phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI

- Remove 91 tracked-but-gitignored files from index (sessions, plugin
  data/manifests, pycache, memory-changes, obsidian state, credential
  notes). Disk files preserved via --cached.
- Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm,
  13 credential note paths.
- Remove filename-blacklist ignore patterns (**/*password*.md etc.)
  that caught nothing and misfired on normal notes.
- Add .scripts/verify-vault.mjs: scans git-tracked files for key
  patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE
  KEY) and 64-char hex in plugin .json files.
- Add verifier step to CI lint workflow before dependency install.
This commit is contained in:
windyboy
2026-09-26 11:31:48 +08:00
parent acca28b2dd
commit 652bdbc364
95 changed files with 91 additions and 8580 deletions
@@ -1,71 +0,0 @@
```
create database vaultwarden;
```
```
CREATE USER vaultwarden WITH ENCRYPTED PASSWORD 'windysecurity';
GRANT ALL PRIVILEGES ON DATABASE vaultwarden TO vaultwarden;
```
```bitwarden.load
LOAD DATABASE
FROM sqlite:///opt/vaultwarden/vw-data/db.sqlite3
INTO postgresql://vaultwarden:windysecurity@localhost:5432/vaultwarden
WITH include drop, create tables, create indexes, reset sequences
EXCLUDING TABLE NAMES LIKE '__diesel_schema_migrations'
ALTER SCHEMA 'main' RENAME TO 'public'
;
```
```
pgloader bitwarden.load
```
```
-- Grant usage and create permissions on the public schema
GRANT USAGE ON SCHEMA public TO vaultwarden;
GRANT CREATE ON SCHEMA public TO vaultwarden;
-- Optionally, grant all permissions on the public schema
GRANT ALL ON SCHEMA public TO vaultwarden;
-- Transfer ownership of the public schema to vaultwarden (optional)
ALTER SCHEMA public OWNER TO vaultwarden;
```
```.env
DOMAIN="https://auth.wsvc.info/"
DATABASE_URL=postgresql://vaultwarden:windysecurity@172.18.0.1:5432/vaultwarden
SMTP_HOST=smtp.windy.me
SMTP_FROM=<vnet@windy.me>
SMTP_PORT=587
SMTP_SECURITY=starttls
SMTP_USERNAME=vnet@windy.me
SMTP_PASSWORD=windyboy2006
```
```admin token
i8aHqBZvgTjCoHKRqMqHxmbFs3JFwWnrzPuub09sUnYKTfwZ7m1VCKXABlSxRkJ6
```
```
echo -n "VjoM4sndg4.8uCzPmodH" | argon2 "$(openssl rand -base64 32)" -e -id -k 19456 -t 2 -p 1
```
```
$argon2id$v=19$m=19456,t=2,p=1$eXhRMTBiVXRjR2pFalpRYStCQys1SmtkaGVONTFJWm9HQmNMVDg2ZGlkVT0$ssdf1xrdTwXP7S7xoRiams1R3nGeSS3dkuKcPD/sO90
```
```
ADMIN_TOKEN='$argon2id$v=19$m=65540,t=3,p=4$d3Pa5o/TrvEhaVvj/bypWSnBqIFjU/rqkRV+Th7KmHU$ZDwdhqyIrTTvnAsIAUURjN3t3bgNWJfEh8Mv2cY0gUs'
```
@@ -1,18 +0,0 @@
release token:
```
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
```
zeroclaw:
```
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
```
```
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
```
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff