60 lines
2.1 KiB
Markdown
60 lines
2.1 KiB
Markdown
---
|
|
title: "Task: Strip Cloudflare credentials from repo"
|
|
status: "done"
|
|
folder: "07-tasks"
|
|
tags: [task, security, cloudflare, vault]
|
|
created: "2026-07-30"
|
|
updated: "2026-07-30"
|
|
version: "1.1.0"
|
|
priority: "high"
|
|
due: "2026-07-30"
|
|
owner: "stateofshit"
|
|
---
|
|
|
|
# Task: Strip Cloudflare credentials from repo
|
|
|
|
## Done — 2026-07-30
|
|
|
|
## What was wrong
|
|
|
|
Cloudflare credentials (API token, account ID, R2 keys) were committed to the repo in `000-shit_admin/cloudflare.md`. The file was tracked in git and had a real `cfat_...` token, R2 access keys, and account ID.
|
|
|
|
## What I did
|
|
|
|
1. **Created server-only env file:** `/home/user/.env.cloudflare` (chmod 600)
|
|
- Holds `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_API_TOKEN`, R2 keys, R2 endpoint
|
|
- Load with `source /home/user/.env.cloudflare`
|
|
- Verified token active ✅ via `/tokens/verify` API
|
|
|
|
2. **Removed creds from repo:**
|
|
- `git rm --cached 000-shit_admin/cloudflare.md` (untrack, keep local)
|
|
- `rm 000-shit_admin/cloudflare.md` (delete working tree copy)
|
|
- Created new `000-shit_admin/cloudflare.md` as placeholder pointing to env file
|
|
|
|
3. **Updated `.gitignore`:**
|
|
- Added `.env`, `.env.*`, `*.env.local` (catch-all)
|
|
- Added `000-shit_admin/cloudflare.md`
|
|
- Added other secret patterns (`.key`, `.pem`, `credentials.md`)
|
|
|
|
4. **Updated docs:**
|
|
- `000-configs/tools/CLOUDFLARE_INSTRUCTIONS.md` — references env file
|
|
- `000-configs/prompts/workspace-system-prompt.md` — references env file
|
|
- `000-configs/modes/workspace-mode.md` — references env file
|
|
|
|
5. **Committed + pushed:** `cc830ac`
|
|
|
|
## Verification
|
|
|
|
- `git ls-files | grep .env` → empty ✅
|
|
- `git show HEAD:000-shit_admin/cloudflare.md | grep cfat_` → empty ✅
|
|
- `source /home/user/.env.cloudflare && curl .../tokens/verify` → `success: true` ✅
|
|
|
|
## Outstanding (user's call)
|
|
|
|
- [ ] **Rotate the API token** via Cloudflare dashboard. Old token still in git history (`e1a5b35`). Repo is private so risk is low, but rotation is cheap and clean.
|
|
- [ ] Optional: `git filter-repo` to scrub history (destructive — would need fresh PC clone)
|
|
|
|
## Commit
|
|
|
|
`cc830ac` — security: strip creds from cloudflare.md, add .env.cloudflare, gitignore secrets
|