From b1fa814f077145a0019c33590f60e15d598f0f2d Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Mon, 13 Jul 2026 14:28:20 +0200
Subject: [PATCH] fix(platform-infra): transfer nginx API key as binary secret

---
 scripts/src/platform-infra-nginx.ts | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/scripts/src/platform-infra-nginx.ts b/scripts/src/platform-infra-nginx.ts
index f13c6b25..237d42ea 100644
--- a/scripts/src/platform-infra-nginx.ts
+++ b/scripts/src/platform-infra-nginx.ts
@@ -1,5 +1,14 @@
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, statSync } from "node:fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
 import { isAbsolute, join } from "node:path";
 import type { UniDeskConfig } from "./config";
 import { repoRoot, rootPath } from "./config";
@@ -293,7 +302,7 @@ async function apply(config: UniDeskConfig, options: OpsApplyOptions): Promise<R
   const distributedImage = `${distribution.workDir}/${fileName(nginx.artifacts.image.remotePath)}`;
   const distributedPlugin = `${distribution.workDir}/${fileName(nginx.artifacts.composePlugin.remotePath)}`;
   const uploads = [
-    uploadArtifact(target.route, secret.sourcePath, target.runtime.envPath),
+    uploadSecret(target.route, secret.sourcePath, target.runtime.envPath),
   ];
   const failedUpload = uploads.find((upload) => !upload.ok);
   if (failedUpload !== undefined) {
@@ -675,6 +684,19 @@ function uploadArtifact(route: string, localPath: string, remotePath: string): R
   };
 }
 
+function uploadSecret(route: string, sourcePath: string, remotePath: string): Record<string, unknown> {
+  const directory = mkdtempSync(join(tmpdir(), "unidesk-nginx-secret-"));
+  const transferPath = join(directory, "runtime.bin");
+  try {
+    writeFileSync(transferPath, readFileSync(sourcePath));
+    chmodSync(transferPath, 0o600);
+    const result = uploadArtifact(route, transferPath, remotePath);
+    return { ...result, localPath: "binary-secret-transfer", valuesPrinted: false };
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+}
+
 function targetSummary(id: string, target: NginxTarget): Record<string, unknown> {
   return {
     id,