feat(platform): wire OTP SMS env from platform Secret via Helm

Enable backend.sms in the chart so MizbanSMS credentials from the platform
Secret are injected into the backend deployment for production OTP delivery.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/templates/backend-deployment.yaml

@@ -105,6 +105,26 @@ spec:
                   key: elastic-password
             - name: FRONTEND_URL
               value: {{ include "cloudhost-platform.corsOrigins" . | quote }}
+            {{- if .Values.backend.sms.enabled }}
+            - name: SMS_PROVIDER
+              value: {{ .Values.backend.sms.provider | default "mizbansms" | quote }}
+            - name: MIZBANSMS_FROM
+              value: {{ .Values.backend.sms.from | default "5000467254" | quote }}
+            - name: MIZBANSMS_API
+              value: {{ .Values.backend.sms.api | default "2016" | quote }}
+            - name: MIZBANSMS_USERTYPE
+              value: {{ .Values.backend.sms.userType | default "2" | quote }}
+            - name: MIZBANSMS_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: mizbansms-username
+            - name: MIZBANSMS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: mizbansms-password
+            {{- end }}
             {{- include "cloudhost-platform.buildEnv" . | nindent 12 }}
             {{- range $key, $val := .Values.backend.env }}
             - name: {{ $key }}

backend/helm/cloudhost-platform/values.yaml

@@ -89,6 +89,13 @@ backend:
       cpu: "2"
       memory: 2Gi
   extraEnv: {}
+  # OTP SMS — credentials live in the platform Secret (mizbansms-username/password).
+  sms:
+    enabled: false
+    provider: mizbansms
+    from: "5000467254"
+    api: "2016"
+    userType: "2"
   env:
     NODE_ENV: production
     PORT: "4000"

gitops/platform/values-abrban.example.yaml

@@ -112,6 +112,13 @@ backend:
     KIBANA_SYSTEM_PASSWORD: "CHANGE_VIA_SEALEDSECRET_OR_KUBECTL"
     # Swagger disabled in production unless explicitly enabled
     # SWAGGER_ENABLED: "true"
+  # OTP SMS — username/password in abrban-platform-secrets (SealedSecret).
+  sms:
+    enabled: true
+    provider: mizbansms
+    from: "5000467254"
+    api: "2016"
+    userType: "2"
 
 frontend:
   enabled: true

gitops/sealed-secrets/abrban-platform-secrets.example.yaml

@@ -4,7 +4,8 @@
 #
 # Required keys (must match backend Deployment + validate-production-config):
 #   postgres-password, jwt-secret, jwt-refresh-secret, cluster-kubeconfig-key,
-#   redis-password, elastic-password (must match elasticsearch-credentials in logging)
+#   redis-password, elastic-password (must match elasticsearch-credentials in logging),
+#   mizbansms-username, mizbansms-password (OTP SMS — required when backend.sms.enabled)
 #
 # Generate (replace CHANGE_ME_* with strong random values):
 #
@@ -15,6 +16,8 @@
 #     --from-literal=cluster-kubeconfig-key='0123456789abcdef0123456789abcdef' \
 #     --from-literal=redis-password='CHANGE_ME_REDIS' \
 #     --from-literal=elastic-password='CHANGE_ME_ELASTIC' \
+#     --from-literal=mizbansms-username='CHANGE_ME_SMS_USER' \
+#     --from-literal=mizbansms-password='CHANGE_ME_SMS_PASS' \
 #     --dry-run=client -o json \
 #   | kubeseal \
 #       --controller-name=sealed-secrets-controller \