3f8790ffce
deployment/cloud: PocketBase (pinned, sha256-checked) as dev (/pb/, signed in; its /_/ dashboard for OIDC_ADMIN_GROUPS only) and prod (/api-prod/api/ public, dashboard never exposed), with the schema as migrations in backend/pocketbase/pb_migrations and data on the /data volume; superuser from env. admin.mjs routes /cdn/, /api-prod/, /pb/ and /admin/ behind oauth2-proxy (public: /cdn/ and /api-prod/api/ only). build-cdn.sh: flock (409 on a second build), a snapshot of the pulled commit, the public exclusions applied BEFORE the build, a heap-capped build, a check of the output that REFUSES the swap if anything excluded remains (proved with planted fixtures: a field-access file, 'Visa Requirements' content, and key-cities one level down each fail; clean passes), then an atomic swap; runtime-config.js carries the public API URL. public-exclusions.txt is the ONE list the giveaway export and the CDN build share. Any git host via REPO_URL/BRANCH/GIT_TOKEN.
23 lines
787 B
Text
23 lines
787 B
Text
# What must NEVER reach a public copy of this repo or a public build (the giveaway export and the
|
|
# container's /cdn/). ONE list, read by both: deployment/cloud/apply-exclusions.sh.
|
|
# <path> a file or folder, relative to the repo root, removed
|
|
# name:<glob> any file whose name matches (case-insensitive), anywhere, removed
|
|
# keep:<name> an exception to the name: rules
|
|
# content:<re> a regex that must not appear in any built file (checked, not removed)
|
|
.claude
|
|
.forgejo
|
|
.main-capture
|
|
.merge-queue
|
|
AGENT-BRIEF.md
|
|
_archive
|
|
data-private
|
|
library/scripts/posters/snapshots/_granular-experiment.mjs.shelved
|
|
plugin-designs/key-cities
|
|
name:*field-access*
|
|
name:*visa*.json
|
|
name:.env
|
|
name:.env.*
|
|
name:*.pem
|
|
name:*.key
|
|
keep:.env.example
|
|
content:field-access|Visa Requirements
|