1.2 KiB
Public repository and deployment privacy
Runtime keys, passwords, sessions, private photos, databases and local .env files
must remain outside Git. Examples use documentation-only addresses and identities.
Personal deployment reports and screenshots are excluded from public history.
The NAS Docker runner accepts trusted repository events only. External fork PRs are not executed on this runner; maintainers must review them before copying changes to a trusted branch. All lint, type, test, audit and isolated Docker checks remain.
Private deployment configuration is stored in Gitea Actions Secrets:
PROD_DATA_DIR, PROD_CONFIG_DIR, PROD_PHOTOS_DIR, PROD_WEB_BIND,
SYNOLOGY_PHOTOS_URL, SYNOLOGY_PHOTOS_CERT_SHA256, and PRODUCTION_ENV.
Project/image names, ports, enable flags and mirror settings remain Variables.
Never print complete Docker inspect environment or secret values.
Publishing requires scanning all refs, removing private historic files, pruning unreachable remote Git objects and archiving/removing historical Actions logs. A private original mirror is retained outside the repository. Existing clones must reclone after the privacy history rewrite; do not merge the original history back.