diff options
| author | Craig Jennings <c@cjennings.net> | 2026-07-20 08:05:20 -0500 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-07-20 08:05:34 -0500 |
| commit | a20e8c2f839fa53659f2fc3eba18645e541e753e (patch) | |
| tree | d6efcb4f0d8a2c819abd9067b5eeff02b1f49335 /assets/wireguard-config/.gitignore | |
| parent | 2e062cc27285f79d75ce49f15a26ea8ebba9764f (diff) | |
| download | archsetup-a20e8c2f839fa53659f2fc3eba18645e541e753e.tar.gz archsetup-a20e8c2f839fa53659f2fc3eba18645e541e753e.zip | |
fix(security): stop tracking plaintext WireGuard configs
The repo is public via cgit, so the three plaintext configs (added 849c3fa)
exposed live Proton PrivateKeys. Remove them, gitignore plaintext, and document
the encrypted-only workflow. Keys rotated at Proton; history purged separately.
Diffstat (limited to 'assets/wireguard-config/.gitignore')
| -rw-r--r-- | assets/wireguard-config/.gitignore | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/assets/wireguard-config/.gitignore b/assets/wireguard-config/.gitignore new file mode 100644 index 0000000..d5e34ab --- /dev/null +++ b/assets/wireguard-config/.gitignore @@ -0,0 +1,5 @@ +# This repo is PUBLIC (cgit at git.cjennings.net serves it unauthenticated). +# NEVER commit plaintext WireGuard configs here — they carry live PrivateKeys. +# Ship configs gpg-encrypted (*.conf.gpg) only; the installer decrypts at import. +*.conf +!*.conf.gpg |