chore(deploy): rewrite ansible for motief on motief.sgeboers.nl, remove drone

- Replace gtfs/bokeh deploy with motief/streamlit (port 8501) - Update inventory to motief.sgeboers.nl - Remove stale .drone.yml - Add CI guard to forbid .env in repo - Add env removal report and secrets rotation checklist
2026-03-28 20:12:36 +01:00
parent 35f4667982
commit c0d1c59bd7
6 changed files with 99 additions and 44 deletions
@@ -0,0 +1,36 @@
+---
+date: 2026-03-28
+title: "Remove .env from tracking — report"
+---
+
+Summary
+-------
+
+I removed `.env` from the repository index and added it to `.gitignore` to prevent accidental future commits. This was a non-destructive, forward-facing change — the repository history still contains prior commits that touched `.env`.
+
+What I ran
+-----------
+
+- git rm --cached .env
+- ensured `.gitignore` contains `.env`
+- committed the change: chore(secrets): stop tracking .env and add to .gitignore
+
+Commits that referenced .env
+----------------------------
+
+These commits touched `.env` in the repository history (from git log --all -- .env):
+
+- 35f4667 2026-03-28 Sven Geboers chore(secrets): stop tracking .env and add to .gitignore
+- 3551a82 2026-03-21 Sven Geboers feat(analysis): add 2D political compass and 2D trajectories
+
+Notes
+-----
+
+- The `.env` file was removed from the index but remains in historical commits. If you need to remove it from history, we can perform a history rewrite (git-filter-repo or BFG) and force-push; this is destructive and requires coordination.
+- I created a CI guard to fail builds if a `.env` file is present in the repository root (see .github/workflows/forbid-env.yml). This prevents accidental re-adding via pushes/PRs.
+
+Next steps (recommended)
+------------------------
+
+1. Rotate secrets that might have been in `.env` (see the secrets-rotation checklist next). This is mandatory if those keys were used anywhere publicly or in shared CI.
+2. If you require history purge, reply confirming and I'll prepare a filter-repo run and the exact force-push sequence.
@@ -0,0 +1,25 @@
+---
+date: 2026-03-28
+title: "Secrets rotation checklist"
+---
+
+Rotate these secrets if they were stored in `.env` or otherwise exposed:
+
+- OPENROUTER_API_KEY / OPENAI_API_KEY
+- NPM_TOKEN
+- DEPLOY SSH keys or passwords (DEPLOY_SSH_KEY, DEPLOY_PASSWORD)
+- Any database credentials, API keys, or third-party service tokens
+
+Steps
+-----
+
+1. Revoke the current tokens in each provider's dashboard.
+2. Create new tokens/keys and store them in the repository secrets (GitHub Settings → Secrets).
+3. Update any running services / CI variables to use the new tokens.
+4. If you used SSH keys and replaced them, update the authorized_keys on the VPS and remove the old key.
+
+Verification
+------------
+
+- Use CI dry-run jobs that check connectivity and token validity.
+- Run local commands that use the new tokens.