From a20e8c2f839fa53659f2fc3eba18645e541e753e Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Mon, 20 Jul 2026 08:05:20 -0500 Subject: fix(security): stop tracking plaintext WireGuard configs The repo is public via cgit, so the three plaintext configs (added 849c3fa) exposed live Proton PrivateKeys. Remove them, gitignore plaintext, and document the encrypted-only workflow. Keys rotated at Proton; history purged separately. --- assets/wireguard-config/.gitignore | 5 +++++ assets/wireguard-config/README.org | 19 +++++++++++++++++++ 2 files changed, 24 insertions(+) create mode 100644 assets/wireguard-config/.gitignore create mode 100644 assets/wireguard-config/README.org diff --git a/assets/wireguard-config/.gitignore b/assets/wireguard-config/.gitignore new file mode 100644 index 0000000..d5e34ab --- /dev/null +++ b/assets/wireguard-config/.gitignore @@ -0,0 +1,5 @@ +# This repo is PUBLIC (cgit at git.cjennings.net serves it unauthenticated). +# NEVER commit plaintext WireGuard configs here — they carry live PrivateKeys. +# Ship configs gpg-encrypted (*.conf.gpg) only; the installer decrypts at import. +*.conf +!*.conf.gpg diff --git a/assets/wireguard-config/README.org b/assets/wireguard-config/README.org new file mode 100644 index 0000000..3bcf327 --- /dev/null +++ b/assets/wireguard-config/README.org @@ -0,0 +1,19 @@ +#+TITLE: WireGuard configs — encrypted only +#+AUTHOR: Craig Jennings + +This directory holds WireGuard VPN configs for the installer's +=import-wireguard-configs.sh=. + +*This repo is public* (cgit at git.cjennings.net serves it over +unauthenticated HTTPS). Plaintext =*.conf= files carry live Proton +=PrivateKey= material and MUST NOT be committed — they are gitignored here. + +Workflow: +- Store configs gpg-encrypted only: =gpg -e --default-recipient-self wg-XX.conf= + produces =wg-XX.conf.gpg=, safe to track in a public repo. +- The installer decrypts =*.conf.gpg= to a private temp dir at import time, + imports, then wipes the plaintext. (Re-architecture tracked in todo.org.) + +History note: three plaintext configs were committed 2026-07-05 (c7b7d16) and +were publicly exposed until 2026-07-20, when the keys were rotated at Proton +and the files were purged from history. -- cgit v1.2.3