feat(worker): adopt canonical public URL

cmd/rsmon-worker/main.go

@@ -76,6 +76,14 @@ func main() {
 	if err := webapp.ValidateBasicAuth(cfg.HTTP.Login, cfg.HTTP.Password); err != nil {
 		log.Fatalf("worker: %v", err)
 	}
+	// Enforce the advertised PUBLIC_URL origin rules (and the
+	// production HTTPS policy) before accepting work. willListen=false
+	// because the webapp's both-empty local bcrypt mode is legitimate
+	// and already gated by ValidateBasicAuth above; here we only check
+	// the URL invariants.
+	if err := distworker.ValidateHTTPConfig(cfg.HTTP, false); err != nil {
+		log.Fatalf("worker: %v", err)
+	}
 
 	runner := distworker.NewRunner(&cfg)
 
@@ -501,20 +509,30 @@ func logHTTPSettings(h distworker.HTTPConfig, willListen bool) {
 	if h.Login == "" {
 		login = "(empty)"
 	}
-	url := h.URL
+	url := h.PublicURL
 	if url == "" {
 		url = "(empty)"
 	}
-	log.Printf("worker http settings: host=%s port=%d url=%s login=%s will_listen=%t",
+	log.Printf("worker http settings: host=%s port=%d public_url=%s login=%s will_listen=%t",
 		h.Host, h.Port, url, login, willListen)
-	if h.URL != "" {
-		if host, warn := distworker.WarnInsecurePublicURL(h.URL); warn {
+	if h.PublicURL != "" {
+		if host, warn := distworker.WarnInsecurePublicURL(h.PublicURL); warn {
+			label := distworker.EnvPublicURL
+			if h.URLSource == distworker.PublicURLSourceLegacy {
+				label = distworker.EnvWorkerURLLegacy
+			}
 			log.Printf(
-				"worker http settings: WARN WORKER_URL=http://%s uses plain HTTP on a non-loopback host; "+
-					"production deployments usually terminate TLS at a reverse proxy", host,
+				"worker http settings: WARN %s=http://%s uses plain HTTP on a non-loopback host; "+
+					"production deployments usually terminate TLS at a reverse proxy", label, host,
 			)
 		}
 	}
+	if _, source := distworker.PublicURLFromEnv(); source == distworker.PublicURLSourceLegacy {
+		log.Printf(
+			"worker http settings: WARNING WORKER_URL is deprecated (bounded migration); " +
+				"rename it to PUBLIC_URL before it is removed (docs/public-endpoint-and-identity.md milestone 1)",
+		)
+	}
 }
 
 func loadDotEnv() {

cmd/rsmon-worker/management.go

@@ -35,6 +35,7 @@ func installCommand(args []string) int {
 	fs.StringVar(&opts.Token, "api-key", "", "worker API token (alias for --token)")
 	fs.StringVar(&tokenFile, "token-file", "", "file containing the worker API token")
 	fs.StringVar(&opts.URL, "url", "", "RSMon server URL (RSMON_URL; default https://rsmon.ru)")
+	fs.StringVar(&opts.PublicURL, "public-url", "", "advertised public origin (PUBLIC_URL; scheme + host, no path)")
 	fs.StringVar(&opts.Host, "host", "", "operator console bind address (WORKER_HOST; default 127.0.0.1)")
 	fs.StringVar(&opts.Port, "port", "", "operator console port (WORKER_PORT; required with --name)")
 	fs.StringVar(&opts.Login, "login", "", "operator console login (WORKER_LOGIN; default admin with a generated password)")