From 6e8eadbab5e77e461cbc1e519cf2fb7086397ae5 Mon Sep 17 00:00:00 2001 From: Mischa Date: Sun, 5 Jul 2026 00:52:42 +0200 Subject: [PATCH] security: stop tracking the per-host env/ secret tree MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit git-sync auto-commit stages everything not gitignored (git add -A over user/), NOT just the pages/config/themes folders. Because /env/ was not gitignored, prod's git-sync pushed the per-host env tree — including api-private.php (JWT), security-private.php (CSRF salt), and the git-sync token — to Gitea in commit 9337003. Gitignore /env/ and untrack it so it can never round-trip again. (Working-tree files kept via --cached; prod still needs them to run.) Leaked secrets rotated separately; history purge TBD. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01Np4cMQLF77i664CAQXySzU --- .gitignore | 4 ++ .../config/plugins/api-private.php | 7 ---- .../config/plugins/git-sync.yaml | 33 ---------------- .../config/security-private.php | 7 ---- env/intotheeast.com/config/system.yaml | 38 ------------------- 5 files changed, 4 insertions(+), 85 deletions(-) delete mode 100644 env/intotheeast.com/config/plugins/api-private.php delete mode 100644 env/intotheeast.com/config/plugins/git-sync.yaml delete mode 100644 env/intotheeast.com/config/security-private.php delete mode 100644 env/intotheeast.com/config/system.yaml diff --git a/.gitignore b/.gitignore index 219ceb2..6f69a89 100644 --- a/.gitignore +++ b/.gitignore @@ -11,4 +11,8 @@ /config/security.yaml /config/security-private.php /config/versions.yaml +# Per-host env override tree — holds LIVE secrets (JWT, CSRF salt, git-sync +# token) + per-host overrides. Never commit/sync: git-sync stages anything +# not gitignored, so an untracked /env/ would boomerang to Gitea. +/env/ /themes/intotheeast/node_modules/ diff --git a/env/intotheeast.com/config/plugins/api-private.php b/env/intotheeast.com/config/plugins/api-private.php deleted file mode 100644 index 1e07a37..0000000 --- a/env/intotheeast.com/config/plugins/api-private.php +++ /dev/null @@ -1,7 +0,0 @@ -$z>\%+G''Jo' -branch: main -logging: false -password: gitsync-def502005b5427cc6afd28ea66682788711e72b3e31bcb6bd302db4232e48a8783900ed76bf2cf891b3e4545dd925a5f5276fa683bf033797b5c6074f7ef0c520c455e34e27392be46615378e779cba61fe4a7f710fcbf157fb9709142794bce7d785e3738de84dd6887e0287f2923e96ae12ce446e4e61285a3ce48 -sync: - direction: both - on_save: true - on_delete: true - on_media: true - cron_enable: false - cron_at: '0 12,23 * * *' -remote: - name: origin - branch: main -git: - author: gituser - message: '(Grav GitSync) Automatic Commit' - name: GitSync - email: mischa@gorinskat.nl - bin: git - ignore: '' - private_key: '' diff --git a/env/intotheeast.com/config/security-private.php b/env/intotheeast.com/config/security-private.php deleted file mode 100644 index d185898..0000000 --- a/env/intotheeast.com/config/security-private.php +++ /dev/null @@ -1,7 +0,0 @@ -/user/env//config/system.yaml -# and Grav's `environment://config` stream (keyed on the request hostname) -# layers it on top of `user://config`. -# -# These values are deliberately NOT in the committed system.yaml because they -# would break local development (see CLAUDE.md §1 — dev keeps twig.cache:false -# so theme edits take effect immediately). Prod is the only place they apply. -# -# Deploy with: make remote-apply-env-prod -# The user/env/ tree is outside the content repo's tracked folders, so it is -# NOT restored by content-push / git-sync / remote-fetch-content — re-run the -# target above after any fresh install. -twig: - cache: true - debug: false - auto_reload: false - -# Compression / connection handling. -# -# This host is not FastCGI (no fastcgi_finish_request()), so Grav's shutdown -# "early connection close" falls back to emitting `Content-Encoding: identity` -# to ask the webserver not to compress. But Apache's mod_deflate compresses -# anyway and adds `Content-Encoding: gzip`, giving TWO conflicting headers — -# the browser can't decode the body and renders raw gzip bytes (a garbage -# page). Note: allow_webserver_gzip:true takes the SAME identity branch, so it -# does not help. The real fix is to disable the early-close path, so Grav never -# emits the bogus header and mod_deflate compresses cleanly (single header). -debugger: - shutdown: - close_connection: false -# Let the webserver own gzip; Grav does not compress or double-label. -cache: - gzip: false - allow_webserver_gzip: false