21 lines
1.2 KiB
Markdown
21 lines
1.2 KiB
Markdown
|
# Public repository and deployment privacy
|
||
|
|
|
||
|
|
Runtime keys, passwords, sessions, private photos, databases and local `.env` files
|
||
|
|
must remain outside Git. Examples use documentation-only addresses and identities.
|
||
|
|
Personal deployment reports and screenshots are excluded from public history.
|
||
|
|
|
||
|
|
The NAS Docker runner accepts trusted repository events only. External fork PRs
|
||
|
|
are not executed on this runner; maintainers must review them before copying changes
|
||
|
|
to a trusted branch. All lint, type, test, audit and isolated Docker checks remain.
|
||
|
|
|
||
|
|
Private deployment configuration is stored in Gitea Actions Secrets:
|
||
|
|
`PROD_DATA_DIR`, `PROD_CONFIG_DIR`, `PROD_PHOTOS_DIR`, `PROD_WEB_BIND`,
|
||
|
|
`SYNOLOGY_PHOTOS_URL`, `SYNOLOGY_PHOTOS_CERT_SHA256`, and `PRODUCTION_ENV`.
|
||
|
|
Project/image names, ports, enable flags and mirror settings remain Variables.
|
||
|
|
Never print complete Docker inspect environment or secret values.
|
||
|
|
|
||
|
|
Publishing requires scanning all refs, removing private historic files, pruning
|
||
|
|
unreachable remote Git objects and archiving/removing historical Actions logs.
|
||
|
|
A private original mirror is retained outside the repository. Existing clones must
|
||
|
|
reclone after the privacy history rewrite; do not merge the original history back.
|