deploy: support runtime env files

deploy/systemd/README.md

@@ -12,6 +12,7 @@ python3 deploy/systemd/install_systemd.py \
   --user mt2.jakubkadlec.dev \
   --group mt2.jakubkadlec.dev \
   --runtime-root /home/mt2.jakubkadlec.dev/metin/runtime/server \
+  --env-file /etc/metin/metin.env \
   --channel 1 \
   --channel 99 \
   --restart
@@ -30,3 +31,14 @@ python3 deploy/systemd/install_systemd.py \
 - `/usr/local/libexec/metin-wait-port`
 
 The `metin-db-ready.service` gate waits until the DB socket is actually accepting connections before `auth` and `game` units start.
+
+## Optional Environment File
+
+The runtime units support an optional `EnvironmentFile` for host-local overrides:
+
+- default path: `/etc/metin/metin.env`
+- it is loaded with `EnvironmentFile=-...`, so the file may be absent
+- recommended ownership: `root:root`
+- recommended mode: `0600`
+
+This is the preferred place for production-only values such as DB credentials and the admin page password.

deploy/systemd/install_systemd.py

@@ -24,6 +24,7 @@ def parse_args() -> argparse.Namespace:
     parser.add_argument("--runtime-root", required=True, help="Absolute path to the live runtime root")
     parser.add_argument("--systemd-dir", default="/etc/systemd/system", help="systemd unit destination")
     parser.add_argument("--libexec-dir", default="/usr/local/libexec", help="Helper script destination")
+    parser.add_argument("--env-file", default="/etc/metin/metin.env", help="Optional EnvironmentFile path for runtime overrides")
     parser.add_argument("--wait-host", default="127.0.0.1", help="DB readiness host")
     parser.add_argument("--wait-port", type=int, default=9000, help="DB readiness port")
     parser.add_argument("--wait-timeout", type=int, default=30, help="DB readiness timeout in seconds")
@@ -118,6 +119,7 @@ def main() -> int:
         "USER_NAME": args.user,
         "GROUP_NAME": group_name,
         "RUNTIME_ROOT": runtime_root,
+        "ENV_FILE": args.env_file,
         "WAIT_HOST": args.wait_host,
         "WAIT_PORT": str(args.wait_port),
         "WAIT_TIMEOUT": str(args.wait_timeout),

deploy/systemd/templates/metin-auth.service.in

@@ -10,6 +10,7 @@ Before=metin-server.service
 Type=simple
 User={{USER_NAME}}
 Group={{GROUP_NAME}}
+EnvironmentFile=-{{ENV_FILE}}
 WorkingDirectory={{RUNTIME_ROOT}}/channels/auth
 ExecStart={{RUNTIME_ROOT}}/channels/auth/game_auth
 Restart=on-failure

deploy/systemd/templates/metin-db.service.in

@@ -10,6 +10,7 @@ Before=metin-server.service
 Type=simple
 User={{USER_NAME}}
 Group={{GROUP_NAME}}
+EnvironmentFile=-{{ENV_FILE}}
 WorkingDirectory={{RUNTIME_ROOT}}/channels/db
 ExecStart={{RUNTIME_ROOT}}/channels/db/db
 Restart=on-failure

deploy/systemd/templates/metin-game@.service.in

@@ -10,6 +10,7 @@ Before=metin-server.service
 Type=simple
 User={{USER_NAME}}
 Group={{GROUP_NAME}}
+EnvironmentFile=-{{ENV_FILE}}
 WorkingDirectory={{RUNTIME_ROOT}}
 ExecStart=/usr/local/libexec/metin-game-instance-start %i
 Restart=on-failure