sync: update from private repo (d31b280)

scripts/server.sh

@@ -5,6 +5,53 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
 PID_FILE="$PROJECT_DIR/.server.pid"
 LOG_FILE="$PROJECT_DIR/logs/server.log"
+
+# Optional project-root .env (gitignored; setup.sh writes credentials here,
+# operators can add e.g. HOST=0.0.0.0 for reverse-proxy deployments so a bare
+# `server.sh restart` keeps the bind address). Lines are `KEY=value` or
+# `export KEY='value'`. Precedence: explicit environment > .env > defaults,
+# so `HOST=127.0.0.1 scripts/server.sh restart` still overrides the file.
+if [[ -f "$PROJECT_DIR/.env" ]]; then
+  # Values are parsed LITERALLY (no eval/source): a value is either bare, or
+  # single-quoted in setup.sh's format ('\'' encodes a literal quote), or
+  # double-quoted (quotes stripped, contents kept literal — no $ expansion).
+  # One KEY=value per line; full-line comments only.
+  #
+  # Keys this loader itself set from .env are tracked space-delimited (keys are
+  # validated identifiers so this is unambiguous — no Bash-4 associative
+  # arrays, macOS ships bash 3.2). Only EXTERNAL pre-set environment is
+  # protected; duplicate keys within .env keep normal source semantics (last
+  # line wins) because earlier lines are recorded here and may be overridden.
+  _envfile_set=" "
+  _q=\'
+  _esc=$'\x01'
+  while IFS= read -r _line || [[ -n "$_line" ]]; do
+    _line="${_line#"${_line%%[![:space:]]*}"}"   # ltrim
+    [[ -z "$_line" || "$_line" == \#* ]] && continue
+    _kv="${_line#export }"
+    _key="${_kv%%=*}"
+    [[ "$_key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
+    [[ "$_kv" == *=* ]] || continue
+    _val="${_kv#*=}"
+    case "$_val" in
+      "$_q"*)
+        _val="${_val//${_q}\\${_q}${_q}/${_esc}}"  # '\''  -> literal-quote marker
+        _val="${_val//${_q}/}"                     # drop quoting quotes
+        _val="${_val//${_esc}/${_q}}"              # restore literal quotes
+        ;;
+      \"*\")
+        _val="${_val#\"}"
+        _val="${_val%\"}"
+        ;;
+    esac
+    if [[ "$_envfile_set" == *" $_key "* || -z "${!_key+x}" ]]; then
+      export "$_key=$_val"
+      _envfile_set="${_envfile_set}${_key} "
+    fi
+  done < "$PROJECT_DIR/.env"
+  unset _line _kv _key _val _envfile_set _q _esc
+fi
+
 PORT="${PORT:-9876}"
 
 cd "$PROJECT_DIR"

scripts/setup.sh

@@ -130,6 +130,15 @@ path.write_text(text.replace(needle, replacement))
 PY
 fi
 
+python3 - <<'PY'
+from pathlib import Path
+p = Path("config.yaml")
+text = p.read_text()
+if "\nserver:" not in text:
+    text += "\nserver:\n  tls:\n    enabled: true\n"
+    p.write_text(text)
+PY
+
 echo "  config.yaml を生成/更新しました"
 echo ""
 
@@ -191,7 +200,8 @@ chmod 600 "${ENV_FILE}"
 
 echo ""
 echo "  認証情報を ${ENV_FILE} (権限 0600) に書き出しました。"
-echo "  起動前に以下で読み込んでください:"
+echo "  scripts/server.sh は起動時に ${ENV_FILE} を自動で読み込みます。"
+echo "  手動起動 (npm start 等) の場合のみ、事前に読み込んでください:"
 echo ""
 echo "    source ${ENV_FILE}"
 echo ""