diff options
| author | Craig Jennings <c@cjennings.net> | 2026-07-20 08:18:38 -0500 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-07-20 08:18:38 -0500 |
| commit | 18429ed05b1653c17f2d3e8257b1297799162c48 (patch) | |
| tree | c3849fc5e8522f1ce085bcc6b9ba8c7312a0aa88 /assets | |
| parent | a20e8c2f839fa53659f2fc3eba18645e541e753e (diff) | |
| download | archsetup-18429ed05b1653c17f2d3e8257b1297799162c48.tar.gz archsetup-18429ed05b1653c17f2d3e8257b1297799162c48.zip | |
docs: close WireGuard leak task, note cgit follow-up
Record the resolution (keys expired, all 10 configs purged from history, server
gc'd, verified via anonymous clone) and file the cgit-exposure audit as the
systemic follow-up. Update the config README to the out-of-band workflow.
Diffstat (limited to 'assets')
| -rw-r--r-- | assets/wireguard-config/README.org | 26 |
1 files changed, 12 insertions, 14 deletions
diff --git a/assets/wireguard-config/README.org b/assets/wireguard-config/README.org index 3bcf327..4329ec7 100644 --- a/assets/wireguard-config/README.org +++ b/assets/wireguard-config/README.org @@ -1,19 +1,17 @@ -#+TITLE: WireGuard configs — encrypted only +#+TITLE: WireGuard configs — not tracked #+AUTHOR: Craig Jennings -This directory holds WireGuard VPN configs for the installer's -=import-wireguard-configs.sh=. +This directory backs the installer's =import-wireguard-configs.sh=. -*This repo is public* (cgit at git.cjennings.net serves it over -unauthenticated HTTPS). Plaintext =*.conf= files carry live Proton -=PrivateKey= material and MUST NOT be committed — they are gitignored here. +*This repo is public* (cgit at git.cjennings.net serves it over unauthenticated +https). Plaintext =*.conf= files carry live Proton =PrivateKey= material and are +gitignored here — never commit them. -Workflow: -- Store configs gpg-encrypted only: =gpg -e --default-recipient-self wg-XX.conf= - produces =wg-XX.conf.gpg=, safe to track in a public repo. -- The installer decrypts =*.conf.gpg= to a private temp dir at import time, - imports, then wipes the plaintext. (Re-architecture tracked in todo.org.) +Configs are supplied out-of-band: drop the plaintext =*.conf= into this +directory locally at install time (they stay gitignored), or fetch them from a +private store. Nothing here is tracked except this note and the .gitignore. -History note: three plaintext configs were committed 2026-07-05 (c7b7d16) and -were publicly exposed until 2026-07-20, when the keys were rotated at Proton -and the files were purged from history. +History: ten plaintext configs were committed and publicly exposed from +2026-07-05 to 2026-07-20. The keys were expired at Proton and every config was +purged from git history (filter-repo + server gc). See the closed WireGuard +security task in todo.org. |