add .env generation from bws, handle build services in deploy

- configure.sh generates .env files from .env.keys + bws
- deploy.sh detects build: services and runs docker compose build
- new-service.sh prints .env.keys instructions
- clean up .gitignore

scripts/configure.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 # Idempotent server configuration. Safe to run from CI or manually.
-# No secrets required — only configures firewall, certbot, and starts services.
+# Uses bws to generate .env files for services that need secrets.
 
 REPO_DIR="/opt/hantim"
 
@@ -56,6 +56,38 @@ for conf in "$REPO_DIR"/docker/nginx/conf.d/*.conf; do
     certbot certonly --standalone --non-interactive --agree-tos --register-unsafely-without-email --cert-name "$cert_name" $domain_args
 done
 
+echo "==> Generating .env files from Bitwarden Secrets Manager..."
+BWS_TOKEN_FILE="/etc/bws-token"
+if [ -f "$BWS_TOKEN_FILE" ]; then
+    export BWS_ACCESS_TOKEN
+    BWS_ACCESS_TOKEN=$(cat "$BWS_TOKEN_FILE")
+    ALL_SECRETS=$(bws secret list)
+    for keys_file in "$REPO_DIR"/docker/*/.env.keys; do
+        [ -f "$keys_file" ] || continue
+        app_dir=$(dirname "$keys_file")
+        app_name=$(basename "$app_dir")
+        env_content=""
+        while IFS= read -r line || [ -n "$line" ]; do
+            [ -z "$line" ] && continue
+            var_name="${line%%=*}"
+            secret_key="${line#*=}"
+            value=$(echo "$ALL_SECRETS" | jq -r --arg key "$secret_key" '.[] | select(.key == $key) | .value')
+            if [ -z "$value" ]; then
+                echo "  WARNING: Secret '$secret_key' not found in bws, skipping."
+                continue
+            fi
+            env_content="${env_content}${var_name}=${value}"$'\n'
+        done < "$keys_file"
+        if [ -n "$env_content" ]; then
+            echo "  Writing .env for $app_name"
+            printf "%s" "$env_content" > "$app_dir/.env"
+            chmod 600 "$app_dir/.env"
+        fi
+    done
+else
+    echo "  No bws token found, skipping .env generation."
+fi
+
 echo "==> Starting services..."
 # Start nginx first (creates the shared network)
 cd "$REPO_DIR/docker/nginx"