feat(deploy): lab-seeds sync, msmtp nginx-readable secret, hub downloads

Signed-off-by: Anton Afanasyeu <a.afanasieff@gmail.com>

sim/cluster0/scripts/compose-lab-backend.sh

@@ -363,13 +363,20 @@ $config['build'] = array_merge([
     'ci_version' => '00.01.00.1000',
     'repo_root' => '/var/www/ac/workspace',
     'artifacts_root' => '/var/www/ac/broadcast/builds',
-    'ota_mount' => '/var/www/ac/broadcast/ota-artifacts',
+    'ota_mount' => '/var/www/localhost/htdocs/apps/app/androidcast_project/ota-artifacts',
+    'downloads_mount' => '/var/www/localhost/htdocs/apps/app/androidcast_project/downloads',
     'ota_base_url' => 'https://apps.f0xx.org',
     'runner_script' => '/var/www/ac/workspace/ac-scripts/docker-build-runner.sh',
     'isolate_source' => true,
     'git_clone_depth' => 1,
     'pipeline_config' => '/var/www/ac/workspace/ac-scripts/build.config.yml',
     'default_channels' => ['stable', 'staging', 'dev', 'nightly'],
+    'mobile_subdir' => 'ac-mobile-android',
+    'scripts_dir' => '/var/www/ac/workspace/ac-scripts',
+    'notify' => [
+        'admin_email' => 'bestcastr@gmail.com',
+        'broadcast_config' => '/var/www/ac/workspace/ac-ms-broadcast/config/config.php',
+    ],
 ], $config['build'] ?? []);
 return $config;
 PHP

sim/cluster0/scripts/deploy-hub-downloads.sh

@@ -1,6 +1,5 @@
 #!/bin/sh
-# Publish hub download artifacts (Session Studio jar) to BE downloads mount.
-# APK is served via OTA stable channel (/v0/ota/) — run ci-build-and-publish-ota.sh separately.
+# Publish hub download artifacts (Session Studio jar + latest OTA .apk) to BE downloads mount.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 # shellcheck source=/dev/null
@@ -8,6 +7,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 load_cluster_env
 
 DOWNLOADS_ROOT="${APP_ROOT:-/var/www/localhost/htdocs/apps/app/androidcast_project}/downloads"
+OTA_ROOT="${APP_ROOT:-/var/www/localhost/htdocs/apps/app/androidcast_project}/ota-artifacts/v0/ota"
 WS="${AC_WORKSPACE_ROOT:-/var/www/ac/workspace}"
 STUDIO_JAR="${WS}/ac-session-studio/build/libs/ac-session-studio.jar"
 
@@ -18,8 +18,44 @@ if [ -f "$STUDIO_JAR" ]; then
   log "installed Session Studio jar → ${DOWNLOADS_ROOT}/ac-session-studio.jar"
 else
   log "WARN: Session Studio jar not built at ${STUDIO_JAR}"
-  log "      cd ac-session-studio && ./gradlew shadowJar (or installDist) on builder node"
 fi
 
+# Prefer staging channel APK; fall back to stable.
+apk_src=""
+for ch in staging stable; do
+  channel_json="${OTA_ROOT}/channel/${ch}.json"
+  [ -f "$channel_json" ] || continue
+  manifest_url="$(sed -n 's/.*"manifestUrl"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$channel_json" | head -1)"
+  [ -n "$manifest_url" ] || continue
+  manifest_path="${OTA_ROOT}/${manifest_url#*\/v0\/ota\/}"
+  [ -f "$manifest_path" ] || continue
+  browser_url="$(sed -n 's/.*"browserApkUrl"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$manifest_path" | head -1)"
+  if [ -n "$browser_url" ]; then
+    candidate="${OTA_ROOT}/${browser_url#*\/v0\/ota\/}"
+    if [ -f "$candidate" ]; then
+      apk_src="$candidate"
+      break
+    fi
+  fi
+  otapkg_url="$(sed -n 's/.*"apkUrl"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$manifest_path" | head -1)"
+  if [ -n "$otapkg_url" ]; then
+    candidate="${OTA_ROOT}/${otapkg_url#*\/v0\/ota\/}"
+    if [ -f "$candidate" ]; then
+      apk_src="$candidate"
+      break
+    fi
+  fi
+done
+
+if [ -n "$apk_src" ]; then
+  install -m 644 "$apk_src" "${DOWNLOADS_ROOT}/android_cast-latest.apk"
+  base="$(basename "$apk_src" .otapkg)"
+  base="$(basename "$base" .apk)"
+  install -m 644 "$apk_src" "${DOWNLOADS_ROOT}/${base}.apk"
+  log "installed APK → ${DOWNLOADS_ROOT}/android_cast-latest.apk (from ${apk_src})"
+else
+  log "WARN: no OTA .apk/.otapkg found under ${OTA_ROOT}/channel/{staging,stable}.json"
+fi
+
+chown -R nginx:nginx "$DOWNLOADS_ROOT" 2>/dev/null || true
 log "Hub downloads dir: ${DOWNLOADS_ROOT}"
-log "URL: ${PUBLIC_ORIGIN:-https://apps.f0xx.org}/v0/downloads/ac-session-studio.jar"

sim/cluster0/scripts/deploy-mailrelay.sh

@@ -19,7 +19,10 @@ apk add --no-cache msmtp mailx >/dev/null 2>&1 || apk add --no-cache msmtp
 mkdir -p /etc/androidcast
 umask 077
 printf '%s\n' "$PASS" > /etc/androidcast/msmtp.secret
-chmod 600 /etc/androidcast/msmtp.secret
+NGROUP="$(getent group nginx 2>/dev/null | cut -d: -f1)"
+NGROUP="${NGROUP:-nginx}"
+chown "root:${NGROUP}" /etc/androidcast/msmtp.secret
+chmod 640 /etc/androidcast/msmtp.secret
 
 sed -e "s|__MSMTP_FROM__|${FROM}|g" -e "s|__MSMTP_USER__|${USER}|g" \
   "$ROOT/mail/msmtprc.template" > /etc/msmtprc