chore(hygiene): stop tracking env — the credentials were rotated by the client; the pattern was still teaching

Arkhos's audit (2026-09-02) closed the credential alarm: the client rotated every key, so the
blob in history is history, not exposure. What remained was the PATTERN — a file named `env`
under version control, in a repo other Origin sites read as a template.

Measured before changing anything:
- docker-compose.yml never references `env`; it substitutes ${VARS} from a git-ignored `.env`.
- The tracked `env` lacks DB_USER/DB_PASSWORD/DB_NAME that compose requires, so no deployment
  can be reading it. Untracking it deletes nothing a VPS `git pull` depends on.

Changes:
- `git rm --cached env` (history untouched; the dead values stay where they were).
- `.gitignore`: `env` (the existing `.env*` rule never matched a dotless name).
- `env.example`: every key compose substitutes, placeholder values only.
- README.md: the environment note Arkhos suggested, plus the deploy one-liner.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.gitignore

@@ -57,3 +57,8 @@ public/branding/
 .mcp.json
 .claude/
 backups/
+
+# Environment files live OUTSIDE git. A file named `env` (no dot) sits in this repo's history
+# (4 commits, 2026); the client rotated every credential in it, so the values are dead — but the
+# PATTERN must not be copied by anyone using this repo as a template. Never track env files.
+env

README.md

@@ -0,0 +1,19 @@
+# Flux SRL — rf-flux.com
+
+Next.js 16 + AI SDK 6 + Prisma 7 + PostgreSQL, shipped as Docker containers behind Nginx.
+Delivered to the client; kept here for support and as a reference for other Origin sites.
+
+## Environment
+
+`docker-compose.yml` reads its `${VARS}` from a git-ignored `.env`. `env.example` lists every
+key. **Do not track environment files.** A file literally named `env` exists in this repo's
+history (4 commits); the client has since rotated every credential in it, so the values are dead —
+if you use this repo as a template, do not replicate that pattern.
+
+## Deploy (VPS)
+
+```bash
+cd /opt/flux-srl && git pull && docker compose up -d --build app
+```
+
+Migrations run from the container entrypoint. Reload Nginx only when `nginx/*` changes.

env

@@ -1,40 +0,0 @@
-# Conexión local a SQLite
-#DATABASE_URL="file:./dev.db"
-
-# POSTGRES SQL CONEXION
-#:xDATABASE_URL="postgresql://flux_user:STRONG_PASSWORD@postgres:5432/flux_db?schema=public"
-DATABASE_URL="postgresql://flux_user:dev_password@localhost:5432/flux_db?schema=public"
-
-# SESSION_SECRET (REQUIRED, min 32 chars).
-# Used to sign 7-day admin JWTs in src/lib/session.ts and CSRF tokens in
-# src/lib/csrf.ts. The app refuses to boot without it. Generate with:
-#   openssl rand -base64 48
-SESSION_SECRET="CHANGE_ME_openssl_rand_base64_48_min_32_chars"
-
-# Optional: multi-instance rate limiting via Upstash Redis REST API.
-# Leave both unset to use the in-memory bucket store (fine for single VPS).
-#REDIS_URL="https://xxx.upstash.io"
-#REDIS_TOKEN="xxxxx"
-
-# Google Analytics 4 Measurement ID (format: G-XXXXXXXXXX).
-# Leave empty to disable analytics entirely — the site loads no Google
-# scripts and the consent banner stays hidden until this is set.
-# This is a PUBLIC value (it ships in the page HTML), safe to commit.
-NEXT_PUBLIC_GA_ID="G-KQ1JRV3KN7"
-
-# Google Search Console verification token (the content="" value from the
-# HTML-tag verification method). Leave empty if you verify via DNS or GA.
-NEXT_PUBLIC_GSC_VERIFICATION=""
-
-# OPEN AI KEY
-OPENAI_API_KEY=sk-proj-dsdsdsds-kaDAHhZXPYsK6-4uw0UWJZ0YuLnQfVoEA
-
-NEXT_PUBLIC_APP_URL=http://localhost:3000 # En producción será https://www.rf-flux.com
-
-#email Config
-SMTP_HOST=smtp.gmail.com                                # (or smtp.office365.com, mail.fluxsrl.com, etc.)
-SMTP_PORT=587                                           #(587 for TLS, 465 for SSL)
-SMTP_USER=davidherran@dreamhousestudios.co
-SMTP_PASS=syzybrtcidrkzehp                           #(Gmail: use App Password, not regular password)
-SMTP_FROM=FLUX Operations <davidherran@dreamhousestudios.co>
-SMTP_SECURE=false                                       # (true for port 465, false for 587 with STARTTLS)

env.example

@@ -0,0 +1,21 @@
+# Copy to `.env` (git-ignored). docker-compose.yml substitutes these ${VARS} — nothing reads a
+# file named `env`. Values are placeholders; never commit the real file.
+DB_USER=flux
+DB_PASSWORD=change-me
+DB_NAME=flux
+SESSION_SECRET=change-me-64-random-bytes
+OPENAI_API_KEY=sk-...
+NEXT_PUBLIC_APP_URL=https://rf-flux.com
+NEXT_PUBLIC_GA_ID=G-XXXXXXXXXX
+NEXT_PUBLIC_GSC_VERIFICATION=
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASS=
+SMTP_FROM=no-reply@rf-flux.com
+SMTP_SECURE=false
+# optional
+REDIS_URL=
+REDIS_TOKEN=
+BACKUP_RETENTION_DAYS=14
+BACKUP_INTERVAL_SECONDS=86400