From 6933ec28be3dac0dc17cd634c663db3b4818caad Mon Sep 17 00:00:00 2001 From: Doan Luu Duc Tai Date: Fri, 30 Oct 2026 22:36:11 -0500 Subject: Centralize deployment settings in the root environment file Document public domains, ports, upstreams, chat binding, and backup defaults alongside private settings. Validate shared configuration and render Caddy, cgit, and website links from an explicit public allowlist while preserving one installation environment file. --- docs/POLICY.txt | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'docs/POLICY.txt') diff --git a/docs/POLICY.txt b/docs/POLICY.txt index 4c8d0bd..f662dd4 100644 --- a/docs/POLICY.txt +++ b/docs/POLICY.txt @@ -30,10 +30,13 @@ PROJECT CONVENTIONS documentation. The generated HTML license page is an explicit exception. Rust documentation attributes provide crate metadata without comments. - Keep configured secrets only in the root .env. Never commit .env or var/. + Keep deployment overrides and configured secrets in the single root .env. + Never commit .env or var/. Only the root .env.example is published; environment variants and nested - examples are ignored. .env.example lists required keys with placeholders. Public hostnames, - public GPG keys, paths, configuration, and source belong in Git. + examples are ignored. The commented .env.example publishes supported public + defaults and private placeholders. Public GPG keys, paths, templates, shared + configuration logic, and source belong in Git. Actual public hostnames remain + visible in rendered pages; .env centralization is not an access boundary. TLS account/certificate private keys, databases, and other generated private state are persistent data in var/data, not .env configuration. The GPG secret key and revocation certificate remain outside this project. -- cgit v1.2.3