Merge pull request 'fix(ops): выгрузка бэкапа в S3 не проходила TLS — у aws-cli свой CA-бандл (#2203)' (#3009) from fix/backup-s3-ca-bundle into main

ops/backup.sh

@@ -157,9 +157,14 @@ log "Globals dump OK: ${globals_out} ($(du -h "$globals_out" | cut -f1))"
 if [[ -n "${S3_ENDPOINT:-}" && -n "${S3_BUCKET:-}" && -n "${S3_ACCESS_KEY:-}" && -n "${S3_SECRET_KEY:-}" ]]; then
     for f in "$out" "$globals_out"; do
         log "Uploading to s3://${S3_BUCKET}/$(basename "$f")"
+        # aws-cli v2 ships its own CA bundle (baked into botocore) instead of
+        # trusting the system store, and it's missing the root that Selectel's
+        # cert chains up to — so uploads fail with CERTIFICATE_VERIFY_FAILED
+        # unless we point it at the container's system store, which has it.
         docker run --rm \
             -e AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY" \
             -e AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY" \
+            -e AWS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
             -v "$LOCAL_BACKUP_DIR":/backup:ro \
             amazon/aws-cli:latest \
             --endpoint-url "$S3_ENDPOINT" \

tradein-mvp/deploy/backup-tradein-db.sh

@@ -122,9 +122,14 @@ log "Globals ok: $globals_out ($(du -h "$globals_out" | cut -f1))"
 if [[ -n "${S3_ENDPOINT:-}" && -n "${S3_BUCKET:-}" && -n "${S3_ACCESS_KEY:-}" && -n "${S3_SECRET_KEY:-}" ]]; then
   for f in "$out" "$globals_out"; do
     log "Заливаю в s3://${S3_BUCKET}/$(basename "$f")"
+    # У aws-cli v2 свой CA-бандл (вшит в botocore), а не системное хранилище —
+    # в нём нет корня, которым подписан сертификат Selectel. Без переменной
+    # ниже выгрузка падает на CERTIFICATE_VERIFY_FAILED; системное хранилище
+    # контейнера этот корень содержит.
     docker run --rm \
       -e AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY" \
       -e AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY" \
+      -e AWS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
       -v "$BACKUP_DIR":/backup:ro \
       amazon/aws-cli:latest \
       --endpoint-url "$S3_ENDPOINT" \