2.2 KiB
Public repository and deployment privacy
Runtime keys, passwords, sessions, private photos, databases and local .env files
must remain outside Git. Examples use documentation-only addresses and identities.
Personal deployment reports and screenshots are excluded from public history.
The Gitea NAS Docker runner accepts trusted repository events only. GitHub mirrors use the separate community workflow on GitHub-hosted disposable runners, with read-only repository permissions and no deployment configuration. External fork PRs are not executed on this runner; maintainers must review them before copying changes to a trusted branch. All lint, type, test, audit and isolated Docker checks remain.
Private deployment configuration is stored in Gitea Actions Secrets:
PROD_DATA_DIR, PROD_CONFIG_DIR, PROD_PHOTOS_DIR, PROD_WEB_BIND,
SYNOLOGY_PHOTOS_URL, SYNOLOGY_PHOTOS_CERT_SHA256, and PRODUCTION_ENV.
Project/image names, ports, enable flags and mirror settings remain Variables.
Never print complete Docker inspect environment or secret values.
Publishing requires scanning all refs, removing private historic files, pruning unreachable remote Git objects and archiving/removing historical Actions logs. A private original mirror is retained outside the repository. Existing clones must reclone after the privacy history rewrite; do not merge the original history back.
Private deployment inputs
Do not publish host addresses, workstation paths, disk UUIDs, photo-library counts, or deployment receipts. Keep receipts and recovery bundles outside the repository in an owner-only directory. A privacy history rewrite changes existing commit IDs; existing clones must be replaced instead of merging old history back.
server-release.py reads FRAME_FLOW_ROOT (default /srv/frameflow), requires
FRAME_FLOW_MOUNT_UUID and FRAME_FLOW_ORIGIN, and retains the mount-identity
check before release actions. Supply verified values privately to the sudo process;
existing installations must set their existing root explicitly. Do not use the
generic default to migrate a deployment. The script still requires the existing
mount guard and does not change host mounts, services, or storage automatically.