Gabriel Brown
913a57f8a6
The catalog in server/containers had drifted from the VPS. Eleven compose
files and twelve units no longer matched what runs, and two running
services, Gbrown_Agent and BillTracker, were missing. server/vps is now a
copy of the live files, and panama-server reads from it.
server/home holds the home server's services in the same shape. They still
run under Docker, so the podman units there are drafts for a later move, and
nothing installs from that tree. PostHog, Sentry and Plausible are checkouts
of upstream repositories. Only their local files are kept, next to an
UPSTREAM file naming the repository and the exact commit.
Every secret in both trees is a ${VAR} reference named in .env.example, or
CHANGE_ME in files that are not compose files. The live servers still hold
some of those values inline, so a live file can differ from its copy on
those lines alone. Existing .env.example files keep their comments, with new
keys appended at the end.
The ignore rules and the secrets contract now cover both trees, plus the
volume/ and volumes/ directories the home server uses.
55 lines
2.3 KiB
Plaintext
55 lines
2.3 KiB
Plaintext
# Ignore bash environment variables, and the lock its writer takes.
|
|
/config/bash/env
|
|
/config/bash/.env.lock
|
|
# Server secrets and state never enter the repo: live .env files belong in
|
|
# ~/Server/<Name>/ (only compose.yml is symlinked back here), and data/ is
|
|
# the bind-mount convention (the home server's older services use volume/ and
|
|
# volumes/). Ignored anyway as a seatbelt -- the repo is public, and
|
|
# tests/server/compose-secrets-contract is the check that these lines still exist.
|
|
/server/**/.env
|
|
/server/**/data/
|
|
/server/**/volume/
|
|
/server/**/volumes/
|
|
# Personal espanso triggers (name, email), seeded per-machine by setup-identity.
|
|
/config/dot/espanso/match/identity.yml
|
|
# Ignore backups of old config files
|
|
/config/old
|
|
# MCP bearer tokens. The server list in user/agents/mcp/servers is tracked
|
|
# and names which variable carries each token; the tokens themselves are
|
|
# machine-local, because this repo is public.
|
|
/user/agents/mcp/env
|
|
# Ignore Wireguard config of course!
|
|
/config/wg/**
|
|
# Ignore Neovim lazy-lock file
|
|
/config/dot/nvim/lazy-lock.json
|
|
# Local visual-companion sessions and generated design mocks.
|
|
/.superpowers/
|
|
# Local linked worktrees used for reviewed feature development.
|
|
/.worktrees/
|
|
# Python helper bytecode is local runtime state.
|
|
__pycache__/
|
|
*.py[cod]
|
|
|
|
# Generated from the color scheme; machine state, not configuration.
|
|
/config/dot/kitty/current-theme.conf
|
|
|
|
# Generated from the color scheme; machine state, not configuration.
|
|
/config/dot/gtk-3.0/settings.ini
|
|
/config/dot/gtk-3.0/bookmarks
|
|
/config/dot/gtk-4.0/settings.ini
|
|
/config/dot/tmux/current-theme.conf
|
|
/config/dot/hypr/hyprlock.conf
|
|
# The Firefox chrome override sheet, rendered from the active theme. It sits
|
|
# beside custom.css because chrome/ is symlinked into the profile as one
|
|
# directory; custom.css imports it and stays the file a person edits.
|
|
/config/firefox/chrome/panama-theme.css
|
|
/config/firefox/chrome/panama-theme.css.tmp
|
|
|
|
# Build products of the Vicinae extension. The source and reviewed lockfile are
|
|
# in the repository; the dependency tree and bundle are machine state.
|
|
/config/local/share/vicinae/extensions/*/node_modules/
|
|
/config/local/share/vicinae/extensions/*/dist/
|
|
/config/local/share/vicinae/extensions/*/build/
|
|
/config/local/share/vicinae/extensions/*/package-lock.json
|
|
!/config/local/share/vicinae/extensions/panama-search/package-lock.json
|