Полный продовый фикс fix22: DNS preflight, inet firewall, idempotent bootstrap, auth-semantics и redact-config

orchestrator/src/commands/reconfigure.ts

@@ -6,7 +6,7 @@ import { preflight } from "../steps/preflight";
 import { generateConfig } from "../steps/config";
 import { deploySystemd } from "../steps/systemd";
 import { applyFirewall, cancelFirewallRollback, rollbackFirewallNow } from "../steps/firewall";
-import { writePostInstallEnv } from "../steps/env";
+import { ensureBootstrapAdminSecret, writePostInstallEnv } from "../steps/env";
 import { smoke } from "../steps/smoke";
 import { runVisible } from "../lib/process";
 import { readInstalledHysteriaVersion, readPackageValue } from "../lib/packageMeta";
@@ -219,6 +219,7 @@ export async function reconfigure(options: ReconfigureOptions): Promise<void> {
     await writeText(options.runtimeConfigPath, renderRuntimeEnv(config), 0o600);
     await runVisible`chown root:root ${options.runtimeConfigPath}`;
     await runVisible`chmod 0600 ${options.runtimeConfigPath}`;
+    await ensureBootstrapAdminSecret(context);
     await writePostInstallEnv(context);
     stepDone("write env artifacts");
     await markPhase(context, "runtime_env_written");