From 0a0cdc0c44dd8b4fb44d8a859962c40c593e98eb Mon Sep 17 00:00:00 2001 From: Doan Luu Duc Tai Date: Fri, 30 Oct 2026 16:20:09 -0500 Subject: Restrict published environment files to the root example --- .gitignore | 4 +++- docs/POLICY.txt | 3 ++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 0ec5a8e..d41af45 100644 --- a/.gitignore +++ b/.gitignore @@ -13,7 +13,9 @@ # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . -/.env +.env +.env.* +!/.env.example /var/ /.tools/ /target/ diff --git a/docs/POLICY.txt b/docs/POLICY.txt index f9e3614..592269b 100644 --- a/docs/POLICY.txt +++ b/docs/POLICY.txt @@ -31,7 +31,8 @@ PROJECT CONVENTIONS Rust documentation attributes provide crate metadata without comments. Keep configured secrets only in the root .env. Never commit .env or var/. - .env.example lists required keys with placeholders. Public hostnames, + Only the root .env.example is published; environment variants and nested + examples are ignored. .env.example lists required keys with placeholders. Public hostnames, public GPG keys, paths, configuration, and source belong in Git. TLS account/certificate private keys, databases, and other generated private state are persistent data in var/data, not .env configuration. -- cgit v1.2.3