Sven laptop
635a130f0b
Build and Push Docker Images / detect-changes (push) Successful in 11s
Build and Push Docker Images / build-auth-api (push) Successful in 1m0s
Build and Push Docker Images / build-employee-api (push) Successful in 1m2s
Build and Push Docker Images / build-transit-api (push) Successful in 1m1s
Build and Push Docker Images / build-error-log-api (push) Successful in 1m5s
Build and Push Docker Images / build-admin-ui (push) Successful in 1m13s
Build and Push Docker Images / build-monitoring-ui (push) Successful in 1m15s
Build and Push Docker Images / deploy-test-node (push) Successful in 3s
### Summary of Changes
1. Documentation Consolidation:
• Relocated the docs/ folder and all repository .md files (README.md, DEPLOYMENT.md, DOCKER_README.md,
DOMAINS_README.md, GETTING_STARTED.md, CI_CD_PORTAINER_GUIDE.md, ADMIN_DEPLOYMENT_SUMMARY.md,
SECURITY_PRIVATE_FILES.md, handoff.md, azure-project-plan.md, plus service-specific READMEs) into .
• Updated document links in README.md.
2. AI Agent Project Map:
• Created PROJECT_MAP.md in the project root containing complete architecture diagrams, service specs, ports, DB
schemas, environment variables, and developer workflows.
• Added PROJECT_MAP.md to .gitignore.
3. Monitoring UI & Infrastructure Integration:
• Added monitoring_ui service to docker-compose.yml (port 5175).
• Configured Gitea workflow docker-build.yml for monitoring_ui builds.
• Added CORS middleware headers in index.js.
• Added nginx.conf copy step in Dockerfile.
──────
### Recommended Commit Message
docs: consolidate project documentation into monitoring_ui and add agent project map
- Move all markdown documentation files and docs/ folder into monitoring_ui/docs/
- Update documentation hub index (monitoring_ui/docs/README.md) with relative paths
- Generate comprehensive AI agent reference map (PROJECT_MAP.md) in repository root
- Add PROJECT_MAP.md and monitoring_ui build output/env overrides to .gitignore
- Integrate monitoring_ui service into docker-compose.yml and Gitea CI workflow
- Configure CORS handling in employee_api for monitoring dashboard access
──────
### Alternative Short Commit Message
refactor(docs): move docs to monitoring_ui and create AI agent PROJECT_MAP.md
123 lines
3.9 KiB
Markdown
123 lines
3.9 KiB
Markdown
# Security: Private Files Exclusion
|
|
|
|
This document explains which files are kept private and why.
|
|
|
|
## Files Excluded from Git & Docker
|
|
|
|
### Deployment Documentation (Private)
|
|
|
|
- `ADMIN_DEPLOYMENT_SUMMARY.md` - Internal deployment status and setup details
|
|
- `CI_CD_PORTAINER_GUIDE.md` - Private CI/CD and Portainer configuration
|
|
- `DEPLOYMENT.md` - Deployment procedures and configuration guidance
|
|
- `GETTING_STARTED.md` - Internal setup instructions
|
|
- `INTERNAL_*.md` - Any file prefixed with INTERNAL\_ (pattern-based exclusion)
|
|
- `SETUP_*.md` - Any file prefixed with SETUP\_ (pattern-based exclusion)
|
|
- `DEPLOY_*.md` - Any file prefixed with DEPLOY\_ (pattern-based exclusion)
|
|
|
|
### Custom Instruction Files (Private)
|
|
|
|
- `.instructions.md` - GitHub Copilot custom instructions
|
|
- `.prompt.md` - Custom prompt templates
|
|
- `.agent.md` - Custom agent definitions
|
|
- `SKILL.md` - Custom skill definitions
|
|
- `copilot-instructions.md` - Extended Copilot instructions
|
|
- `AGENTS.md` - Agent configuration
|
|
|
|
These are kept private to prevent exposure of:
|
|
|
|
- Development workflow details
|
|
- Copilot customization strategies
|
|
- Internal coding guidelines and preferences
|
|
- Prompt engineering techniques
|
|
|
|
### Private Scripts
|
|
|
|
- `scripts/private/` - Directory for private deployment scripts
|
|
- `scripts/*.local.*` - Local-specific script configurations
|
|
|
|
## Files Included in Public Repo
|
|
|
|
### Public Documentation
|
|
|
|
- `README.md` - Main project documentation
|
|
- `DOCKER_README.md` - Docker usage documentation
|
|
- `admin_ui/README.md` - Admin UI documentation
|
|
- `admin_ui/SCHEDULE_API.md` - Public API documentation
|
|
- `transit_api/README.md` - API documentation
|
|
- `deprecated/README.md` - Legacy Flutter bus terminal documentation kept for historical reference
|
|
|
|
### Configuration
|
|
|
|
- `.env.example` - Environment variable template (no secrets)
|
|
- `.gitignore` - Git exclusion rules
|
|
- `.dockerignore` - Docker build exclusion rules
|
|
- `docker-compose.yml` - Service composition
|
|
- `Dockerfile` files - Container definitions
|
|
|
|
### Code & Configuration
|
|
|
|
- All source code in `auth_api/`, `transit_api/`, `employee_api/`, `admin_ui/`, and the legacy `deprecated/` app
|
|
- `package.json` files (no secrets, only dependencies)
|
|
- GitHub Actions workflows in `.github/workflows/`
|
|
|
|
## Environment Variables - NEVER Commit
|
|
|
|
Always keep the following OUT of git:
|
|
|
|
- `.env` - Local environment variables (in `.gitignore`)
|
|
- Database credentials
|
|
- JWT secrets
|
|
- API keys and tokens
|
|
- Private configuration files
|
|
|
|
Use `.env.example` as a template and create local `.env` files for development.
|
|
|
|
## Docker Build Security
|
|
|
|
All `.dockerignore` files (root and per-service) ensure that:
|
|
|
|
1. Sensitive documentation never enters Docker images
|
|
2. Private scripts and configs are excluded from builds
|
|
3. Only necessary source code and dependencies are included
|
|
4. Build artifacts don't leak internal information
|
|
|
|
## GitHub Actions Security
|
|
|
|
The CI/CD workflow in `.github/workflows/docker-build.yml`:
|
|
|
|
- Only builds from specific service directories (auth_api, transit_api, etc.)
|
|
- Respects `.dockerignore` rules
|
|
- Uses GitHub secrets for credentials (never hardcoded)
|
|
- Does not include workspace documentation in pushed images
|
|
|
|
## Best Practices
|
|
|
|
1. **Before committing**: Check that `.env` is in `.gitignore` and local files are not staged
|
|
2. **Before building Docker**: Verify `.dockerignore` files exclude private docs
|
|
3. **Before pushing images**: Confirm no sensitive data is present (`docker inspect --format=...`)
|
|
4. **Deployment**: Always use environment variables or secrets managers, never embed credentials
|
|
5. **Documentation**: Keep public docs in `*.md` files, private docs in separately excluded files
|
|
|
|
## Adding New Private Files
|
|
|
|
To keep new private files out of the repo and Docker:
|
|
|
|
1. Add pattern to `.gitignore`:
|
|
|
|
```
|
|
MYFILE_*.md
|
|
new_private_thing.*
|
|
```
|
|
|
|
2. Add pattern to `.dockerignore` (root and per-service):
|
|
|
|
```
|
|
/MYFILE_*.md
|
|
/new_private_thing.*
|
|
```
|
|
|
|
3. Verify with:
|
|
```bash
|
|
git check-ignore -v MYFILE_something.md
|
|
```
|