From 3d773a4a6270ea4b02e21df3a30cc944febd85fd Mon Sep 17 00:00:00 2001 From: keyhan Date: Sun, 5 Jul 2026 20:05:08 +0330 Subject: [PATCH] feat(platform): wire OTP SMS env from platform Secret via Helm Enable backend.sms in the chart so MizbanSMS credentials from the platform Secret are injected into the backend deployment for production OTP delivery. Co-authored-by: Cursor --- .../templates/backend-deployment.yaml | 20 +++++++++++++++++++ backend/helm/cloudhost-platform/values.yaml | 7 +++++++ gitops/platform/values-abrban.example.yaml | 7 +++++++ .../abrban-platform-secrets.example.yaml | 5 ++++- 4 files changed, 38 insertions(+), 1 deletion(-) diff --git a/backend/helm/cloudhost-platform/templates/backend-deployment.yaml b/backend/helm/cloudhost-platform/templates/backend-deployment.yaml index ceec103..967333b 100644 --- a/backend/helm/cloudhost-platform/templates/backend-deployment.yaml +++ b/backend/helm/cloudhost-platform/templates/backend-deployment.yaml @@ -105,6 +105,26 @@ spec: key: elastic-password - name: FRONTEND_URL value: {{ include "cloudhost-platform.corsOrigins" . | quote }} + {{- if .Values.backend.sms.enabled }} + - name: SMS_PROVIDER + value: {{ .Values.backend.sms.provider | default "mizbansms" | quote }} + - name: MIZBANSMS_FROM + value: {{ .Values.backend.sms.from | default "5000467254" | quote }} + - name: MIZBANSMS_API + value: {{ .Values.backend.sms.api | default "2016" | quote }} + - name: MIZBANSMS_USERTYPE + value: {{ .Values.backend.sms.userType | default "2" | quote }} + - name: MIZBANSMS_USERNAME + valueFrom: + secretKeyRef: + name: {{ include "cloudhost-platform.secretName" . }} + key: mizbansms-username + - name: MIZBANSMS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "cloudhost-platform.secretName" . }} + key: mizbansms-password + {{- end }} {{- include "cloudhost-platform.buildEnv" . | nindent 12 }} {{- range $key, $val := .Values.backend.env }} - name: {{ $key }} diff --git a/backend/helm/cloudhost-platform/values.yaml b/backend/helm/cloudhost-platform/values.yaml index 3ad869b..f96a78e 100644 --- a/backend/helm/cloudhost-platform/values.yaml +++ b/backend/helm/cloudhost-platform/values.yaml @@ -89,6 +89,13 @@ backend: cpu: "2" memory: 2Gi extraEnv: {} + # OTP SMS — credentials live in the platform Secret (mizbansms-username/password). + sms: + enabled: false + provider: mizbansms + from: "5000467254" + api: "2016" + userType: "2" env: NODE_ENV: production PORT: "4000" diff --git a/gitops/platform/values-abrban.example.yaml b/gitops/platform/values-abrban.example.yaml index ed53318..2d4bd5c 100644 --- a/gitops/platform/values-abrban.example.yaml +++ b/gitops/platform/values-abrban.example.yaml @@ -112,6 +112,13 @@ backend: KIBANA_SYSTEM_PASSWORD: "CHANGE_VIA_SEALEDSECRET_OR_KUBECTL" # Swagger disabled in production unless explicitly enabled # SWAGGER_ENABLED: "true" + # OTP SMS — username/password in abrban-platform-secrets (SealedSecret). + sms: + enabled: true + provider: mizbansms + from: "5000467254" + api: "2016" + userType: "2" frontend: enabled: true diff --git a/gitops/sealed-secrets/abrban-platform-secrets.example.yaml b/gitops/sealed-secrets/abrban-platform-secrets.example.yaml index 0c1c69a..0c95665 100644 --- a/gitops/sealed-secrets/abrban-platform-secrets.example.yaml +++ b/gitops/sealed-secrets/abrban-platform-secrets.example.yaml @@ -4,7 +4,8 @@ # # Required keys (must match backend Deployment + validate-production-config): # postgres-password, jwt-secret, jwt-refresh-secret, cluster-kubeconfig-key, -# redis-password, elastic-password (must match elasticsearch-credentials in logging) +# redis-password, elastic-password (must match elasticsearch-credentials in logging), +# mizbansms-username, mizbansms-password (OTP SMS — required when backend.sms.enabled) # # Generate (replace CHANGE_ME_* with strong random values): # @@ -15,6 +16,8 @@ # --from-literal=cluster-kubeconfig-key='0123456789abcdef0123456789abcdef' \ # --from-literal=redis-password='CHANGE_ME_REDIS' \ # --from-literal=elastic-password='CHANGE_ME_ELASTIC' \ +# --from-literal=mizbansms-username='CHANGE_ME_SMS_USER' \ +# --from-literal=mizbansms-password='CHANGE_ME_SMS_PASS' \ # --dry-run=client -o json \ # | kubeseal \ # --controller-name=sealed-secrets-controller \