──────

### Summary of Changes 1. Documentation Consolidation: • Relocated the docs/ folder and all repository .md files (README.md, DEPLOYMENT.md, DOCKER_README.md, DOMAINS_README.md, GETTING_STARTED.md, CI_CD_PORTAINER_GUIDE.md, ADMIN_DEPLOYMENT_SUMMARY.md, SECURITY_PRIVATE_FILES.md, handoff.md, azure-project-plan.md, plus service-specific READMEs) into . • Updated document links in README.md. 2. AI Agent Project Map: • Created PROJECT_MAP.md in the project root containing complete architecture diagrams, service specs, ports, DB schemas, environment variables, and developer workflows. • Added PROJECT_MAP.md to .gitignore. 3. Monitoring UI & Infrastructure Integration: • Added monitoring_ui service to docker-compose.yml (port 5175). • Configured Gitea workflow docker-build.yml for monitoring_ui builds. • Added CORS middleware headers in index.js. • Added nginx.conf copy step in Dockerfile. ────── ### Recommended Commit Message docs: consolidate project documentation into monitoring_ui and add agent project map - Move all markdown documentation files and docs/ folder into monitoring_ui/docs/ - Update documentation hub index (monitoring_ui/docs/README.md) with relative paths - Generate comprehensive AI agent reference map (PROJECT_MAP.md) in repository root - Add PROJECT_MAP.md and monitoring_ui build output/env overrides to .gitignore - Integrate monitoring_ui service into docker-compose.yml and Gitea CI workflow - Configure CORS handling in employee_api for monitoring dashboard access ────── ### Alternative Short Commit Message refactor(docs): move docs to monitoring_ui and create AI agent PROJECT_MAP.md
2026-09-20 23:33:55 +02:00
parent f935bbeb8c
commit 635a130f0b
195 changed files with 28309 additions and 957 deletions
@@ -0,0 +1,122 @@
+# Security: Private Files Exclusion
+
+This document explains which files are kept private and why.
+
+## Files Excluded from Git & Docker
+
+### Deployment Documentation (Private)
+
+- `ADMIN_DEPLOYMENT_SUMMARY.md` - Internal deployment status and setup details
+- `CI_CD_PORTAINER_GUIDE.md` - Private CI/CD and Portainer configuration
+- `DEPLOYMENT.md` - Deployment procedures and configuration guidance
+- `GETTING_STARTED.md` - Internal setup instructions
+- `INTERNAL_*.md` - Any file prefixed with INTERNAL\_ (pattern-based exclusion)
+- `SETUP_*.md` - Any file prefixed with SETUP\_ (pattern-based exclusion)
+- `DEPLOY_*.md` - Any file prefixed with DEPLOY\_ (pattern-based exclusion)
+
+### Custom Instruction Files (Private)
+
+- `.instructions.md` - GitHub Copilot custom instructions
+- `.prompt.md` - Custom prompt templates
+- `.agent.md` - Custom agent definitions
+- `SKILL.md` - Custom skill definitions
+- `copilot-instructions.md` - Extended Copilot instructions
+- `AGENTS.md` - Agent configuration
+
+These are kept private to prevent exposure of:
+
+- Development workflow details
+- Copilot customization strategies
+- Internal coding guidelines and preferences
+- Prompt engineering techniques
+
+### Private Scripts
+
+- `scripts/private/` - Directory for private deployment scripts
+- `scripts/*.local.*` - Local-specific script configurations
+
+## Files Included in Public Repo
+
+### Public Documentation
+
+- `README.md` - Main project documentation
+- `DOCKER_README.md` - Docker usage documentation
+- `admin_ui/README.md` - Admin UI documentation
+- `admin_ui/SCHEDULE_API.md` - Public API documentation
+- `transit_api/README.md` - API documentation
+- `deprecated/README.md` - Legacy Flutter bus terminal documentation kept for historical reference
+
+### Configuration
+
+- `.env.example` - Environment variable template (no secrets)
+- `.gitignore` - Git exclusion rules
+- `.dockerignore` - Docker build exclusion rules
+- `docker-compose.yml` - Service composition
+- `Dockerfile` files - Container definitions
+
+### Code & Configuration
+
+- All source code in `auth_api/`, `transit_api/`, `employee_api/`, `admin_ui/`, and the legacy `deprecated/` app
+- `package.json` files (no secrets, only dependencies)
+- GitHub Actions workflows in `.github/workflows/`
+
+## Environment Variables - NEVER Commit
+
+Always keep the following OUT of git:
+
+- `.env` - Local environment variables (in `.gitignore`)
+- Database credentials
+- JWT secrets
+- API keys and tokens
+- Private configuration files
+
+Use `.env.example` as a template and create local `.env` files for development.
+
+## Docker Build Security
+
+All `.dockerignore` files (root and per-service) ensure that:
+
+1. Sensitive documentation never enters Docker images
+2. Private scripts and configs are excluded from builds
+3. Only necessary source code and dependencies are included
+4. Build artifacts don't leak internal information
+
+## GitHub Actions Security
+
+The CI/CD workflow in `.github/workflows/docker-build.yml`:
+
+- Only builds from specific service directories (auth_api, transit_api, etc.)
+- Respects `.dockerignore` rules
+- Uses GitHub secrets for credentials (never hardcoded)
+- Does not include workspace documentation in pushed images
+
+## Best Practices
+
+1. **Before committing**: Check that `.env` is in `.gitignore` and local files are not staged
+2. **Before building Docker**: Verify `.dockerignore` files exclude private docs
+3. **Before pushing images**: Confirm no sensitive data is present (`docker inspect --format=...`)
+4. **Deployment**: Always use environment variables or secrets managers, never embed credentials
+5. **Documentation**: Keep public docs in `*.md` files, private docs in separately excluded files
+
+## Adding New Private Files
+
+To keep new private files out of the repo and Docker:
+
+1. Add pattern to `.gitignore`:
+
+   ```
+   MYFILE_*.md
+   new_private_thing.*
+   ```
+
+2. Add pattern to `.dockerignore` (root and per-service):
+
+   ```
+   /MYFILE_*.md
+   /new_private_thing.*
+   ```
+
+3. Verify with:
+   ```bash
+   git check-ignore -v MYFILE_something.md
+   ```