revert: back to symlink approach, PrivateMounts incompatible

python/deploy.py

@@ -161,30 +161,32 @@ http {{
         run(f"cp -a {DEPLOY_TO} {instance}", timeout=30)
         shutil.rmtree(DEPLOY_TO, ignore_errors=True)
 
-    # PrivateMounts handles filesystem isolation (/opt/wallarm == instance dir)
-    # Still need port offsets for internal services (wstore, api-firewall)
+    # Patch paths + port offsets for multi-instance
     offset = hash_port(instance)
-    for pattern in ("*.yaml", "*.yml", "*.conf"):
+    for pattern in ("*.sh", "*.list", "*.conf", "*.yaml", "*.yml"):
         for f in Path(instance).rglob(pattern):
             content = f.read_text()
+            content = content.replace("/opt/wallarm", instance)
             for port_num in (3313, 6388, 9001, 8088, 9667, 6060, 5005):
                 content = content.replace(f":{port_num}", f":{port_num + offset}")
             f.write_text(content)
 
+    # Add -cfg flag to wcli so it reads its own node.yaml
+    for conf in Path(f"{instance}/etc").glob("*.conf"):
+        c = conf.read_text()
+        if "wcli run" in c and "-cfg" not in c:
+            conf.write_text(c.replace("wcli run", f"wcli run -cfg {instance}/etc/wallarm/node.yaml"))
+
     # Systemd
     # Systemd template with private /opt/wallarm per instance
     tmpl = f"""[Unit]
 Description=Wallarm Node - %i
 After=network.target
-
 [Service]
 Type=simple
 WorkingDirectory={BASE}/%i/wallarm
 EnvironmentFile=-{BASE}/%i/wallarm/env.list
-# Private mount namespace isolates /opt/wallarm per instance
-PrivateMounts=yes
-ExecStartPre=/bin/mkdir -p /opt/wallarm
-ExecStartPre=/bin/mount --bind {BASE}/%i/wallarm /opt/wallarm
+ExecStartPre=/bin/ln -sf {BASE}/%i/wallarm /opt/wallarm
 ExecStartPre=-{BASE}/%i/wallarm/nginx/sbin/nginx -c {BASE}/%i/wallarm/nginx/conf/nginx.conf
 ExecStartPre=/bin/sleep 1
 ExecStart={BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervisord -c {BASE}/%i/wallarm/etc/supervisord.conf
@@ -192,7 +194,6 @@ ExecStop={BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervis
 Restart=on-failure
 RestartSec=5
 User=root
-
 [Install]
 WantedBy=multi-user.target
 """