Harden immutable release deployment

deploy/unraid/all-in-one-start.sh

@@ -13,6 +13,27 @@ export YOLO_MODELS_DIR="${YOLO_MODELS_DIR:-/app/models}"
 export YOLO_CONFIG_DIR="${YOLO_CONFIG_DIR:-$STORAGE_ROOT/ultralytics}"
 export GEOINTEL_RECONCILE_INTERRUPTED_RUNS_ON_STARTUP="${GEOINTEL_RECONCILE_INTERRUPTED_RUNS_ON_STARTUP:-true}"
 
+case "$MAX_UPLOAD_MB" in
+  ''|*[!0-9]*)
+    echo "GEOINTEL_MAX_UPLOAD_MB must be a whole number between 1 and 2048." >&2
+    exit 2
+    ;;
+esac
+if [ "$MAX_UPLOAD_MB" -lt 1 ] || [ "$MAX_UPLOAD_MB" -gt 2048 ]; then
+  echo "GEOINTEL_MAX_UPLOAD_MB must be between 1 and 2048." >&2
+  exit 2
+fi
+
+case "${GEOINTEL_ENV:-production}:${POSTGRES_PASSWORD}" in
+  production:|production:geointel|production:postgres|production:password|production:changeme|production:change-me-before-shared-use)
+    echo "Refusing to start production with an empty or known-default PostGIS password." >&2
+    exit 2
+    ;;
+esac
+
+sed -i "s/__GEOINTEL_MAX_UPLOAD_MB__/${MAX_UPLOAD_MB}/g" /etc/nginx/conf.d/default.conf
+nginx -t
+
 mkdir -p "$PGDATA" "$STORAGE_ROOT" "$YOLO_CONFIG_DIR" /run/nginx /var/log/nginx
 chown -R postgres:postgres "$PGDATA"