phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI
- Remove 91 tracked-but-gitignored files from index (sessions, plugin data/manifests, pycache, memory-changes, obsidian state, credential notes). Disk files preserved via --cached. - Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm, 13 credential note paths. - Remove filename-blacklist ignore patterns (**/*password*.md etc.) that caught nothing and misfired on normal notes. - Add .scripts/verify-vault.mjs: scans git-tracked files for key patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE KEY) and 64-char hex in plugin .json files. - Add verifier step to CI lint workflow before dependency install.
This commit is contained in:
@@ -1,71 +0,0 @@
|
||||
|
||||
|
||||
```
|
||||
create database vaultwarden;
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
CREATE USER vaultwarden WITH ENCRYPTED PASSWORD 'windysecurity';
|
||||
GRANT ALL PRIVILEGES ON DATABASE vaultwarden TO vaultwarden;
|
||||
```
|
||||
|
||||
|
||||
```bitwarden.load
|
||||
LOAD DATABASE
|
||||
FROM sqlite:///opt/vaultwarden/vw-data/db.sqlite3
|
||||
INTO postgresql://vaultwarden:windysecurity@localhost:5432/vaultwarden
|
||||
|
||||
WITH include drop, create tables, create indexes, reset sequences
|
||||
EXCLUDING TABLE NAMES LIKE '__diesel_schema_migrations'
|
||||
ALTER SCHEMA 'main' RENAME TO 'public'
|
||||
;
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
pgloader bitwarden.load
|
||||
```
|
||||
|
||||
```
|
||||
-- Grant usage and create permissions on the public schema
|
||||
GRANT USAGE ON SCHEMA public TO vaultwarden;
|
||||
GRANT CREATE ON SCHEMA public TO vaultwarden;
|
||||
|
||||
-- Optionally, grant all permissions on the public schema
|
||||
GRANT ALL ON SCHEMA public TO vaultwarden;
|
||||
|
||||
-- Transfer ownership of the public schema to vaultwarden (optional)
|
||||
ALTER SCHEMA public OWNER TO vaultwarden;
|
||||
|
||||
```
|
||||
|
||||
|
||||
```.env
|
||||
DOMAIN="https://auth.wsvc.info/"
|
||||
DATABASE_URL=postgresql://vaultwarden:windysecurity@172.18.0.1:5432/vaultwarden
|
||||
SMTP_HOST=smtp.windy.me
|
||||
SMTP_FROM=<vnet@windy.me>
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURITY=starttls
|
||||
SMTP_USERNAME=vnet@windy.me
|
||||
SMTP_PASSWORD=windyboy2006
|
||||
```
|
||||
|
||||
```admin token
|
||||
i8aHqBZvgTjCoHKRqMqHxmbFs3JFwWnrzPuub09sUnYKTfwZ7m1VCKXABlSxRkJ6
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
echo -n "VjoM4sndg4.8uCzPmodH" | argon2 "$(openssl rand -base64 32)" -e -id -k 19456 -t 2 -p 1
|
||||
```
|
||||
|
||||
```
|
||||
$argon2id$v=19$m=19456,t=2,p=1$eXhRMTBiVXRjR2pFalpRYStCQys1SmtkaGVONTFJWm9HQmNMVDg2ZGlkVT0$ssdf1xrdTwXP7S7xoRiams1R3nGeSS3dkuKcPD/sO90
|
||||
```
|
||||
|
||||
```
|
||||
ADMIN_TOKEN='$argon2id$v=19$m=65540,t=3,p=4$d3Pa5o/TrvEhaVvj/bypWSnBqIFjU/rqkRV+Th7KmHU$ZDwdhqyIrTTvnAsIAUURjN3t3bgNWJfEh8Mv2cY0gUs'
|
||||
```
|
||||
@@ -1,18 +0,0 @@
|
||||
|
||||
|
||||
|
||||
release token:
|
||||
```
|
||||
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
|
||||
```
|
||||
|
||||
|
||||
zeroclaw:
|
||||
```
|
||||
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
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
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
|
||||
```
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user