MMD
43e317eeba
- Delete backups/*.dump and all real credentials from README/docs
(prod MinIO creds, Casdoor passwords, server IP, admin password)
- All stack secrets now come from git-ignored .env (.env.example added);
docker-compose.prod.yml refuses to boot without them (${VAR:?})
- seed_casdoor.py: bcrypt password hashing, generated console/client secrets
- Harden infra/deploy-webhook: HMAC-verified Gitea webhook receiver
+ systemd unit + README (replaces unauthenticated deploy endpoint)
- docs/SECRET-MANAGEMENT.md: secret inventory + rotation checklist
44 lines
736 B
Plaintext
44 lines
736 B
Plaintext
# ---- Node / frontend ----
|
|
node_modules/
|
|
dist/
|
|
*.tsbuildinfo
|
|
|
|
# ---- Python / backend ----
|
|
__pycache__/
|
|
*.pyc
|
|
*.pyo
|
|
.venv/
|
|
venv/
|
|
|
|
# ---- Env / secrets ----
|
|
# All credentials live in git-ignored .env files (server-side and local).
|
|
# NEVER commit .env or database dumps — see docs/SECRET-MANAGEMENT.md.
|
|
.env
|
|
.env.*
|
|
!*.env.example
|
|
backend/.env
|
|
frontend/.env
|
|
*.local
|
|
|
|
# ---- Database dumps (contain user rows + signing material) ----
|
|
*.dump
|
|
*.sql.gz
|
|
|
|
# ---- Local session / backups ----
|
|
.zcode/
|
|
v1.2 - Copy/
|
|
inv dash/
|
|
|
|
# ---- Machine-local compose overrides (LAN phone access, etc.) ----
|
|
docker-compose.override.yml
|
|
|
|
# ---- Screenshots (root) ----
|
|
*.png
|
|
*.jpg
|
|
*.jpeg
|
|
!frontend/public/icons/*.png
|
|
|
|
# ---- OS junk ----
|
|
.DS_Store
|
|
Thumbs.db
|