davidherranandClaude Fable 5.1
04253cba2b
Arkhos's audit (2026-09-02) closed the credential alarm: the client rotated every key, so the
blob in history is history, not exposure. What remained was the PATTERN — a file named `env`
under version control, in a repo other Origin sites read as a template.
Measured before changing anything:
- docker-compose.yml never references `env`; it substitutes ${VARS} from a git-ignored `.env`.
- The tracked `env` lacks DB_USER/DB_PASSWORD/DB_NAME that compose requires, so no deployment
can be reading it. Untracking it deletes nothing a VPS `git pull` depends on.
Changes:
- `git rm --cached env` (history untouched; the dead values stay where they were).
- `.gitignore`: `env` (the existing `.env*` rule never matched a dotless name).
- `env.example`: every key compose substitutes, placeholder values only.
- README.md: the environment note Arkhos suggested, plus the deploy one-liner.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
22 lines
584 B
Plaintext
22 lines
584 B
Plaintext
# Copy to `.env` (git-ignored). docker-compose.yml substitutes these ${VARS} — nothing reads a
|
|
# file named `env`. Values are placeholders; never commit the real file.
|
|
DB_USER=flux
|
|
DB_PASSWORD=change-me
|
|
DB_NAME=flux
|
|
SESSION_SECRET=change-me-64-random-bytes
|
|
OPENAI_API_KEY=sk-...
|
|
NEXT_PUBLIC_APP_URL=https://rf-flux.com
|
|
NEXT_PUBLIC_GA_ID=G-XXXXXXXXXX
|
|
NEXT_PUBLIC_GSC_VERIFICATION=
|
|
SMTP_HOST=smtp.example.com
|
|
SMTP_PORT=587
|
|
SMTP_USER=
|
|
SMTP_PASS=
|
|
SMTP_FROM=no-reply@rf-flux.com
|
|
SMTP_SECURE=false
|
|
# optional
|
|
REDIS_URL=
|
|
REDIS_TOKEN=
|
|
BACKUP_RETENTION_DAYS=14
|
|
BACKUP_INTERVAL_SECONDS=86400
|