M55: restore private RAGcore routing

deploy/unraid/deploy-release.sh

@@ -15,6 +15,33 @@ case "$revision" in *[!0-9a-f]*) echo "Revision must be lowercase hexadecimal" >
 [ -n "$expected_checksum" ] || { echo "Expected SHA-256 is required" >&2; exit 1; }
 [ -f "$root/.env" ] || { echo "Production .env is missing" >&2; exit 1; }
 
+read_env_value() {
+  key="$1"
+  awk -v key="$key" '
+    index($0, key "=") == 1 {
+      sub("^[^=]*=", "")
+      print
+      exit
+    }
+  ' "$root/.env"
+}
+
+# Stateless replicas normally inherit the complete, already-secret-resolved environment
+# from the serving API. RAGcore routing is an explicit exception: its private endpoint and
+# cross-project Docker network are non-secret deployment topology and the server .env is
+# authoritative so infrastructure changes take effect on the next release.
+ragcore_base_url="$(read_env_value RAGCORE_BASE_URL)"
+ragcore_network="$(read_env_value RAGCORE_DOCKER_NETWORK)"
+case "$ragcore_base_url" in
+  http://*|https://*) ;;
+  *) echo "RAGCORE_BASE_URL must be an absolute HTTP(S) URL" >&2; exit 1 ;;
+esac
+case "$ragcore_network" in
+  "") ;;
+  *[!a-zA-Z0-9_.-]*) echo "RAGCORE_DOCKER_NETWORK contains invalid characters" >&2; exit 1 ;;
+  *) docker network inspect "$ragcore_network" > /dev/null ;;
+esac
+
 actual_checksum="$(sha256sum "$archive" | awk '{print $1}')"
 [ "$actual_checksum" = "$expected_checksum" ] || {
   echo "Archive checksum mismatch" >&2
@@ -123,7 +150,13 @@ for replica in 1 2; do
     --label "com.mobilityops.revision=$revision" \
     --network "$network" --network-alias api --network-alias "api-$short_revision" \
     --env-file "$api_environment" \
-    --env RUN_MIGRATIONS=false "$api_image")"
+    --env RUN_MIGRATIONS=false --env "RAGCORE_BASE_URL=$ragcore_base_url" "$api_image")"
+  if [ -n "$ragcore_network" ] && ! docker network connect "$ragcore_network" "$id"; then
+    # shellcheck disable=SC2086
+    docker rm -f $new_api_ids "$id" > /dev/null 2>&1 || true
+    echo "Could not attach API candidates to RAGcore network $ragcore_network" >&2
+    exit 1
+  fi
   new_api_ids="$new_api_ids $id"
 done