From a07b779ef4d9eed0ffedcadd0e7862cb748b3ed0 Mon Sep 17 00:00:00 2001 From: stateofshit Date: Thu, 30 Jul 2026 02:23:15 +0000 Subject: [PATCH] tasks: log cloudflare doc + creds strip work --- 000-shit_admin/dashboard.md | 4 +- .../cloudflare-tools-and-workspace-prompt.md | 65 +++++++++++++++++++ 07-tasks/security-creds-strip-from-repo.md | 59 +++++++++++++++++ 3 files changed, 126 insertions(+), 2 deletions(-) create mode 100644 07-tasks/cloudflare-tools-and-workspace-prompt.md create mode 100644 07-tasks/security-creds-strip-from-repo.md diff --git a/000-shit_admin/dashboard.md b/000-shit_admin/dashboard.md index cd76db4..31705d7 100644 --- a/000-shit_admin/dashboard.md +++ b/000-shit_admin/dashboard.md @@ -4,8 +4,8 @@ status: "active" folder: "000-shit_admin" tags: [dashboard, home] created: "2026-07-29" -updated: "2026-07-29" -version: "1.1.0" +updated: "2026-07-30" +version: "1.3.0" --- # Dashboard diff --git a/07-tasks/cloudflare-tools-and-workspace-prompt.md b/07-tasks/cloudflare-tools-and-workspace-prompt.md new file mode 100644 index 0000000..d393130 --- /dev/null +++ b/07-tasks/cloudflare-tools-and-workspace-prompt.md @@ -0,0 +1,65 @@ +--- +title: "Task: Cloudflare tool doc + workspace system prompt" +status: "done" +folder: "07-tasks" +tags: [task, cloudflare, prompt, vault] +created: "2026-07-30" +updated: "2026-07-30" +version: "1.1.0" +priority: "medium" +due: "2026-07-30" +owner: "stateofshit" +--- + +# Task: Cloudflare tool doc + workspace system prompt + +## Done — 2026-07-30 + +## What + +Built out the workspace mode for openwebui + the Cloudflare reference doc. + +## Files + +| File | Purpose | +|---|---| +| `000-configs/tools/CLOUDFLARE_INSTRUCTIONS.md` | Full Cloudflare + wrangler doc | +| `000-configs/modes/workspace-mode.md` | Workspace mode definition | +| `000-configs/prompts/workspace-system-prompt.md` | Paste-able system prompt | +| `000-configs/tools/README.md` | Updated to list Cloudflare doc | +| `.gitignore` | Added `.env*` + `cloudflare.md` rules | + +## Cloudflare doc covers + +- Workers (deploy, dev, tail, secrets) +- R2 (buckets, objects, S3-compatible API) +- D1 (SQLite at edge, migrations) +- KV (namespaces, key ops) +- Workers AI (model runs) +- Pages (static deploys) +- wrangler.jsonc config +- Local vs remote (`--remote` flag) +- Environments (staging/prod) +- Common patterns (cron, queues, Durable Objects) +- All 10 skills in `/home/user/.agents/skills/` referenced + +## System prompt covers + +- Environment (OS, paths, repos, vault) +- 10 behavior rules (terse, verify, commit, push, etc.) +- Vault folder map +- Frontmatter spec +- Common workflows (edit vault file, make repo, vite preview, Playwright, gh CLI, Cloudflare deploy) +- Failure modes to avoid + +## Commits + +- `cfc6f01` — prompts+modes: add workspace mode + system prompt +- `93e51a4` — tools: full Cloudflare doc, ref in prompts+modes +- `cc830ac` — security: strip creds, add .env.cloudflare + +## Outstanding + +- [ ] Test the system prompt in openwebui (load model, paste prompt, verify behavior) +- [ ] Optionally install `wrangler` globally on server: `npm i -g wrangler` +- [ ] PC: `git pull` to sync changes diff --git a/07-tasks/security-creds-strip-from-repo.md b/07-tasks/security-creds-strip-from-repo.md new file mode 100644 index 0000000..81bb75a --- /dev/null +++ b/07-tasks/security-creds-strip-from-repo.md @@ -0,0 +1,59 @@ +--- +title: "Task: Strip Cloudflare credentials from repo" +status: "done" +folder: "07-tasks" +tags: [task, security, cloudflare, vault] +created: "2026-07-30" +updated: "2026-07-30" +version: "1.1.0" +priority: "high" +due: "2026-07-30" +owner: "stateofshit" +--- + +# Task: Strip Cloudflare credentials from repo + +## Done — 2026-07-30 + +## What was wrong + +Cloudflare credentials (API token, account ID, R2 keys) were committed to the repo in `000-shit_admin/cloudflare.md`. The file was tracked in git and had a real `cfat_...` token, R2 access keys, and account ID. + +## What I did + +1. **Created server-only env file:** `/home/user/.env.cloudflare` (chmod 600) + - Holds `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_API_TOKEN`, R2 keys, R2 endpoint + - Load with `source /home/user/.env.cloudflare` + - Verified token active ✅ via `/tokens/verify` API + +2. **Removed creds from repo:** + - `git rm --cached 000-shit_admin/cloudflare.md` (untrack, keep local) + - `rm 000-shit_admin/cloudflare.md` (delete working tree copy) + - Created new `000-shit_admin/cloudflare.md` as placeholder pointing to env file + +3. **Updated `.gitignore`:** + - Added `.env`, `.env.*`, `*.env.local` (catch-all) + - Added `000-shit_admin/cloudflare.md` + - Added other secret patterns (`.key`, `.pem`, `credentials.md`) + +4. **Updated docs:** + - `000-configs/tools/CLOUDFLARE_INSTRUCTIONS.md` — references env file + - `000-configs/prompts/workspace-system-prompt.md` — references env file + - `000-configs/modes/workspace-mode.md` — references env file + +5. **Committed + pushed:** `cc830ac` + +## Verification + +- `git ls-files | grep .env` → empty ✅ +- `git show HEAD:000-shit_admin/cloudflare.md | grep cfat_` → empty ✅ +- `source /home/user/.env.cloudflare && curl .../tokens/verify` → `success: true` ✅ + +## Outstanding (user's call) + +- [ ] **Rotate the API token** via Cloudflare dashboard. Old token still in git history (`e1a5b35`). Repo is private so risk is low, but rotation is cheap and clean. +- [ ] Optional: `git filter-repo` to scrub history (destructive — would need fresh PC clone) + +## Commit + +`cc830ac` — security: strip creds from cloudflare.md, add .env.cloudflare, gitignore secrets