9f819df4d9
Establish the design foundation for the heleosv2 multi-tenant hosting platform before any implementation code: - Monorepo skeleton: docs/, platform-infra/, site-templates/, deployments/, control-panel/ with orientation READMEs. - docs/: roadmap index, architecture + threat model, naming conventions, site profiles, provisioning workflow, backup & DR runbook, repo/GitOps layout, and the approved architecture plan. - docs/adr/: 9 ADRs recording the rationale for single-host Compose, Traefik edge, nginx+fpm split, shared MariaDB, ZFS-per-customer, decoupled backup streams, Forgejo, CLI-first, and SFTP-only. - Secrets hygiene: .gitignore (only *.enc.* committed) and .gitattributes (LF for scripts/Dockerfiles/YAML run on the Linux host). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
33 lines
449 B
Text
33 lines
449 B
Text
# Secrets — never commit plaintext. Use SOPS/age (*.enc.yaml is allowed).
|
|
*.env
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
secrets/
|
|
*.key
|
|
*.pem
|
|
!*.pub
|
|
|
|
# SOPS-encrypted files ARE allowed to be committed:
|
|
!*.enc.*
|
|
!*.sops.*
|
|
|
|
# Rendered runtime state that should not be tracked
|
|
deployments/**/.state/
|
|
deployments/**/data/
|
|
|
|
# OS / editor cruft
|
|
.DS_Store
|
|
Thumbs.db
|
|
*.swp
|
|
.idea/
|
|
.vscode/
|
|
|
|
# Ansible
|
|
*.retry
|
|
|
|
# Python (control-panel CLI)
|
|
__pycache__/
|
|
*.pyc
|
|
.venv/
|
|
venv/
|