Stéphane Tailland
80a2a27ca9
k8s/secret.yaml held the actual PostgreSQL password, Keycloak admin
password and OIDC client secrets, and .gitignore only covered .DS_Store
and *.tmp. Untrack it and ignore it, matching what infra-librechat already
does, and extend the ignore list to TLS key material.
kustomization.yaml still references the file, so the README now documents
creating it from secret.example.yaml — whose key set is identical — before
the first apply.
This only stops future leaks. The values remain in commit 6d3431c and on
the remote, so they must still be treated as compromised and rotated.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
13 lines
233 B
Plaintext
13 lines
233 B
Plaintext
.DS_Store
|
|
*.tmp
|
|
|
|
# Real secrets: only secret.example.yaml is versioned.
|
|
# k8s/kustomization.yaml still references secret.yaml, so a fresh clone must
|
|
# create it first — see README.
|
|
k8s/secret.yaml
|
|
|
|
# TLS material
|
|
*.crt
|
|
*.key
|
|
*.pem
|