badge-service: mount config folder, ignore .env (#7715)

.gitignore

@@ -89,9 +89,3 @@ apps/android/app/release
 apps/multiplatform/.kotlin/sessions
 # anywhere in the tree: this file holds a real BTCPay api_key and webhook_secret
 badge_service.ini
-
-# Badge service Docker deployment: the Dockerfile, compose, and example config are tracked; the
-# live config (a secret) and its data volume are not.
-scripts/badge-service/badge_service.ini
-scripts/badge-service/data/
-scripts/badge-service/web/

scripts/badge-service/.gitignore

@@ -0,0 +1,4 @@
+.env
+config/
+data/
+web/

scripts/badge-service/badge_service.ini.example

@@ -37,8 +37,8 @@ waiting_seconds = 3
 idle_seconds = 60
 
 ; optional; without it every App Store receipt is answered provider_not_configured, which the app retries later.
-; root_certificates lists, comma-separated, the roots trusted to sign receipts, each in DER and mounted
-; in compose.yml. Today that is https://www.apple.com/certificateauthority/AppleRootCA-G3.cer.
+; root_certificates lists, comma-separated, the roots trusted to sign receipts, each in DER and placed
+; in config/. Today that is https://www.apple.com/certificateauthority/AppleRootCA-G3.cer.
 ; When Apple adds a root, list it beside the old one rather than in its place.
 ;[apple]
 ;bundle_id = chat.simplex.app
@@ -48,7 +48,7 @@ idle_seconds = 60
 ; service_account_file is the JSON key of a service account with the Play Console permissions "View
 ; financial data, orders, and cancellation survey responses" and "Manage orders and subscriptions", to
 ; read and acknowledge purchases. Without the second, a purchase the app has not already acknowledged
-; itself is answered internal until the permission is granted. Uncomment its mount in compose.yml; the file must be readable by the service's user alone.
+; itself is answered internal until the permission is granted. Place it in config/; the file must be readable by the service's user alone.
 ;[google]
 ;package_name = chat.simplex.app
 ;service_account_file = /etc/simplex-badge-service/play-service-account.json

scripts/badge-service/compose.yml

@@ -20,22 +20,10 @@ services:
       - "/etc/simplex-badge-service/badge_service.ini"
     volumes:
       - type: bind
-        source: ./badge_service.ini
-        target: /etc/simplex-badge-service/badge_service.ini
+        source: ./config
+        target: /etc/simplex-badge-service
         read_only: true
         bind:
           create_host_path: false
-      # - type: bind
-      #   source: ./AppleRootCA-G3.cer
-      #   target: /etc/simplex-badge-service/AppleRootCA-G3.cer
-      #   read_only: true
-      #   bind:
-      #     create_host_path: false
-      # - type: bind
-      #   source: ./play-service-account.json
-      #   target: /etc/simplex-badge-service/play-service-account.json
-      #   read_only: true
-      #   bind:
-      #     create_host_path: false
       - ./web:/srv/webapp
     stop_grace_period: 10s