Harden VPS deployment: non-interactive deploy, systemd EnvironmentFile, safer secrets

[AlexKitipov]

Motivation

• Make VPS deployment non-interactive and suitable for automation and CI/CD.
• Remove hardcoded production secrets from the systemd unit and ensure secrets are created/stored safely.
• Make the deploy process idempotent and safer to run repeatedly on a server (avoid overwrites and interactive prompts).

Description

• Switch gateway-hub.service from Type=notify to Type=simple and stop embedding production secrets; load runtime config from an EnvironmentFile at /etc/gateway-hub/gateway-hub.env instead.
• Replace the old interactive deploy.sh with a non-interactive, idempotent script that is configurable via environment variables (APP_USER, APP_DIR, ENV_FILE, REPO_BRANCH, ENABLE_SSL, DOMAIN, etc.).
• Make the script create or preserve a protected environment file (/etc/gateway-hub/gateway-hub.env) owned by root with group set to the app user and 0640 permissions, and generate a secure SECRET_KEY only on first run (no hardcoded secrets).
• Ensure database role/database creation, safe repository sync (clone or fast-forward), virtualenv management, run Alembic migrations after sourcing the environment file, install a tailored systemd unit (service file is rewritten with configured paths), configure Nginx, and optionally obtain Let's Encrypt certificates non-interactively with certbot.

Testing

• git diff --check ran and reported no whitespace/patch errors (passed).
• bash -n deploy.sh syntax check ran and reported no syntax errors (passed).
• shellcheck deploy.sh could not be run because shellcheck is not installed in the environment (skipped).
• systemd-analyze verify gateway-hub.service was attempted but could not fully verify the unit here because /home/appuser/backend/venv/bin/uvicorn does not exist in the container (verification blocked by missing runtime binary).

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cf6b4441ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".