chore: workspace-bootstrap перенесён в Answer.and.other.shit

guides/init.new.comps — см. scripts/workspace-bootstrap/README.md
2026-06-14 19:43:05 +10:00
parent 834595df6b
commit 027d64f245
18 changed files with 15 additions and 783 deletions
@@ -2,6 +2,5 @@
 *.pem
 *.key

-# Workspace bootstrap — локальные секреты (только на машине)
-scripts/workspace-bootstrap/config/workspace.local.env
+# Workspace bootstrap — локальные секреты
 **/workspace.local.env
@@ -28,12 +28,12 @@ cd reverse-proxy
 На Windows:

 ```powershell
-cd scripts\workspace-bootstrap
+cd Answer.and.other.shit\guides\init.new.comps
 .\init-machine.ps1
 .\scripts\Set-GitRemotes.ps1 -Repo reverse-proxy
 ```

-Полная настройка новой машины: [scripts/workspace-bootstrap/README.md](../scripts/workspace-bootstrap/README.md).
+Полная настройка новой машины: [Answer.and.other.shit/guides/init.new.comps](https://git.kalinamall.ru/PapaTramp/Answer.and.other.shit/src/branch/main/guides/init.new.comps).

 ## Обновление локальной копии

@@ -37,16 +37,16 @@

 ## Настройка remotes (один раз на машине)

-Только **SSH**, три имени — скрипт **`scripts/workspace-bootstrap`** (Mac/Linux: `Set-GitRemotes.sh`, Windows: `Set-GitRemotes.ps1`):
+Только **SSH**, три имени — **`Answer.and.other.shit/guides/init.new.comps`**:

 ```bash
-cd ~/Documents/Cursor/Projects/reverse-proxy/scripts/workspace-bootstrap
+git clone ssh://git@git.kalinamall.ru:2222/PapaTramp/Answer.and.other.shit.git
+cd Answer.and.other.shit/guides/init.new.comps
 cp config/workspace.local.env.example config/workspace.local.env
-# заполнить workspace.local.env
 ./init-machine.sh
 ```

-Или для одного репо:
+Один репозиторий:

 ```bash
 ./scripts/Set-GitRemotes.sh reverse-proxy
@@ -55,13 +55,11 @@ cp config/workspace.local.env.example config/workspace.local.env
 Windows:

 ```powershell
-cd C:\Users\papat\Projects\reverse-proxy\scripts\workspace-bootstrap
+cd Answer.and.other.shit\guides\init.new.comps
 .\init-machine.ps1
-..\scripts\Set-GitRemotes.ps1 -Repo reverse-proxy
+.\scripts\Set-GitRemotes.ps1 -Repo reverse-proxy
 ```

-Старый вариант (Answer.and.other.shit) — переносится в `scripts/workspace-bootstrap`.
-
 Или вручную:

 ```bash
@@ -1,67 +1,14 @@
-# Workspace bootstrap
+# Перенесено

-Единая настройка **Mac / Windows** для Git (SSH), Cursor и политики push.
+Скрипты настройки новых компьютеров живут в репозитории **Answer.and.other.shit**:

-Целевое место в Gitea: репозиторий **Answer.and.other.shit** (можно скопировать эту папку в `scripts/workspace-bootstrap/`).
-
-## Быстрый старт (новая машина)
+**`guides/init.new.comps/`**

 ```bash
-# 1. Клонировать bootstrap (или весь Answer.and.other.shit)
-cd scripts/workspace-bootstrap
-
-# 2. Секреты и адреса — один файл (не в git!)
+git clone ssh://git@git.kalinamall.ru:2222/PapaTramp/Answer.and.other.shit.git
+cd Answer.and.other.shit/guides/init.new.comps
 cp config/workspace.local.env.example config/workspace.local.env
-# отредактировать workspace.local.env
-
-# 3. Машина: SSH, git, клоны, remotes
-./init-machine.sh
-
-# 4. Cursor: правила в проекты
-./init-cursor.sh
-
-# 5. Добавить ~/.ssh/id_ed25519_kalinamall.pub в Gitea (kalinamall + home) и GitHub
-./init-machine.sh --verify
-```
-
-Windows (PowerShell):
-
-```powershell
-cd scripts\workspace-bootstrap
-copy config\workspace.local.env.example config\workspace.local.env
-# отредактировать
-.\init-machine.ps1
-.\init-cursor.sh   # через Git Bash, или: bash init-cursor.sh
-.\init-machine.ps1 -Verify
-```
-
-## Файлы
-
-| Файл | В git | Назначение |
-|------|-------|------------|
-| `config/workspace.local.env.example` | да | шаблон |
-| `config/workspace.local.env` | **нет** | логины, IP, пароли, пути |
-| `config/repos.yaml` | да | список репозиториев |
-| `config/ssh-config.template` | да | `~/.ssh/config` |
-| `config/hosts.template` | да | строки для `/etc/hosts` или `C:\Windows\System32\drivers\etc\hosts` |
-
-## Push
-
-```bash
-cd ~/Documents/Cursor/Projects/reverse-proxy
-../../reverse-proxy/scripts/workspace-bootstrap/push-safe.sh
-# или из bootstrap: ./push-safe.sh /path/to/repo
-```
-
- **kalinamall** — всегда (с секретами)
- **home** — если `PUSH_HOME=yes` в env
- **github** — только после `check-no-secrets.sh`
-
-## Переменная окружения
-
-```bash
-export WORKSPACE_ENV=/path/to/workspace.local.env
 ./init-machine.sh
 ```

-По умолчанию: `config/workspace.local.env` рядом со скриптами.
+См. [docs/git.md](../../docs/git.md) и [docs/repo-policy.md](../../docs/repo-policy.md).
@@ -1,3 +0,0 @@
-# Строки для hosts (подставляются IP из workspace.local.env)
-__GITEA_KALINAMALL_IP__ __GITEA_KALINAMALL_HOST__ __GITEA_KALINAMALL_HOST_PUBLIC__
-__GITEA_KALINAMALL_IP__ sac.kalinamall.ru sac-api.kalinamall.ru
@@ -1,22 +0,0 @@
-# Список репозиториев PapaTramp / PTah
-# github: false — не добавлять remote github, не пушить на GitHub
-
-repos:
-  - name: reverse-proxy
-    github: true
-
-  - name: security-alert-center
-    github: true
-
-  - name: seaca
-    github: false
-
-  - name: rdp-login-monitor
-    github: true
-    github_name: RDP-login-monitor
-
-  - name: ssh-monitor
-    github: true
-
-  - name: Answer.and.other.shit
-    github: false
@@ -1,28 +0,0 @@
-# Сгенерировано init-machine.sh — ручные правки могут быть перезаписаны
-# Блок BEGIN WORKSPACE-BOOTSTRAP … END
-
-Host github.com
-    User git
-    IdentityFile __SSH_KEY_PATH__
-    IdentitiesOnly yes
-
-Host __GITEA_KALINAMALL_HOST__ __GITEA_KALINAMALL_HOST_PUBLIC__
-    User git
-    HostName __GITEA_KALINAMALL_HOST__
-    Port __GITEA_KALINAMALL_SSH_PORT__
-    IdentityFile __SSH_KEY_PATH__
-    IdentitiesOnly yes
-
-Host __GITEA_HOME_HOST__ __GITEA_HOME_HOST_PUBLIC__
-    User git
-    HostName __GITEA_HOME_HOST__
-    Port __GITEA_HOME_SSH_PORT__
-    IdentityFile __SSH_KEY_PATH__
-    IdentitiesOnly yes
-
-Host haproxy haproxy.kalinamall.ru __SSH_HAPROXY_IP__
-    User __SSH_HAPROXY_USER__
-    IdentityFile __SSH_KEY_PATH__
-    IdentitiesOnly yes
-
-# END WORKSPACE-BOOTSTRAP
@@ -1,57 +0,0 @@
-# Копия: config/workspace.local.env (не коммитить!)
-# Все адреса, логины и пароли для init-скриптов — только в workspace.local.env
-
-# --- Профиль машины: home-mac | home-win | work-win ---
-MACHINE_PROFILE="home-mac"
-
-# --- Git (identity) ---
-GIT_USER_NAME="Your Name"
-GIT_USER_EMAIL="you@example.com"
-
-# --- SSH-ключ для Git (создаётся init-machine, если файла нет) ---
-SSH_KEY_BASENAME="id_ed25519_kalinamall"
-SSH_KEY_COMMENT="papatramp"
-
-# --- Корпоративный Gitea (remote: kalinamall) ---
-GITEA_KALINAMALL_HOST="git.kalinamall.lan"
-GITEA_KALINAMALL_HOST_PUBLIC="git.kalinamall.ru"
-GITEA_KALINAMALL_IP="192.168.160.129"
-GITEA_KALINAMALL_SSH_PORT="2222"
-GITEA_KALINAMALL_ORG="PapaTramp"
-
-# --- Домашний Gitea (remote: home) ---
-GITEA_HOME_HOST="git.papatramp.lan"
-GITEA_HOME_HOST_PUBLIC="git.papatramp.ru"
-GITEA_HOME_SSH_PORT="2222"
-GITEA_HOME_ORG="PapaTramp"
-
-# --- GitHub (remote: github) ---
-GITHUB_USER="PTah"
-
-# --- Каталог проектов ---
-PROJECTS_DIR_MAC="${HOME}/Documents/Cursor/Projects"
-PROJECTS_DIR_WIN="C:/Users/papat/Projects"
-
-# --- Push ---
-PUSH_HOME="yes"
-PUSH_GITHUB="yes"
-
-# --- /etc/hosts (опционально: yes — init добавит строки из hosts.template) ---
-UPDATE_HOSTS="yes"
-
-# --- SSH на серверы (для справки / будущих скриптов; не для git remote) ---
-SSH_HAPROXY_IP="192.168.160.117"
-SSH_HAPROXY_USER="papatramp"
-SSH_HAPROXY_PASSWORD=""
-
-SSH_GIT_SERVER_IP="192.168.160.129"
-SSH_GIT_SERVER_USER="papatramp"
-SSH_GIT_SERVER_PASSWORD=""
-
-SSH_SAC_SERVER_IP="192.168.160.145"
-SSH_SAC_SERVER_USER="papatramp"
-SSH_SAC_SERVER_PASSWORD=""
-
-# --- Админ / VPN (справочно) ---
-ADMIN_PUBLIC_IP="5.100.81.121"
-VPN_CIDR="192.168.128.0/17"
@@ -1,18 +0,0 @@
---
-description: Политика remotes и push — kalinamall/home/github
-alwaysApply: true
---
-
-# Git remotes (kalinamall.ru)
-
- **kalinamall** — основной Gitea, полный код и секреты. `git push kalinamall main`.
- **home** — домашний Gitea, полная копия.
- **github** — только резерв **без секретов**. Перед push: `check-no-secrets.sh`.
- Remotes только **SSH** (`ssh://`, `git@`). HTTPS и `origin` не использовать.
- Не коммитить в GitHub: `.env`, ключи, пароли, токены, `google-services.json`, prod credentials.
- См. `docs/repo-policy.md` в reverse-proxy.
-
-# Cursor
-
- Отвечать на русском, если пользователь пишет по-русски.
- Коммиты только по явной просьбе пользователя.
@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-# Git pre-push: проверка секретов только для remote github
-set -Eeuo pipefail
-
-remote="${1:-}"
-url="${2:-}"
-
-[[ $remote == github ]] || exit 0
-
-# Найти bootstrap от корня репо
-repo_root=$(git rev-parse --show-toplevel)
-checker=""
-
-for candidate in \
-    "$repo_root/scripts/workspace-bootstrap/scripts/check-no-secrets.sh" \
-    "$repo_root/../reverse-proxy/scripts/workspace-bootstrap/scripts/check-no-secrets.sh" \
-    "$HOME/Documents/Cursor/Projects/reverse-proxy/scripts/workspace-bootstrap/scripts/check-no-secrets.sh"; do
-    if [[ -f $candidate ]]; then
-        checker=$candidate
-        break
-    fi
-done
-
-if [[ -z $checker ]]; then
-    echo "pre-push: check-no-secrets.sh не найден — пропуск проверки"
-    exit 0
-fi
-
-exec bash "$checker" github
@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=lib/common.sh
-source "$ROOT/lib/common.sh"
-
-load_workspace_env
-
-PROJ=$(projects_dir)
-RULES_SRC="$ROOT/cursor/rules"
-
-[[ -d $RULES_SRC ]] || die "нет $RULES_SRC"
-
-while read -r repo _gh; do
-    [[ -z $repo ]] && continue
-    dest="$PROJ/$repo/.cursor/rules"
-    if [[ -d $PROJ/$repo ]]; then
-        mkdir -p "$dest"
-        cp -f "$RULES_SRC"/*.mdc "$dest/" 2>/dev/null || true
-        log "cursor rules → $dest"
-    fi
-done < <(each_repo)
-
-# User rules (опционально — копия в ~/.cursor/rules если каталог есть)
-USER_RULES="$HOME/.cursor/rules"
-if [[ -d $(dirname "$USER_RULES") ]]; then
-    mkdir -p "$USER_RULES"
-    cp -f "$RULES_SRC"/*.mdc "$USER_RULES/" 2>/dev/null || true
-    log "cursor user rules → $USER_RULES"
-fi
-
-log "init-cursor готово"
@@ -1,42 +0,0 @@
-#Requires -Version 5.1
-<#
-.SYNOPSIS
-  Инициализация машины: SSH, git, клоны (Windows).
-.DESCRIPTION
-  Вызывает init-machine.sh через Git Bash, если доступен.
-#>
-param(
-    [switch]$Verify
-)
-
-$ErrorActionPreference = 'Stop'
-$BootstrapRoot = Split-Path -Parent $MyInvocation.MyCommand.Path
-$ShScript = Join-Path $BootstrapRoot 'init-machine.sh'
-
-$envExample = Join-Path $BootstrapRoot 'config\workspace.local.env.example'
-$envLocal = Join-Path $BootstrapRoot 'config\workspace.local.env'
-if (-not (Test-Path $envLocal)) {
-    Write-Host "Создайте config\workspace.local.env из workspace.local.env.example" -ForegroundColor Yellow
-    if (Test-Path $envExample) {
-        Copy-Item $envExample $envLocal
-        Write-Host "Скопирован шаблон → workspace.local.env — заполните и запустите снова."
-    }
-    exit 1
-}
-
-$gitBash = @(
-    "${env:ProgramFiles}\Git\bin\bash.exe",
-    "${env:ProgramFiles(x86)}\Git\bin\bash.exe"
-) | Where-Object { Test-Path $_ } | Select-Object -First 1
-
-$args = @()
-if ($Verify) { $args += '--verify' }
-
-if ($gitBash) {
-    & $gitBash $ShScript @args
-    exit $LASTEXITCODE
-}
-
-Write-Host "Git Bash не найден. Установите Git for Windows или выполните вручную:" -ForegroundColor Red
-Write-Host "  bash init-machine.sh $($args -join ' ')"
-exit 1
@@ -1,116 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=lib/common.sh
-source "$ROOT/lib/common.sh"
-
-VERIFY=0
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        --verify) VERIFY=1; shift ;;
-        -h | --help)
-            echo "Usage: init-machine.sh [--verify]"
-            exit 0
-            ;;
-        *) die "unknown option: $1" ;;
-    esac
-done
-
-load_workspace_env
-
-log "профиль: ${MACHINE_PROFILE:-?}, OS: $(detect_os)"
-
-# --- SSH key ---
-KEY_PATH=$(ssh_key_path)
-mkdir -p "$(ssh_home)"
-if [[ ! -f $KEY_PATH ]]; then
-    log "создаю ключ $KEY_PATH"
-    ssh-keygen -t ed25519 -C "${SSH_KEY_COMMENT:-papatramp}@$(hostname -s 2>/dev/null || hostname)" -f "$KEY_PATH" -N ""
-    log "добавьте публичный ключ в Gitea (kalinamall + home) и GitHub:"
-    echo "----------"
-    cat "${KEY_PATH}.pub"
-    echo "----------"
-else
-    log "ключ уже есть: $KEY_PATH"
-fi
-
-# --- ssh config ---
-TMP_BLOCK=$(mktemp)
-render_template "$ROOT/config/ssh-config.template" "$TMP_BLOCK"
-merge_ssh_config "$TMP_BLOCK"
-rm -f "$TMP_BLOCK"
-log "обновлён $(ssh_home)/config"
-
-# --- known_hosts ---
-for target in "${GITEA_KALINAMALL_HOST}:${GITEA_KALINAMALL_SSH_PORT}" \
-    "${GITEA_HOME_HOST}:${GITEA_HOME_SSH_PORT}" "github.com"; do
-    host=${target%%:*}
-    port=${target##*:}
-    if [[ $host == $port ]]; then port=22; fi
-    log "ssh-keyscan $host:$port"
-    ssh-keyscan -p "$port" "$host" 2>/dev/null >>"$(ssh_home)/known_hosts" || true
-done
-
-# --- git global: только SSH, без credential prompts ---
-if [[ -n ${GIT_USER_NAME:-} ]]; then
-    git config --global user.name "$GIT_USER_NAME"
-fi
-if [[ -n ${GIT_USER_EMAIL:-} ]]; then
-    git config --global user.email "$GIT_USER_EMAIL"
-fi
-git config --global credential.helper ""
-git config --global url."git@github.com:".insteadOf "https://github.com/"
-git config --global url."ssh://git@${GITEA_KALINAMALL_HOST}:${GITEA_KALINAMALL_SSH_PORT}/".insteadOf "https://${GITEA_KALINAMALL_HOST_PUBLIC}/"
-git config --global url."ssh://git@${GITEA_HOME_HOST}:${GITEA_HOME_SSH_PORT}/".insteadOf "https://${GITEA_HOME_HOST_PUBLIC}/"
-log "git global: SSH-only, credential.helper отключён"
-
-# --- hosts (optional) ---
-if [[ ${UPDATE_HOSTS:-no} == yes ]]; then
-    HOSTS_TMP=$(mktemp)
-    sed \
-        -e "s|__GITEA_KALINAMALL_IP__|${GITEA_KALINAMALL_IP}|g" \
-        -e "s|__GITEA_KALINAMALL_HOST__|${GITEA_KALINAMALL_HOST}|g" \
-        -e "s|__GITEA_KALINAMALL_HOST_PUBLIC__|${GITEA_KALINAMALL_HOST_PUBLIC}|g" \
-        "$ROOT/config/hosts.template" >"$HOSTS_TMP"
-    if [[ $(detect_os) == mac ]]; then
-        log "добавление в /etc/hosts (нужен sudo)"
-        while read -r line; do
-            [[ -z $line || $line == \#* ]] && continue
-            grep -qF "$line" /etc/hosts 2>/dev/null || echo "$line" | sudo tee -a /etc/hosts >/dev/null
-        done <"$HOSTS_TMP"
-    elif [[ $(detect_os) == win ]]; then
-        log "Windows: добавьте вручную в C:\\Windows\\System32\\drivers\\etc\\hosts:"
-        cat "$HOSTS_TMP"
-    fi
-    rm -f "$HOSTS_TMP"
-fi
-
-# --- clone + remotes ---
-PROJ=$(projects_dir)
-mkdir -p "$PROJ"
-while read -r repo has_gh; do
-    [[ -z $repo ]] && continue
-    dest="$PROJ/$repo"
-    if [[ ! -d $dest/.git ]]; then
-        log "клонирование $repo"
-        git clone "$(kalinamall_remote_url "$repo")" "$dest" || log "клон не удался (сеть/ключ?) — настройте ключ и повторите"
-    fi
-    if [[ -d $dest/.git ]]; then
-        bash "$ROOT/scripts/Set-GitRemotes.sh" --repo-dir "$dest" "$repo" "$has_gh"
-        # pre-push hook для github
-        if [[ $has_gh == 1 && -f $ROOT/hooks/pre-push ]]; then
-            install -m 755 "$ROOT/hooks/pre-push" "$dest/.git/hooks/pre-push"
-        fi
-    fi
-done < <(each_repo)
-
-if [[ $VERIFY == 1 ]]; then
-    log "проверка SSH (BatchMode — без запроса пароля)"
-    ssh -o BatchMode=yes -o ConnectTimeout=8 -p "$GITEA_KALINAMALL_SSH_PORT" -T "git@${GITEA_KALINAMALL_HOST}" 2>&1 | head -3 || true
-    ssh -o BatchMode=yes -o ConnectTimeout=8 -p "$GITEA_HOME_SSH_PORT" -T "git@${GITEA_HOME_HOST}" 2>&1 | head -3 || true
-    ssh -o BatchMode=yes -o ConnectTimeout=8 -T git@github.com 2>&1 | head -3 || true
-    log "если выше «Permission denied» — добавьте .pub в Gitea/GitHub и повторите --verify"
-fi
-
-log "готово"
@@ -1,144 +0,0 @@
-#!/usr/bin/env bash
-# Общие функции workspace-bootstrap
-set -Eeuo pipefail
-
-BOOTSTRAP_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-
-die() { echo "workspace-bootstrap: error: $*" >&2; exit 1; }
-log() { echo "[bootstrap] $*"; }
-
-load_workspace_env() {
-    local env_file="${WORKSPACE_ENV:-$BOOTSTRAP_ROOT/config/workspace.local.env}"
-    [[ -f $env_file ]] || die "нет $env_file — скопируйте config/workspace.local.env.example и заполните"
-    # shellcheck source=/dev/null
-    set -a
-    source "$env_file"
-    set +a
-}
-
-detect_os() {
-    case "$(uname -s)" in
-        Darwin) echo mac ;;
-        MINGW* | MSYS* | CYGWIN*) echo win ;;
-        *) echo linux ;;
-    esac
-}
-
-ssh_home() {
-    if [[ $(detect_os) == win ]]; then
-        if [[ -n ${HOME:-} ]]; then printf '%s/.ssh' "$HOME"
-        else printf '%s/.ssh' "$USERPROFILE"
-        fi
-    else
-        printf '%s/.ssh' "$HOME"
-    fi
-}
-
-projects_dir() {
-    local os
-    os=$(detect_os)
-    if [[ $os == mac ]]; then
-        # shellcheck disable=SC2086
-        eval echo "${PROJECTS_DIR_MAC:-$HOME/Documents/Cursor/Projects}"
-    elif [[ $os == win ]]; then
-        echo "${PROJECTS_DIR_WIN:-$HOME/Projects}"
-    else
-        eval echo "${PROJECTS_DIR_MAC:-$HOME/projects}"
-    fi
-}
-
-ssh_key_path() {
-    printf '%s/%s' "$(ssh_home)" "${SSH_KEY_BASENAME:-id_ed25519_kalinamall}"
-}
-
-expand_path() {
-    local p=$1
-    if [[ $p == ~* ]]; then
-        p="${p/#\~/$HOME}"
-    fi
-    printf '%s' "$p"
-}
-
-render_template() {
-    local template=$1 dest=$2
-    local key_path
-    key_path=$(ssh_key_path)
-    [[ -f $key_path ]] || key_path="${key_path}.example"
-    sed \
-        -e "s|__SSH_KEY_PATH__|$key_path|g" \
-        -e "s|__GITEA_KALINAMALL_HOST__|${GITEA_KALINAMALL_HOST}|g" \
-        -e "s|__GITEA_KALINAMALL_HOST_PUBLIC__|${GITEA_KALINAMALL_HOST_PUBLIC}|g" \
-        -e "s|__GITEA_KALINAMALL_SSH_PORT__|${GITEA_KALINAMALL_SSH_PORT}|g" \
-        -e "s|__GITEA_HOME_HOST__|${GITEA_HOME_HOST}|g" \
-        -e "s|__GITEA_HOME_HOST_PUBLIC__|${GITEA_HOME_HOST_PUBLIC}|g" \
-        -e "s|__GITEA_HOME_SSH_PORT__|${GITEA_HOME_SSH_PORT}|g" \
-        -e "s|__SSH_HAPROXY_IP__|${SSH_HAPROXY_IP}|g" \
-        -e "s|__SSH_HAPROXY_USER__|${SSH_HAPROXY_USER}|g" \
-        "$template" >"$dest"
-}
-
-merge_ssh_config() {
-    local block_file=$1
-    local ssh_config
-    ssh_config="$(ssh_home)/config"
-    mkdir -p "$(ssh_home)"
-    touch "$ssh_config"
-    if grep -q 'BEGIN WORKSPACE-BOOTSTRAP' "$ssh_config" 2>/dev/null; then
-        local tmp
-        tmp=$(mktemp)
-        awk '/# BEGIN WORKSPACE-BOOTSTRAP/{skip=1} !skip{print} /# END WORKSPACE-BOOTSTRAP/{skip=0}' "$ssh_config" >"$tmp"
-        mv "$tmp" "$ssh_config"
-    fi
-    {
-        echo ""
-        echo "# BEGIN WORKSPACE-BOOTSTRAP"
-        cat "$block_file"
-        echo "# END WORKSPACE-BOOTSTRAP"
-    } >>"$ssh_config"
-    chmod 600 "$ssh_config" 2>/dev/null || true
-}
-
-each_repo() {
-    local repos_file="$BOOTSTRAP_ROOT/config/repos.yaml"
-    [[ -f $repos_file ]] || die "missing $repos_file"
-    awk '
-        /^  - name:/ { if (n != "") print n, gh; n = $3; gh = 0 }
-        /github: true/ { gh = 1 }
-        /github: false/ { gh = 0 }
-        END { if (n != "") print n, gh }
-    ' "$repos_file"
-}
-
-github_repo_name() {
-    local name=$1
-    local repos_file="$BOOTSTRAP_ROOT/config/repos.yaml"
-    local custom
-    custom=$(awk -v repo="$name" '
-        $0 ~ "- name: " repo { found=1; next }
-        found && /github_name:/ { print $2; exit }
-    ' "$repos_file")
-    if [[ -n $custom ]]; then
-        echo "$custom"
-    else
-        echo "$name"
-    fi
-}
-
-kalinamall_remote_url() {
-    local repo=$1
-    printf 'ssh://git@%s:%s/%s/%s.git' \
-        "$GITEA_KALINAMALL_HOST" "$GITEA_KALINAMALL_SSH_PORT" "$GITEA_KALINAMALL_ORG" "$repo"
-}
-
-home_remote_url() {
-    local repo=$1
-    printf 'ssh://git@%s:%s/%s/%s.git' \
-        "$GITEA_HOME_HOST" "$GITEA_HOME_SSH_PORT" "$GITEA_HOME_ORG" "$repo"
-}
-
-github_remote_url() {
-    local repo=$1
-    local gh_name
-    gh_name=$(github_repo_name "$repo")
-    printf 'git@%s:%s/%s.git' 'github.com' "$GITHUB_USER" "$gh_name"
-}
@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=lib/common.sh
-source "$ROOT/lib/common.sh"
-
-REPO_DIR="${1:-.}"
-[[ -d $REPO_DIR ]] || die "каталог не найден: $REPO_DIR"
-cd "$REPO_DIR"
-[[ -d .git ]] || die "не git: $REPO_DIR"
-
-load_workspace_env
-
-BRANCH=$(git rev-parse --abbrev-ref HEAD)
-log "push-safe в $(pwd) ветка $BRANCH"
-
-git push kalinamall "$BRANCH" || die "push kalinamall failed"
-
-if [[ ${PUSH_HOME:-yes} == yes ]]; then
-    git push home "$BRANCH" || log "push home пропущен (сеть?)"
-fi
-
-if [[ ${PUSH_GITHUB:-yes} == yes ]] && git remote | grep -qx github; then
-    bash "$ROOT/scripts/check-no-secrets.sh" || exit 1
-    git push github "$BRANCH" || die "push github failed"
-    log "github OK"
-else
-    log "github remote нет или PUSH_GITHUB=no"
-fi
-
-log "готово"
@@ -1,28 +0,0 @@
-#Requires -Version 5.1
-param(
-    [Parameter(Mandatory = $true)]
-    [string]$Repo,
-
-    [string]$RepoDir = ''
-)
-
-$ErrorActionPreference = 'Stop'
-$ScriptsDir = Split-Path -Parent $MyInvocation.MyCommand.Path
-$BootstrapRoot = Split-Path -Parent $ScriptsDir
-$ShScript = Join-Path $ScriptsDir 'Set-GitRemotes.sh'
-
-$gitBash = @(
-    "${env:ProgramFiles}\Git\bin\bash.exe",
-    "${env:ProgramFiles(x86)}\Git\bin\bash.exe"
-) | Where-Object { Test-Path $_ } | Select-Object -First 1
-
-$bashArgs = @($ShScript, $Repo)
-if ($RepoDir) { $bashArgs = @($ShScript, '--repo-dir', $RepoDir, $Repo) }
-
-if ($gitBash) {
-    & $gitBash @bashArgs
-    exit $LASTEXITCODE
-}
-
-Write-Host "Git Bash не найден."
-exit 1
@@ -1,85 +0,0 @@
-#!/usr/bin/env bash
-# Настроить remotes для одного репозитория (только SSH)
-set -Eeuo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/common.sh
-source "$SCRIPT_DIR/../lib/common.sh"
-
-usage() {
-    cat <<'EOF'
-Usage: Set-GitRemotes.sh [--repo-dir PATH] REPO_NAME [HAS_GITHUB]
-
-  REPO_NAME    каталог проекта (имя в repos.yaml)
-  HAS_GITHUB    1 или 0 (по умолчанию из repos.yaml)
-
-Remotes: kalinamall, home, github (если включён). Без origin и без https.
-EOF
-}
-
-REPO_NAME=""
-REPO_DIR=""
-HAS_GITHUB=""
-
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        --repo-dir) REPO_DIR=$2; shift 2 ;;
-        -h | --help) usage; exit 0 ;;
-        *)
-            if [[ -z $REPO_NAME ]]; then REPO_NAME=$1
-            else HAS_GITHUB=$1
-            fi
-            shift
-            ;;
-    esac
-done
-
-[[ -n $REPO_NAME ]] || { usage; exit 1; }
-
-load_workspace_env
-
-if [[ -z $REPO_DIR ]]; then
-    REPO_DIR="$(projects_dir)/$REPO_NAME"
-fi
-
-[[ -d $REPO_DIR/.git ]] || die "не git-репозиторий: $REPO_DIR"
-
-if [[ -z $HAS_GITHUB ]]; then
-    HAS_GITHUB=$(each_repo | awk -v n="$REPO_NAME" '$1==n{print $2; exit}')
-    [[ -n $HAS_GITHUB ]] || die "репозиторий $REPO_NAME не найден в repos.yaml"
-fi
-
-cd "$REPO_DIR"
-
-set_remote() {
-    local name=$1 url=$2
-    if git remote | grep -qx "$name"; then
-        git remote set-url "$name" "$url"
-    else
-        git remote add "$name" "$url"
-    fi
-}
-
-# Убрать origin/https если были
-if git remote | grep -qx origin; then
-    local_url=$(git remote get-url origin 2>/dev/null || true)
-    if [[ $local_url == https://* ]]; then
-        log "удаляю origin с HTTPS: $local_url"
-        git remote remove origin
-    fi
-fi
-
-set_remote kalinamall "$(kalinamall_remote_url "$REPO_NAME")"
-set_remote home "$(home_remote_url "$REPO_NAME")"
-
-if [[ $HAS_GITHUB == 1 ]]; then
-    set_remote github "$(github_remote_url "$REPO_NAME")"
-elif git remote | grep -qx github; then
-    log "удаляю github remote для $REPO_NAME (github: false)"
-    git remote remove github
-fi
-
-git branch -u kalinamall/main main 2>/dev/null || git branch -u kalinamall/main master 2>/dev/null || true
-
-log "$REPO_NAME remotes:"
-git remote -v
@@ -1,75 +0,0 @@
-#!/usr/bin/env bash
-# Блокирует push на github при подозрении на секреты в коммитах
-set -Eeuo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck source=lib/common.sh
-source "$ROOT/lib/common.sh"
-
-PATTERNS=(
-    '\.env$'
-    'SECRET_KEY'
-    'DATABASE_URL='
-    'password\s*=\s*["\x27][^"\x27]+'
-    'BEGIN (RSA |OPENSSH )?PRIVATE KEY'
-    'api[_-]?key'
-    'telegram.*token'
-    'smtp.*password'
-    'credentials\.json'
-    'google-services\.json'
-    '\.pem$'
-    '\.p12$'
-    '\.jks$'
-)
-
-scan_range() {
-    local range=$1
-    local hits=0
-    local files
-    files=$(git diff --name-only $range 2>/dev/null; git diff --cached --name-only 2>/dev/null)
-    files=$(echo "$files" | sort -u | grep -v '^$' || true)
-    while read -r f; do
-        [[ -z $f ]] && continue
-        [[ -f $f ]] || continue
-        case $f in
-            *.example | *.sample | *env.example | workspace.local.env.example) continue ;;
-        esac
-        for pat in "${PATTERNS[@]}"; do
-            if grep -qiE "$pat" "$f" 2>/dev/null; then
-                echo "  SECRET? $f (pattern: $pat)"
-                hits=$((hits + 1))
-            fi
-        done
-    done <<<"$files"
-    return $hits
-}
-
-main() {
-    local remote="${1:-github}"
-    local branch
-    branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo main)
-
-    if ! git remote | grep -qx "$remote"; then
-        exit 0
-    fi
-
-    local range=""
-    if git rev-parse "$remote/$branch" >/dev/null 2>&1; then
-        range="$remote/$branch..HEAD"
-    else
-        range="HEAD"
-    fi
-
-    echo "[check-no-secrets] сканирование перед push $remote ($range)"
-    local n=0
-    scan_range "$range" || n=$?
-
-    if [[ $n -gt 0 ]]; then
-        echo "[check-no-secrets] найдено подозрительных совпадений: $n"
-        echo "push на $remote отменён. Проверьте diff или используйте только kalinamall."
-        exit 1
-    fi
-    echo "[check-no-secrets] OK"
-}
-
-main github