feat(worker): adopt canonical public URL

internal/installer/install.go

@@ -15,6 +15,8 @@ import (
 	"unicode"
 
 	"github.com/joho/godotenv"
+
+	"rocketgit.ru/rsmon/worker/internal/distworker"
 )
 
 var (
@@ -34,11 +36,16 @@ const (
 // installEnvKeys is the canonical, ordered set of worker environment
 // variables the installer understands and writes to the unit's env
 // file. Order matters: the rendered file is stable and readable.
+//
+// PUBLIC_URL is the canonical advertised origin. WORKER_URL stays in the
+// list for the bounded migration so legacy env files still resolve; it
+// is dropped from the written file whenever PUBLIC_URL is also present.
 var installEnvKeys = []string{
 	"RSMON_URL",
 	"RSMON_TOKEN",
 	"WORKER_HOST",
 	"WORKER_PORT",
+	"PUBLIC_URL",
 	"WORKER_URL",
 	"WORKER_LOGIN",
 	"WORKER_PASSWORD",
@@ -56,18 +63,19 @@ var installEnvKeys = []string{
 // installs a co-located worker under rsmon-worker-<name> with its own
 // binary path, config dir, data dir, systemd unit, and port.
 type InstallOptions struct {
-	Binary   string
-	EnvFile  string
-	Token    string
-	URL      string
-	Host     string
-	Port     string
-	Login    string
-	Password string
-	Name     string
-	Docker   bool
-	Image    string
-	NoStart  bool
+	Binary    string
+	EnvFile   string
+	Token     string
+	URL       string
+	PublicURL string
+	Host      string
+	Port      string
+	Login     string
+	Password  string
+	Name      string
+	Docker    bool
+	Image     string
+	NoStart   bool
 }
 
 // paths is the fully-resolved on-disk layout for an instance. Every
@@ -258,6 +266,7 @@ func resolveInstallEnv(opts InstallOptions, name string, fileEnv map[string]stri
 	flagVals := map[string]string{
 		"RSMON_URL":       opts.URL,
 		"RSMON_TOKEN":     opts.Token,
+		"PUBLIC_URL":      opts.PublicURL,
 		"WORKER_HOST":     opts.Host,
 		"WORKER_PORT":     opts.Port,
 		"WORKER_LOGIN":    opts.Login,
@@ -312,6 +321,26 @@ func resolveInstallEnv(opts InstallOptions, name string, fileEnv map[string]stri
 		return nil, fmt.Errorf("WORKER_LOGIN and WORKER_PASSWORD must both be set or both be empty")
 	}
 
+	// PUBLIC_URL is the canonical advertised origin. When both the
+	// canonical and the legacy WORKER_URL resolve, the legacy variable
+	// is superseded and must not be written to a fresh env file.
+	if values["PUBLIC_URL"] != "" {
+		delete(values, "WORKER_URL")
+	}
+	// Canonical PUBLIC_URL is held to the strict origin shape; the
+	// legacy WORKER_URL only to the tolerant absolute-URL check so env
+	// files that previously installed keep working.
+	if v := values["PUBLIC_URL"]; v != "" {
+		if err := distworker.ValidatePublicURL(v); err != nil {
+			return nil, fmt.Errorf("PUBLIC_URL: %w", err)
+		}
+	}
+	if v := values["WORKER_URL"]; v != "" {
+		if err := distworker.ValidateAdvertisedURL(v); err != nil {
+			return nil, fmt.Errorf("WORKER_URL: %w", err)
+		}
+	}
+
 	// Validate every value we will write is systemd/docker safe.
 	for _, key := range installEnvKeys {
 		v, ok := values[key]