From a20e8c2f839fa53659f2fc3eba18645e541e753e Mon Sep 17 00:00:00 2001
From: Craig Jennings <c@cjennings.net>
Date: Mon, 20 Jul 2026 08:05:20 -0500
Subject: fix(security): stop tracking plaintext WireGuard configs

The repo is public via cgit, so the three plaintext configs (added 849c3fa)
exposed live Proton PrivateKeys. Remove them, gitignore plaintext, and document
the encrypted-only workflow. Keys rotated at Proton; history purged separately.
---
 assets/wireguard-config/.gitignore | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 assets/wireguard-config/.gitignore

(limited to 'assets/wireguard-config/.gitignore')

diff --git a/assets/wireguard-config/.gitignore b/assets/wireguard-config/.gitignore
new file mode 100644
index 0000000..d5e34ab
--- /dev/null
+++ b/assets/wireguard-config/.gitignore
@@ -0,0 +1,5 @@
+# This repo is PUBLIC (cgit at git.cjennings.net serves it unauthenticated).
+# NEVER commit plaintext WireGuard configs here — they carry live PrivateKeys.
+# Ship configs gpg-encrypted (*.conf.gpg) only; the installer decrypts at import.
+*.conf
+!*.conf.gpg
-- 
cgit v1.2.3