davidherranandClaude Fable 5.1
04253cba2b
Arkhos's audit (2026-09-02) closed the credential alarm: the client rotated every key, so the
blob in history is history, not exposure. What remained was the PATTERN — a file named `env`
under version control, in a repo other Origin sites read as a template.
Measured before changing anything:
- docker-compose.yml never references `env`; it substitutes ${VARS} from a git-ignored `.env`.
- The tracked `env` lacks DB_USER/DB_PASSWORD/DB_NAME that compose requires, so no deployment
can be reading it. Untracking it deletes nothing a VPS `git pull` depends on.
Changes:
- `git rm --cached env` (history untouched; the dead values stay where they were).
- `.gitignore`: `env` (the existing `.env*` rule never matched a dotless name).
- `env.example`: every key compose substitutes, placeholder values only.
- README.md: the environment note Arkhos suggested, plus the deploy one-liner.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
65 lines
1.1 KiB
Plaintext
65 lines
1.1 KiB
Plaintext
# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
|
|
|
|
# dependencies
|
|
/node_modules
|
|
/.pnp
|
|
.pnp.*
|
|
.yarn/*
|
|
!.yarn/patches
|
|
!.yarn/plugins
|
|
!.yarn/releases
|
|
!.yarn/versions
|
|
|
|
# testing
|
|
/coverage
|
|
|
|
# next.js
|
|
/.next/
|
|
/out/
|
|
|
|
# production
|
|
/build
|
|
|
|
# misc
|
|
.DS_Store
|
|
*.pem
|
|
|
|
# debug
|
|
npm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
.pnpm-debug.log*
|
|
|
|
# env files (can opt-in for committing if needed)
|
|
.env*
|
|
|
|
# vercel
|
|
.vercel
|
|
|
|
# typescript
|
|
*.tsbuildinfo
|
|
next-env.d.ts
|
|
|
|
/src/generated/prisma
|
|
certbot/
|
|
|
|
# Asset uploads - manejados manualmente, no versionados
|
|
public/applications/
|
|
public/cases/
|
|
public/news/
|
|
public/parts/
|
|
public/operations-inbox/
|
|
public/footage/
|
|
public/team/
|
|
public/branding/
|
|
|
|
# Local Claude Code / MCP config — agent-specific, not project
|
|
.mcp.json
|
|
.claude/
|
|
backups/
|
|
|
|
# Environment files live OUTSIDE git. A file named `env` (no dot) sits in this repo's history
|
|
# (4 commits, 2026); the client rotated every credential in it, so the values are dead — but the
|
|
# PATTERN must not be copied by anyone using this repo as a template. Never track env files.
|
|
env
|