2026-10-11 01:13:55 +08:00
|
|
|
# Public repository and deployment privacy
|
|
|
|
|
|
|
|
|
|
Runtime keys, passwords, sessions, private photos, databases and local `.env` files
|
|
|
|
|
must remain outside Git. Examples use documentation-only addresses and identities.
|
|
|
|
|
Personal deployment reports and screenshots are excluded from public history.
|
|
|
|
|
|
2026-10-18 15:56:16 +08:00
|
|
|
The Gitea NAS Docker runner accepts trusted repository events only. GitHub mirrors
|
|
|
|
|
use the separate community workflow on GitHub-hosted disposable runners, with
|
|
|
|
|
read-only repository permissions and no deployment configuration. External fork PRs
|
2026-10-11 01:13:55 +08:00
|
|
|
are not executed on this runner; maintainers must review them before copying changes
|
|
|
|
|
to a trusted branch. All lint, type, test, audit and isolated Docker checks remain.
|
|
|
|
|
|
|
|
|
|
Private deployment configuration is stored in Gitea Actions Secrets:
|
|
|
|
|
`PROD_DATA_DIR`, `PROD_CONFIG_DIR`, `PROD_PHOTOS_DIR`, `PROD_WEB_BIND`,
|
|
|
|
|
`SYNOLOGY_PHOTOS_URL`, `SYNOLOGY_PHOTOS_CERT_SHA256`, and `PRODUCTION_ENV`.
|
|
|
|
|
Project/image names, ports, enable flags and mirror settings remain Variables.
|
|
|
|
|
Never print complete Docker inspect environment or secret values.
|
|
|
|
|
|
|
|
|
|
Publishing requires scanning all refs, removing private historic files, pruning
|
|
|
|
|
unreachable remote Git objects and archiving/removing historical Actions logs.
|
|
|
|
|
A private original mirror is retained outside the repository. Existing clones must
|
|
|
|
|
reclone after the privacy history rewrite; do not merge the original history back.
|
2026-10-18 16:14:56 +08:00
|
|
|
|
|
|
|
|
## Private deployment inputs
|
|
|
|
|
|
|
|
|
|
Do not publish host addresses, workstation paths, disk UUIDs, photo-library counts,
|
|
|
|
|
or deployment receipts. Keep receipts and recovery bundles outside the repository
|
|
|
|
|
in an owner-only directory. A privacy history rewrite changes existing commit IDs;
|
|
|
|
|
existing clones must be replaced instead of merging old history back.
|
|
|
|
|
|
|
|
|
|
`server-release.py` reads `FRAME_FLOW_ROOT` (default `/srv/frameflow`), requires
|
|
|
|
|
`FRAME_FLOW_MOUNT_UUID` and `FRAME_FLOW_ORIGIN`, and retains the mount-identity
|
|
|
|
|
check before release actions. Supply verified values privately to the sudo process;
|
|
|
|
|
existing installations must set their existing root explicitly. Do not use the
|
|
|
|
|
generic default to migrate a deployment. The script still requires the existing
|
|
|
|
|
mount guard and does not change host mounts, services, or storage automatically.
|
