docs: close WireGuard leak task, note cgit follow-up

Record the resolution (keys expired, all 10 configs purged from history, server
gc'd, verified via anonymous clone) and file the cgit-exposure audit as the
systemic follow-up. Update the config README to the out-of-band workflow.

1 files changed, 11 insertions, 3 deletions

diff --git a/todo.org b/todo.org
index b03deea..c7a1146 100644
--- a/todo.org
+++ b/todo.org
@@ -48,9 +48,17 @@ below):
 ** TODO [#B] Installer GRUB_CMDLINE overwrite drops boot params :bug:solo:
 Grading: Critical severity (unbootable) x some-users-sometimes (machines whose base install set a cryptdevice=/resume=/zfs= cmdline param) = P2 = [#B].
 archsetup:3054 rewrites the whole GRUB_CMDLINE_LINUX_DEFAULT line with a fixed string; nothing re-adds a pre-existing cryptdevice/resume/zfs token, so grub-mkconfig (3059) can bake an unbootable config. Fix: read the current value and append only the missing tokens; assert any pre-existing boot-critical token survives before grub-mkconfig. See [[file:docs/design/2026-07-19-sentry-code-findings.org][sentry code findings]] (S3).
-** TODO [#B] Tracked WireGuard private keys in repo :bug:security:network:
-Grading: security carve-out (graded on severity alone) — live Proton VPN private keys committed to git. Private remote (git@cjennings.net) mitigates immediate exposure, but archsetup is a code project and a server-side mirror hook could republish; keys are live = P2 = [#B]. Bump to [#A]+date to act now.
-assets/wireguard-config/wg-NL-781.conf, wg-US-CA-144.conf, wg-US-TX-714.conf each hold an [Interface] PrivateKey (added c7b7d16, 2026-07-05), not gitignored. Decision: if not meant to be tracked, rotate the three Proton keys, git rm + gitignore assets/wireguard-config/, scrub history (filter-repo/BFG), force-push. If intentional, confirm no mirror hook and record the decision in notes.org so audits stop flagging it. Not :solo: — needs Craig's call.
+** DONE [#A] Tracked WireGuard private keys in repo — public leak, resolved :bug:security:network:
+CLOSED: [2026-07-20 Mon]
+Confirmed a live public leak, not just at-risk: git.cjennings.net runs cgit (scan-path=/var/git), so archsetup.git was anonymously cloneable over https. An unauthenticated clone pulled the configs with intact PrivateKeys. Exposed 2026-07-05 (c7b7d16) to 2026-07-20. Regraded to P1/[#A] (public credential exposure, severity-alone carve-out) from the initial [#B].
+Scope was wider than first found: the current 3 configs (assets/wireguard-config/wg-*.conf) plus 7 older ones at the pre-reorg path assets/wireguard/ (switzerland x2, USCALA/USCASF/USDC/USGAAT/USNY) — 10 config files, all with real keys.
+Resolution: Craig expired all the Proton WireGuard configs (keys dead). Purged all 10 from every commit with git filter-repo, force-pushed main + v0.5, and ran git gc --prune=now on the server bare repo. Verified via anonymous clone: zero real-key blobs reachable, all old exposed commits gone. Stopped tracking plaintext (gitignore + README, out-of-band configs only).
+Follow-ups filed below: harden cgit exposure; installer no longer ships configs.
+** TODO [#B] Audit cgit-published repos for secrets and privacy :bug:security:
+Grading: security carve-out — cgit at git.cjennings.net serves every repo under scan-path=/var/git over unauthenticated https (any repo is anonymously cloneable). archsetup being public is by design (curl-install), but this means ANY secret in ANY /var/git repo is world-readable, and any repo meant to be private is not. Severity depends on what else lives there = P2 = [#B], raise if a private repo with secrets is found.
+Not :solo: — needs Craig's decisions. Steps: list repos under /var/git; for each, decide intended public vs private; scan each for secrets (keys, tokens, credentials) the way this WireGuard leak was found; for any meant-to-be-private repo, actually restrict access (cgit repo.hide only hides from the index — a known repo name is still cloneable; use http auth or move it off the public scan-path); for public repos, confirm no secrets and add a pre-receive/CI secret scan. Check dotfiles (git.cjennings.net/dotfiles) specifically — it is also under /var/git.
+** TODO [#C] WireGuard import is now config-less — decide feature fate :feature:network:
+scripts/import-wireguard-configs.sh reads assets/wireguard-config/*.conf, but no configs ship in the repo anymore (removed as a public-leak fix; .gitignore blocks plaintext). Decide: remove the import feature entirely, or keep it and document dropping plaintext configs into the dir out-of-band at install time (they stay gitignored). If kept, confirm the script no-ops gracefully when the dir has no *.conf.
 ** TODO [#C] Installer chpasswd unguarded — unloggable primary user :bug:solo:quick:
 Grading: Major severity (fresh system's primary user can't log in) x rare edge case (chpasswd seldom fails) = P3 = [#C].
 archsetup:1168 runs =echo "$user:$pass" | chpasswd= with no guard, then unsets the password next line; set -e is off (line 21), so a silent failure leaves no password and no log entry. Fix: guard with error_fatal (report + "set it by hand: passwd $user") before unsetting. See findings doc (S2).