2026-10-11 01:13:55 +08:00
|
|
|
# Public repository and deployment privacy
|
|
|
|
|
|
|
|
|
|
Runtime keys, passwords, sessions, private photos, databases and local `.env` files
|
|
|
|
|
must remain outside Git. Examples use documentation-only addresses and identities.
|
|
|
|
|
Personal deployment reports and screenshots are excluded from public history.
|
|
|
|
|
|
2026-10-18 21:31:03 +08:00
|
|
|
The Gitea Server Docker runner accepts trusted repository events only. GitHub mirrors
|
2026-10-18 15:56:16 +08:00
|
|
|
use the separate community workflow on GitHub-hosted disposable runners, with
|
|
|
|
|
read-only repository permissions and no deployment configuration. External fork PRs
|
2026-10-11 01:13:55 +08:00
|
|
|
are not executed on this runner; maintainers must review them before copying changes
|
|
|
|
|
to a trusted branch. All lint, type, test, audit and isolated Docker checks remain.
|
|
|
|
|
|
2026-10-18 18:48:47 +08:00
|
|
|
Public CI verifies source only. Runtime configuration belongs in private environment
|
|
|
|
|
files or the deployment system's secret store. Never print complete Docker inspect
|
|
|
|
|
environment or secret values.
|
2026-10-11 01:13:55 +08:00
|
|
|
|
2026-10-18 18:48:47 +08:00
|
|
|
Before publishing, scan the current source and distribution files for secrets and
|
|
|
|
|
private receipts. Keep Git history and existing remote releases. If a real historic
|
|
|
|
|
secret is found, revoke it and handle history remediation as a separate operation.
|
2026-10-18 16:14:56 +08:00
|
|
|
|
|
|
|
|
## Private deployment inputs
|
|
|
|
|
|
|
|
|
|
Do not publish host addresses, workstation paths, disk UUIDs, photo-library counts,
|
2026-10-18 18:48:47 +08:00
|
|
|
or deployment receipts. Do not include deployment receipts or recovery bundles in published archives. Local
|
|
|
|
|
obsolete artifacts may be removed after verification; active runtime configuration,
|
|
|
|
|
databases and images must be preserved.
|
2026-10-18 16:14:56 +08:00
|
|
|
|
|
|
|
|
`server-release.py` reads `FRAME_FLOW_ROOT` (default `/srv/frameflow`), requires
|
|
|
|
|
`FRAME_FLOW_MOUNT_UUID` and `FRAME_FLOW_ORIGIN`, and retains the mount-identity
|
|
|
|
|
check before release actions. Supply verified values privately to the sudo process;
|
|
|
|
|
existing installations must set their existing root explicitly. Do not use the
|
|
|
|
|
generic default to migrate a deployment. The script still requires the existing
|
|
|
|
|
mount guard and does not change host mounts, services, or storage automatically.
|
