From 04253cba2b1aba5911b7dc28fb97699a5f70ad87 Mon Sep 17 00:00:00 2001 From: DavidHerran Date: Fri, 4 Sep 2026 21:02:15 -0500 Subject: [PATCH] =?UTF-8?q?chore(hygiene):=20stop=20tracking=20`env`=20?= =?UTF-8?q?=E2=80=94=20the=20credentials=20were=20rotated=20by=20the=20cli?= =?UTF-8?q?ent;=20the=20pattern=20was=20still=20teaching?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Arkhos's audit (2026-09-02) closed the credential alarm: the client rotated every key, so the blob in history is history, not exposure. What remained was the PATTERN — a file named `env` under version control, in a repo other Origin sites read as a template. Measured before changing anything: - docker-compose.yml never references `env`; it substitutes ${VARS} from a git-ignored `.env`. - The tracked `env` lacks DB_USER/DB_PASSWORD/DB_NAME that compose requires, so no deployment can be reading it. Untracking it deletes nothing a VPS `git pull` depends on. Changes: - `git rm --cached env` (history untouched; the dead values stay where they were). - `.gitignore`: `env` (the existing `.env*` rule never matched a dotless name). - `env.example`: every key compose substitutes, placeholder values only. - README.md: the environment note Arkhos suggested, plus the deploy one-liner. Co-Authored-By: Claude Fable 5.1 --- .gitignore | 5 +++++ README.md | 19 +++++++++++++++++++ env | 40 ---------------------------------------- env.example | 21 +++++++++++++++++++++ 4 files changed, 45 insertions(+), 40 deletions(-) create mode 100644 README.md delete mode 100644 env create mode 100644 env.example diff --git a/.gitignore b/.gitignore index 5435e84..d3b2f02 100644 --- a/.gitignore +++ b/.gitignore @@ -57,3 +57,8 @@ public/branding/ .mcp.json .claude/ backups/ + +# Environment files live OUTSIDE git. A file named `env` (no dot) sits in this repo's history +# (4 commits, 2026); the client rotated every credential in it, so the values are dead — but the +# PATTERN must not be copied by anyone using this repo as a template. Never track env files. +env diff --git a/README.md b/README.md new file mode 100644 index 0000000..48ddb83 --- /dev/null +++ b/README.md @@ -0,0 +1,19 @@ +# Flux SRL — rf-flux.com + +Next.js 16 + AI SDK 6 + Prisma 7 + PostgreSQL, shipped as Docker containers behind Nginx. +Delivered to the client; kept here for support and as a reference for other Origin sites. + +## Environment + +`docker-compose.yml` reads its `${VARS}` from a git-ignored `.env`. `env.example` lists every +key. **Do not track environment files.** A file literally named `env` exists in this repo's +history (4 commits); the client has since rotated every credential in it, so the values are dead — +if you use this repo as a template, do not replicate that pattern. + +## Deploy (VPS) + +```bash +cd /opt/flux-srl && git pull && docker compose up -d --build app +``` + +Migrations run from the container entrypoint. Reload Nginx only when `nginx/*` changes. diff --git a/env b/env deleted file mode 100644 index a9871d0..0000000 --- a/env +++ /dev/null @@ -1,40 +0,0 @@ -# Conexión local a SQLite -#DATABASE_URL="file:./dev.db" - -# POSTGRES SQL CONEXION -#:xDATABASE_URL="postgresql://flux_user:STRONG_PASSWORD@postgres:5432/flux_db?schema=public" -DATABASE_URL="postgresql://flux_user:dev_password@localhost:5432/flux_db?schema=public" - -# SESSION_SECRET (REQUIRED, min 32 chars). -# Used to sign 7-day admin JWTs in src/lib/session.ts and CSRF tokens in -# src/lib/csrf.ts. The app refuses to boot without it. Generate with: -# openssl rand -base64 48 -SESSION_SECRET="CHANGE_ME_openssl_rand_base64_48_min_32_chars" - -# Optional: multi-instance rate limiting via Upstash Redis REST API. -# Leave both unset to use the in-memory bucket store (fine for single VPS). -#REDIS_URL="https://xxx.upstash.io" -#REDIS_TOKEN="xxxxx" - -# Google Analytics 4 Measurement ID (format: G-XXXXXXXXXX). -# Leave empty to disable analytics entirely — the site loads no Google -# scripts and the consent banner stays hidden until this is set. -# This is a PUBLIC value (it ships in the page HTML), safe to commit. -NEXT_PUBLIC_GA_ID="G-KQ1JRV3KN7" - -# Google Search Console verification token (the content="" value from the -# HTML-tag verification method). Leave empty if you verify via DNS or GA. -NEXT_PUBLIC_GSC_VERIFICATION="" - -# OPEN AI KEY -OPENAI_API_KEY=sk-proj-dsdsdsds-kaDAHhZXPYsK6-4uw0UWJZ0YuLnQfVoEA - -NEXT_PUBLIC_APP_URL=http://localhost:3000 # En producción será https://www.rf-flux.com - -#email Config -SMTP_HOST=smtp.gmail.com # (or smtp.office365.com, mail.fluxsrl.com, etc.) -SMTP_PORT=587 #(587 for TLS, 465 for SSL) -SMTP_USER=davidherran@dreamhousestudios.co -SMTP_PASS=syzybrtcidrkzehp #(Gmail: use App Password, not regular password) -SMTP_FROM=FLUX Operations -SMTP_SECURE=false # (true for port 465, false for 587 with STARTTLS) \ No newline at end of file diff --git a/env.example b/env.example new file mode 100644 index 0000000..40046df --- /dev/null +++ b/env.example @@ -0,0 +1,21 @@ +# Copy to `.env` (git-ignored). docker-compose.yml substitutes these ${VARS} — nothing reads a +# file named `env`. Values are placeholders; never commit the real file. +DB_USER=flux +DB_PASSWORD=change-me +DB_NAME=flux +SESSION_SECRET=change-me-64-random-bytes +OPENAI_API_KEY=sk-... +NEXT_PUBLIC_APP_URL=https://rf-flux.com +NEXT_PUBLIC_GA_ID=G-XXXXXXXXXX +NEXT_PUBLIC_GSC_VERIFICATION= +SMTP_HOST=smtp.example.com +SMTP_PORT=587 +SMTP_USER= +SMTP_PASS= +SMTP_FROM=no-reply@rf-flux.com +SMTP_SECURE=false +# optional +REDIS_URL= +REDIS_TOKEN= +BACKUP_RETENTION_DAYS=14 +BACKUP_INTERVAL_SECONDS=86400