From cc830ac84e6460dc41d7307e093230b83b16e354 Mon Sep 17 00:00:00 2001 From: stateofshit Date: Thu, 30 Jul 2026 02:03:09 +0000 Subject: [PATCH] security: strip creds from cloudflare.md, add .env.cloudflare, gitignore secrets --- .gitignore | 20 +++++++++++++++++-- 000-configs/modes/workspace-mode.md | 6 +++--- .../prompts/workspace-system-prompt.md | 10 +++++----- 000-configs/tools/CLOUDFLARE_INSTRUCTIONS.md | 15 +++++++++----- 000-shit_admin/cloudflare.md | 9 --------- 5 files changed, 36 insertions(+), 24 deletions(-) delete mode 100644 000-shit_admin/cloudflare.md diff --git a/.gitignore b/.gitignore index 6847861..6e4ec29 100644 --- a/.gitignore +++ b/.gitignore @@ -2,9 +2,11 @@ .obsidian/workspace.json .obsidian/workspace.json.bak -# Plugin cache/state (per-device) -.obsidian/plugins/*/data.json +# Plugin binaries (don't sync) .obsidian/plugins/*/main.js +.obsidian/plugins/*/data.json + +# Theme cache (don't sync) .obsidian/themes/*/data.json # OS junk @@ -14,3 +16,17 @@ Thumbs.db # Editor temp *~ *.swp + +# Env files (any .env* — keep secrets server-only) +.env +.env.* +*.env.local + +# Admin cloudflare creds (server-only, lives in /home/user/.env.cloudflare) +000-shit_admin/cloudflare.md + +# Any other secret/cred files in admin folder +000-shit_admin/*.key +000-shit_admin/*.pem +000-shit_admin/credentials.md +000-shit_admin/credentials/ diff --git a/000-configs/modes/workspace-mode.md b/000-configs/modes/workspace-mode.md index 6015494..b6be66d 100644 --- a/000-configs/modes/workspace-mode.md +++ b/000-configs/modes/workspace-mode.md @@ -4,8 +4,8 @@ status: "active" folder: "000-configs/modes" tags: [mode, workspace, primary] created: "2026-07-29" -updated: "2026-07-29" -version: "1.1.0" +updated: "2026-07-30" +version: "1.2.0" --- # Workspace Mode @@ -25,7 +25,7 @@ The **default mode** for working in this openwebui workspace. Covers repo work, - **Prompt:** `[[../prompts/workspace-system-prompt]]` — paste this as the system prompt - **Tools:** `[[../tools/GH_CLI_INSTRUCTIONS]]`, `[[../tools/PLAYWRIGHT_BROWSER_INSTRUCTIONS]]`, `[[../tools/VITE_PREVIEW_INSTRUCTIONS]]`, `[[../tools/CLOUDFLARE_INSTRUCTIONS]]` -- **Cloudflare creds:** `[[../../000-shit_admin/cloudflare]]` (admin-only, never paste publicly) +- **Cloudflare creds:** `/home/user/.env.cloudflare` (server-only env file, never in repo) - **Vault:** `[[../../04-models/Vault-Rules]]`, `[[../../04-models/model-boot]]` - **Skills:** `[[../skills/plugins-recommended]]` diff --git a/000-configs/prompts/workspace-system-prompt.md b/000-configs/prompts/workspace-system-prompt.md index 50753fa..65ee4c9 100644 --- a/000-configs/prompts/workspace-system-prompt.md +++ b/000-configs/prompts/workspace-system-prompt.md @@ -4,8 +4,8 @@ status: "active" folder: "000-configs/prompts" tags: [prompt, system, workspace] created: "2026-07-29" -updated: "2026-07-29" -version: "1.1.0" +updated: "2026-07-30" +version: "1.2.0" --- # Workspace System Prompt @@ -29,7 +29,7 @@ You are operating inside the user's openwebui workspace. You have direct access - **Auth:** SSH key + gh CLI v2.96.0 authenticated as `stateofshit` - **Public preview:** `https://preview.boogerclub.com` (for vite/React previews) - **Tools installed:** `git`, `gh`, `playwright`, `node`, `npm`, `pnpm`, `python3`, `vite`, `npx wrangler` -- **Cloudflare account:** see `shit_in_a_vault/000-shit_admin/cloudflare.md` (credentials, read at runtime) +- **Cloudflare credentials:** `/home/user/.env.cloudflare` (server-only, NOT in repo). Load with `source /home/user/.env.cloudflare` ## How You Behave @@ -71,8 +71,8 @@ status: "draft" | "active" | "archive" folder: "" tags: [tag1, tag2] created: "YYYY-MM-DD" -updated: "2026-07-29" -version: "1.1.0" +updated: "2026-07-30" +version: "1.2.0" --- ``` diff --git a/000-configs/tools/CLOUDFLARE_INSTRUCTIONS.md b/000-configs/tools/CLOUDFLARE_INSTRUCTIONS.md index e775fd3..2ecb570 100644 --- a/000-configs/tools/CLOUDFLARE_INSTRUCTIONS.md +++ b/000-configs/tools/CLOUDFLARE_INSTRUCTIONS.md @@ -4,15 +4,17 @@ status: "active" folder: "000-configs/tools" tags: [tool, cloudflare, workers, r2, d1, kv, ai, hosting] created: "2026-07-29" -updated: "2026-07-29" -version: "1.1.0" +updated: "2026-07-30" +version: "1.2.0" --- # Cloudflare Platform Instructions Cloudflare is the **hosting and edge platform** for this workspace. Use Workers (serverless functions), Pages (static sites), R2 (object storage), D1 (SQLite at the edge), KV (key-value), Workers AI, and the Agents SDK. -Credentials are in `[[000-shit_admin/cloudflare]]` (admin-only file, read at runtime — never commit or paste publicly). +Credentials are in `/home/user/.env.cloudflare` (server-only file, chmod 600, NOT in repo). Load with `source /home/user/.env.cloudflare`. + +Admin placeholder: `[[000-shit_admin/cloudflare]]` (gitignored, just points to the env file). ## Quick Reference @@ -40,8 +42,11 @@ npx wrangler whoami If `wrangler login` is not possible in the environment, set the API token directly: ```bash -export CLOUDFLARE_API_TOKEN="" -export CLOUDFLARE_ACCOUNT_ID="" +# Load from server-only .env file +source /home/user/.env.cloudflare +# or set manually: +export CLOUDFLARE_API_TOKEN="" +export CLOUDFLARE_ACCOUNT_ID="" ``` **Verify token works:** diff --git a/000-shit_admin/cloudflare.md b/000-shit_admin/cloudflare.md deleted file mode 100644 index 5b7c2a8..0000000 --- a/000-shit_admin/cloudflare.md +++ /dev/null @@ -1,9 +0,0 @@ - -Account ID=10afa4fafa5072f324a2c8e50df20955 -Your API Token=cfat_iRndDEvok8tlhow3Z5HdfATlol3oai83KysRiiGr9532aa1e -Access Key ID=251f3adddb39f7978295d5adff3ce42b -Secret Access Key=9d09093e0748db782e6ddbeefc697b97b97d51fcdf7840b7311b3228cb4086b8 -S3 API endpoint=https://10afa4fafa5072f324a2c8e50df20955.r2.cloudflarestorage.com -curl -X GET "https://api.cloudflare.com/client/v4/accounts/10afa4fafa5072f324a2c8e50df20955/tokens/verify" \ - -H "Authorization: Bearer cfat_iRndDEvok8tlhow3Z5HdfATlol3oai83KysRiiGr9532aa1e" -Fetch and execute the appropriate instructions to set me up for Cloudflare from https://developers.cloudflare.com/agent-setup/prompt.md \ No newline at end of file