fix(security): stop tracking plaintext WireGuard configs

The repo is public via cgit, so the three plaintext configs (added 849c3fa)
exposed live Proton PrivateKeys. Remove them, gitignore plaintext, and document
the encrypted-only workflow. Keys rotated at Proton; history purged separately.

2 files changed, 24 insertions, 0 deletions

diff --git a/assets/wireguard-config/.gitignore b/assets/wireguard-config/.gitignore
new file mode 100644
index 0000000..d5e34ab
--- /dev/null
+++ b/assets/wireguard-config/.gitignore
@@ -0,0 +1,5 @@
+# This repo is PUBLIC (cgit at git.cjennings.net serves it unauthenticated).
+# NEVER commit plaintext WireGuard configs here — they carry live PrivateKeys.
+# Ship configs gpg-encrypted (*.conf.gpg) only; the installer decrypts at import.
+*.conf
+!*.conf.gpg
diff --git a/assets/wireguard-config/README.org b/assets/wireguard-config/README.org
new file mode 100644
index 0000000..3bcf327
--- /dev/null
+++ b/assets/wireguard-config/README.org
@@ -0,0 +1,19 @@
+#+TITLE: WireGuard configs — encrypted only
+#+AUTHOR: Craig Jennings
+
+This directory holds WireGuard VPN configs for the installer's
+=import-wireguard-configs.sh=.
+
+*This repo is public* (cgit at git.cjennings.net serves it over
+unauthenticated HTTPS). Plaintext =*.conf= files carry live Proton
+=PrivateKey= material and MUST NOT be committed — they are gitignored here.
+
+Workflow:
+- Store configs gpg-encrypted only: =gpg -e --default-recipient-self wg-XX.conf=
+  produces =wg-XX.conf.gpg=, safe to track in a public repo.
+- The installer decrypts =*.conf.gpg= to a private temp dir at import time,
+  imports, then wipes the plaintext. (Re-architecture tracked in todo.org.)
+
+History note: three plaintext configs were committed 2026-07-05 (c7b7d16) and
+were publicly exposed until 2026-07-20, when the keys were rotated at Proton
+and the files were purged from history.