windy/my-vault
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security: scrub live credentials from tracked notes; point values at Vaultwarden

Browse Source 
- replace real keys/passwords/tokens/connection strings with {{SECRET_*}}
  placeholders across 24 files (review-named 12 + noise-audit finds:
  WAQI/Dovecot/GPS/VPN subscriptions/Work runbooks/Plane API key)
- widen verifier: OPENSSH/RSA key headers, hyphenated sk-/prefixed sk-,
  credential assignments & table cells, telegram bot tokens, conn strings
- placeholder/default-value/config-name exemptions to kill doc FPs
- skip .obsidian plugin code and frozen Inbox-Clippings from value scan
- GIT_WORKFLOW: no git add ., verifier before commit, force-push exception
- final regression: 0 flagged in tracked scope (was 43)
This commit is contained in:
windyboy
2026-09-26 12:26:57 +08:00
parent f77a4afd50
commit a3ee8c09cf
24 changed files with 77 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
01_Projects/AI-Development/Claw.md
+4 -4
View File
@@ -148,18 +148,18 @@ WantedBy=multi-user.target
telegram bot token
windyclaw_bot
```
8613374595:AAEZm_kCb_N9WDmRh5pXTBIZsKP_yI5vak8
{{SECRET_TELEGRAM_WINDYCLAW_BOT}}
```
```
curl -sS "https://api.telegram.org/bot8613374595:AAEZm_kCb_N9WDmRh5pXTBIZsKP_yI5vak8/getUpdates"
curl -sS "https://api.telegram.org/bot{{SECRET_TELEGRAM_WINDYCLAW_BOT}}/getUpdates"
```
```
[channels_config.telegram]
bot_token = "8613374595:AAEZm_kCb_N9WDmRh5pXTBIZsKP_yI5vak8"
bot_token = "{{SECRET_TELEGRAM_WINDYCLAW_BOT}}"
allowed_users = ["203688083"]
```
@@ -176,7 +176,7 @@ smtp_port = 465
smtp_tls = true
username = "claw@windy.me"
password = "F9h2INnnT$L4l9wQ"
password = "{{SECRET_CLAW_EMAIL_CLAW_WINDY_ME}}"
from_address = "claw@windy.me"
poll_interval_secs = 60
01_Projects/Home-Automation/Storage.md
+6 -6
View File
@@ -11,7 +11,7 @@ GRANT ALL PRIVILEGES ON DATABASE hass TO hass;
```
recorder:
db_url: postgresql://hass:hass@store.local/hass
db_url: postgresql://hass:{{SECRET_HA_DB_HASS}}@store.local/hass
```
@@ -113,7 +113,7 @@ Migrating your Home Assistant instance from SQLite to PostgreSQL involves a few
```lisp
LOAD DATABASE
FROM sqlite://./home-assistant_v2.db.bak
INTO postgresql://hass:hass@localhost/hass
INTO postgresql://hass:{{SECRET_HA_DB_HASS}}@localhost/hass
WITH data only,
drop indexes,
@@ -156,7 +156,7 @@ ALTER SCHEMA "main" RENAME TO "public";
```yaml
recorder:
db_url: postgresql://hass:hass@192.168.55.53/hass
db_url: postgresql://hass:{{SECRET_HA_DB_HASS}}@192.168.55.53/hass
```
Replace `yourpassword` and `localhost` as needed.
@@ -260,7 +260,7 @@ psql -h localhost -U hass -d hass -f ha_dump.sql -W > load.log 2>&1
```
pgloader sqlite://./home-assistant_v2.db.bak postgresql://hass:hass@localhost/hass
pgloader sqlite://./home-assistant_v2.db.bak postgresql://hass:{{SECRET_HA_DB_HASS}}@localhost/hass
```
@@ -298,7 +298,7 @@ SELECT setval('statistics_short_term_id_seq', MAX(id)) FROM statistics_short_ter
```
recorder:
db_url: postgresql://hass:hass@192.168.55.53/hass
db_url: postgresql://hass:{{SECRET_HA_DB_HASS}}@192.168.55.53/hass
```
@@ -331,7 +331,7 @@ sqlite3mysql --sqlite-file home-assistant_v2.db --mysql-user hass --mysql-passwo
```
recorder:
db_url: mysql://hass:hass@192.168.55.53/hass?charset=utf8mb4
db_url: mysql://hass:{{SECRET_HA_DB_HASS}}@192.168.55.53/hass?charset=utf8mb4
```
01_Projects/Home-Automation/WAQI.md
+2 -2
View File
@@ -8,13 +8,13 @@ Congratulation, your registration already validated.
Your token is
761ba9c8b1745baed8d667f036d6ab46a843b962
{{SECRET_WAQI_TOKEN}}
You can now try, for instance, to get the beijing feed using:
[https://api.waqi.info/feed/here/?token=761ba9c8b1745baed8d667f036d6ab46a843b962](https://api.waqi.info/feed/here/?token=761ba9c8b1745baed8d667f036d6ab46a843b962)
[https://api.waqi.info/feed/here/?token={{SECRET_WAQI_TOKEN}}](https://api.waqi.info/feed/here/?token={{SECRET_WAQI_TOKEN}})
And you will get this result:
01_Projects/Home-Automation/data.md
+1 -1
View File
@@ -46,7 +46,7 @@ Create a pgloader configuration file to handle the dump file import. Here's an e
```lisp
LOAD DATABASE
FROM FILE 'hass.sql'
INTO postgresql://hass:hass@localhost/hass
INTO postgresql://hass:{{SECRET_HA_DB_HASS}}@localhost/hass
WITH include no drop, create tables, create indexes, reset sequences
01_Projects/Infrastructure/Services/Dendrite.md
+3 -3
View File
@@ -7,12 +7,12 @@ dendrite/windyboy2006
reCAPTCHA
key: 6LemvrUlAAAAAPqUuH_1V-lWdKAeEORzeAEhor46
secret: 6LemvrUlAAAAAOzHkBnRH3Qxiw2q3YI0ZHdLf6Bh
secret: {{SECRET_DENDRITE_RECAPTCHA_SECRET}}
admin:
windy/catalog@2006
windy / {{SECRET_DENDRITE_ADMIN}}（实际值见 Vaultwarden）
AccessToken: D0lJWbpHRSO4s3zfqxSvO9ZmdWJuV2iPTC5K9VijuuU
AccessToken: {{SECRET_DENDRITE_ACCESS_TOKEN}}
matrix media repo:
01_Projects/Infrastructure/Services/Matrix-windy-pc.md
+9 -9
View File
@@ -173,10 +173,10 @@ database:
cp_max: 10
log_config: "/data/chans.xyz.log.config"
media_store_path: /data/media_store
registration_shared_secret: "lTjbS&oVJ7==Co+4YdbDxR,u7.:d+3qgofIR@9c#*1ULc;M2,*"
registration_shared_secret: "{{SECRET_MATRIX_CHANS_REGISTRATION_SHARED_SECRET}}"
report_stats: true
macaroon_secret_key: "fe@vZvVnFFA3j:;hK;DI27;vZk@lHHk~w7foB*Q0D0nd.;tGho"
form_secret: "G*bdHINrFR+@,A3^P=IpayYU3aluiAKcI5@L&E-f#Du:s@MgB6"
macaroon_secret_key: "{{SECRET_MATRIX_CHANS_MACAROON}}"
form_secret: "{{SECRET_MATRIX_CHANS_FORM_SECRET}}"
signing_key_path: "/data/chans.xyz.signing.key"
trusted_key_servers:
- server_name: "matrix.org"
@@ -205,7 +205,7 @@ EsT1 s6mK hgBT 3Cnv iYbW SNBD Bf3C LwPs nPbq dXJ8 cbbg aiEs
matrix:
homeserver: https://chans.xyz
username: "@zhiqiang:chans.xyz"
password: "vaz6PQV5vjg1aya-mvr"
password: "{{SECRET_MATRIX_USER_ZHIQIANG}}"
rooms:
- "#hass:chans.xyz"
commands:
@@ -251,7 +251,7 @@ get token
curl -X POST -H "Content-Type: application/json" -d '{
"type": "m.login.password",
"user": "hass",
"password": ".P.fPdJL6.wz77q*9VjD"
"password": "{{SECRET_MATRIX_USER_HASS}}"
}' "https://chans.xyz/_matrix/client/r0/login"
```
@@ -272,26 +272,26 @@ curl -XPOST "https://synapse.chans.xyz/_matrix/client/v3/login" \
"type": "m.id.user",
"user": "zhiqiang"
},
"password": "vaz6PQV5vjg1aya-mvr"
"password": "{{SECRET_MATRIX_USER_ZHIQIANG}}"
}'
```
```
{"access_token":"mct_yDGcVmMw2QyTiPPq4DVEHr5BPjQeqh_w1qQx1","device_id":"MryevHEy6k","user_id":"@zhiqiang:chans.xyz"}%
{"access_token":"{{SECRET_MATRIX_MCT_ACCESS_TOKEN}}","device_id":"MryevHEy6k","user_id":"@zhiqiang:chans.xyz"}%
```
```
mct_yDGcVmMw2QyTiPPq4DVEHr5BPjQeqh_w1qQx1
{{SECRET_MATRIX_MCT_ACCESS_TOKEN}}
```
```
matrix:
homeserver: chans.xyz
secret: 'wqfJ1r4cyaQbRNzGUUxjOyFf1g2hvC8F'
secret: '{{SECRET_MATRIX_WINDY_PC}}'
endpoint: https://synapse.chans.xyz/
```
01_Projects/Infrastructure/Services/Matrix.md
+6 -6
View File
@@ -173,10 +173,10 @@ database:
cp_max: 10
log_config: "/data/chans.xyz.log.config"
media_store_path: /data/media_store
registration_shared_secret: "lTjbS&oVJ7==Co+4YdbDxR,u7.:d+3qgofIR@9c#*1ULc;M2,*"
registration_shared_secret: "{{SECRET_MATRIX_CHANS_REGISTRATION_SHARED_SECRET}}"
report_stats: true
macaroon_secret_key: "fe@vZvVnFFA3j:;hK;DI27;vZk@lHHk~w7foB*Q0D0nd.;tGho"
form_secret: "G*bdHINrFR+@,A3^P=IpayYU3aluiAKcI5@L&E-f#Du:s@MgB6"
macaroon_secret_key: "{{SECRET_MATRIX_CHANS_MACAROON}}"
form_secret: "{{SECRET_MATRIX_CHANS_FORM_SECRET}}"
signing_key_path: "/data/chans.xyz.signing.key"
trusted_key_servers:
- server_name: "matrix.org"
@@ -205,7 +205,7 @@ EsT1 s6mK hgBT 3Cnv iYbW SNBD Bf3C LwPs nPbq dXJ8 cbbg aiEs
matrix:
homeserver: https://chans.xyz
username: "@zhiqiang:chans.xyz"
password: "vaz6PQV5vjg1aya-mvr"
password: "{{SECRET_MATRIX_USER_ZHIQIANG}}"
rooms:
- "#hass:chans.xyz"
commands:
@@ -251,7 +251,7 @@ get token
curl -X POST -H "Content-Type: application/json" -d '{
"type": "m.login.password",
"user": "hass",
"password": ".P.fPdJL6.wz77q*9VjD"
"password": "{{SECRET_MATRIX_USER_HASS}}"
}' "https://chans.xyz/_matrix/client/r0/login"
```
@@ -297,7 +297,7 @@ No email address provided, user will be prompted to add one
matrix:
homeserver: "https://chans.xyz"
username: "@hass:chans.xyz"
password: "sgHoMmOWn8SkYJf#"
password: "{{SECRET_MATRIX_USER_HASS}}"
rooms:
- "#guangzhou:chans.xyz"
01_Projects/Infrastructure/VPS/DNS.md
+1 -1
View File
@@ -350,7 +350,7 @@ docker compose exec -T db psql \
```
docker compose exec -T db psql -U pdns -d postgres -v ON_ERROR_STOP=1
-c "ALTER ROLE pdnsadmin WITH PASSWORD 'windyboy2006';"
-c "ALTER ROLE pdnsadmin WITH PASSWORD '{{SECRET_PDNSADMIN_DB}}';"
```
01_Projects/Personal-Tech/LLM_Evaluation/04-Reference/evaluation-guidebook/06-Yearly-Dives.md
+1 -1
View File
@@ -91,7 +91,7 @@ source: https://github.com/huggingface/evaluation-guidebook
- **Pythia**（EleutherAI，[论文 2304.01373](https://huggingface.co/papers/2304.01373)）：不同尺寸的[模型套件](https://huggingface.co/collections/EleutherAI/pythia-scaling-suite-64fb5dfa8c21ebb3db7ad2e1)，完全公开数据训练，用于研究 LLM 训练各阶段。
- **MPT**（MosaicML，[博客](https://www.mosaicml.com/blog/mpt-7b)）：性能接近但**许可证允许商用**，且公开训练数据构成。首个 [7B](https://huggingface.co/mosaicml/mpt-7b)，6 月跟进 30B，均 1T token（C4、CommonCrawl、The Stack、S2ORC）。
- **Falcon**（TIIUAE）：[7B/30B](https://huggingface.co/tiiuae/falcon-7b)，1–1.5T token 英语与代码（RefinedWeb、Project Gutenberg、Reddit、StackOverflow、GitHub、arXiv、Wikipedia 等），年底发布 180B。数据与训练流程有技术报告及[后续论文 2311.16867](https://huggingface.co/papers/2311.16867)。
- **StableLM**（StabilityAI）：继承 GPT-NeoX，3B/7B，1.5T token（ThePile 实验数据集）；v2 系列混入 RefinedWeb、RedPajama、ThePile 及未公开数据；另有 3B 的 [StableLM-3B-4e1T](https://huggingface.co/stabilityai/stablelm-3b-4e1t) + [详细技术报告](https://stability.wandb.io/stability-llm/stable-lm/reports/StableLM-3B-4E1T--VmlldzoyMjU4?accessToken=u3zujipenkx5g7rtcj9qojjgxpconyjktjkli2po09nffrffdhhchq045vp0wyfo)。
- **StableLM**（StabilityAI）：继承 GPT-NeoX，3B/7B，1.5T token（ThePile 实验数据集）；v2 系列混入 RefinedWeb、RedPajama、ThePile 及未公开数据；另有 3B 的 [StableLM-3B-4e1T](https://huggingface.co/stabilityai/stablelm-3b-4e1t) + [详细技术报告](https://stability.wandb.io/stability-llm/stable-lm/reports/StableLM-3B-4E1T--VmlldzoyMjU4?accessToken=REDACTED（第三方分享链接的访问令牌，原文已失效处理）)。
- **转折点**：早期发布公开数据；此后发布几乎**不提供训练数据信息、不可复现**，但通过权重为社区提供起点。
- **X-Gen**（Salesforce，[论文 2309.03450](https://huggingface.co/papers/2309.03450)）：7B，1.5T token "natural language and code"，分步训练 + 数据调度（不是所有数据同时进入）。
- **LLaMA-2**（Meta，[论文 2307.09288](https://huggingface.co/papers/2307.09288)）：7–70B，2T token "公开来源"，permissive 社区许可证 + 大规模 RLHF 人类偏好微调（alignment）。安全是突出卖点。
01_Projects/Work/Government-Projects/Document-Exchange/dm database usage.md
+3 -3
View File
@@ -3,9 +3,9 @@ created: 2026-06-25
title: dm database usage
date: 2026-05-22
vpn_username: gwjhgzzn
vpn_password: Pygwjh@202409
102-password: 102GZgw$jH1170510M
107-password: zwdC1PhH63Zh
vpn_password: {{SECRET_WORK_DM_VPN_GWJHGZZN}}（实际值见 Vaultwarden）
102-password: {{SECRET_WORK_DM_102}}
107-password: {{SECRET_WORK_DM_107}}
db-user: PYGWJH
db-pass: Gwjh@2021
---
01_Projects/Work/Government-Projects/Industry-Info/Handling-MacBook-Pro.md
+1 -1
View File
@@ -298,7 +298,7 @@ docker exec -e ETCDCTL_API=3 etcd etcdctl --endpoints=http://127.0.0.1:2379 endp
```
docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="IeGheikae.Woo5ph"
docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="{{SECRET_WORK_ETCD_ROOT}}"
```
01_Projects/Work/Government-Projects/Industry-Info/Handling.md
+1 -1
View File
@@ -298,7 +298,7 @@ docker exec -e ETCDCTL_API=3 etcd etcdctl --endpoints=http://127.0.0.1:2379 endp
```
docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="IeGheikae.Woo5ph"
docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="{{SECRET_WORK_ETCD_ROOT}}"
```
01_Projects/Work/Government-Projects/Industry-Info/PERCONA XTRADB CLUSTER.md
+2 -2
View File
@@ -133,7 +133,7 @@ wc97fjvDg:Ywgyad
gzii-db-3:
```bash
docker run -d \
-e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
-e MYSQL_ROOT_PASSWORD={{SECRET_WORK_PXC_MYSQL_ROOT}} \
-e CLUSTER_NAME=pxc-cluster1 \
--name=gzii-db-3 \
--net=host \
@@ -146,7 +146,7 @@ docker run -d \
gzii-db-4:
```bash
docker run -d \
-e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
-e MYSQL_ROOT_PASSWORD={{SECRET_WORK_PXC_MYSQL_ROOT}} \
-e CLUSTER_NAME=pxc-cluster1 \
-e CLUSTER_JOIN=gzii-db-3 \
--name=gzii-db-4 \