fd0f4a0365
6d224861 came from a --no-checkout worktree whose empty index made the
commit drop every file except two. This restores 05b50d2b's full tree and
correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su
entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the
live infra was never applied from the broken commit.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
11 lines
623 B
Text
11 lines
623 B
Text
# git-crypt encrypts these at rest; the working-tree plaintext is local-only.
|
|
# gitleaks scans the staged working-tree copy and can't see that they're
|
|
# encrypted on disk in git, so allowlist by fingerprint.
|
|
stacks/recruiter-responder/secrets/privkey.pem:private-key:1
|
|
|
|
# False positives: the `curl-auth-user` rule flags `-u "admin:..."` in the
|
|
# nextcloud-todos webhook-register provisioner, but the password is a shell
|
|
# variable ($NC_ADMIN_APP_PW) resolved at apply time from Vault — no literal
|
|
# secret is committed.
|
|
stacks/nextcloud-todos/main.tf:curl-auth-user:383
|
|
stacks/nextcloud-todos/main.tf:curl-auth-user:400
|