Provision instance bank credentials automatically (Refs #146)

src/lib/server/provisioning/launch-worker.ts

@@ -71,6 +71,19 @@ parentPort!.on(
                 };
             })();
             const instance = input.instance;
+            // Credential files travel only in this host's private operation payload, never
+            // shared recipes, promoted files, or the content-addressed download store.
+            const bankPath = posix.join(
+                relDestForKind('config', recipe.game),
+                'electric_cherry_bank.cfg'
+            );
+            if (
+                recipe.files.some(
+                    (file) =>
+                        posix.join(relDestForKind(file.kind, recipe.game), file.path) === bankPath
+                )
+            )
+                throw new Error('electric_cherry_bank.cfg is reserved for instance credentials.');
             const payload = {
                 name: instance.server,
                 game: recipe.game,
@@ -79,13 +92,14 @@ parentPort!.on(
                 port: instance.port,
                 bindAddress: instance.bind_address,
                 rconPassword: password,
+                bank: { token: input.bankToken, configPath: bankPath },
                 env: {
                     PLUTAINER_SERVER_NAME: instance.server,
                     PLUTAINER_PORT: String(instance.port),
                     PLUTAINER_GAME: recipe.game === 't6' ? 't6zm' : 't5sp',
                     PLUTAINER_CONFIG_FILE: recipe.configFile,
                     PLUTAINER_MAP_ROTATE: 'false',
-                    PLUTAINER_EXTRA_ARGS: `+exec electric_cherry_map.cfg +set tws_server_id ${instance.server} +map_rotate`,
+                    PLUTAINER_EXTRA_ARGS: `+exec electric_cherry_map.cfg +exec electric_cherry_bank.cfg +set tws_server_id ${instance.server} +map_rotate`,
                     PLUTO_SERVER_KEY: input.serverKey
                 },
                 files: recipe.files.map((file) => ({