TGSETTLE_GATEWAY_MONGO_SECRET_PATH}"
 

ci/scripts/tron_gateway/build-image.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-TRON_GATEWAY_ENV_NAME="${TRON_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${TRON_GATEWAY_ENV_NAME}/.env.runtime"
+TRON_GATEWAY_ENV_NAME="${TRON_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${TRON_GATEWAY_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[tron-gateway-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -93,7 +85,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${TRON_GATEWAY_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${TRON_GATEWAY_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${TRON_GATEWAY_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \

ci/scripts/tron_gateway/deploy.sh

@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-TRON_GATEWAY_ENV_NAME="${TRON_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${TRON_GATEWAY_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[tron-gateway-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+TRON_GATEWAY_ENV_NAME="${TRON_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${TRON_GATEWAY_ENV_NAME}"
 
 TRON_GATEWAY_MONGO_SECRET_PATH="${TRON_GATEWAY_MONGO_SECRET_PATH:?missing TRON_GATEWAY_MONGO_SECRET_PATH}"
 TRON_GATEWAY_RPC_SECRET_PATH="${TRON_GATEWAY_RPC_SECRET_PATH:?missing TRON_GATEWAY_RPC_SECRET_PATH}"

frontend/pweb/entrypoint.sh

@@ -1,25 +1,26 @@
 #!/bin/sh
+set -eu
 
-replace_env_var() {
-  local var_name=$1
-  local placeholder="%%$var_name%%"
-  local value=$(eval echo \$$var_name)
-  # inject value to the index.html
-  sed -i "s|$placeholder|$value|g" /usr/share/pweb/index.html
+js_escape() {
+  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
 }
 
-echo "Starting Container"
+write_app_config() {
+  cat <<EOF >/usr/share/pweb/app-config.js
+window.appConfig = {
+  apiProto: "$(js_escape "${API_PROTOCOL:-https}")",
+  apiHost: "$(js_escape "${SERVICE_HOST:-app.sendico.io}")",
+  apiEndpoint: "$(js_escape "${API_ENDPOINT:-/api/v1}")",
+  amplitudeSecret: "$(js_escape "${AMPLITUDE_SECRET:-}")",
+  defaultLocale: "$(js_escape "${DEFAULT_LOCALE:-en}")",
+  defaultCurrency: "$(js_escape "${DEFAULT_CURRENCY:-EUR}")",
+  wsProto: "$(js_escape "${WS_PROTOCOL:-wss}")",
+  wsEndpoint: "$(js_escape "${WS_ENDPOINT:-/ws}")"
+};
+EOF
+}
 
-replace_env_var "WS_PROTOCOL"
-replace_env_var "WS_ENDPOINT"
-replace_env_var "API_PROTOCOL"
-replace_env_var "SERVICE_HOST"
-replace_env_var "API_ENDPOINT"
-replace_env_var "AMPLITUDE_SECRET"
-replace_env_var "DEFAULT_LOCALE"
-replace_env_var "DEFAULT_CURRENCY"
+echo "Starting container"
+write_app_config
 
-echo "Passing by launch command"
-# Execute the passed command (e.g., starting Caddy)
-# exec "$@"
 exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile

frontend/pweb/web/index.html

@@ -33,6 +33,7 @@
   <link rel="manifest" href="manifest.json">
 </head>
 <body>
+  <script src="app-config.js"></script>
   <script src="flutter_bootstrap.js" async></script>
 </body>
 </html>