fd6240772e
Documentation: - certs/README.md: Complete guide for managing nginx TLS certificates - Server cert generation (self-signed, CA-signed, Let's Encrypt) - Certificate expiry monitoring and renewal procedures - Agent certificate pinning configuration - Air-gapped deployment notes Tooling: - certs/regenerate-server-cert.sh: Bash script for cert regeneration - certs/regenerate-server-cert.ps1: PowerShell script for Windows - Both scripts backup old certs and display new thumbprint Config: - Updated .gitignore to allow cert management files (docs/scripts/config) - Private keys and actual certificates still excluded (security) Context: - User asked where to manage server-side certificate - Current cert: self-signed, CN=localhost, valid 1 year - Agents validate server cert via pinning or Windows trusted roots - Critical for mTLS client cert authentication (ADR-006) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
177 lines
3.7 KiB
Plaintext
177 lines
3.7 KiB
Plaintext
# Python
|
|
__pycache__/
|
|
*.py[cod]
|
|
*$py.class
|
|
*.so
|
|
.Python
|
|
build/
|
|
develop-eggs/
|
|
dist/
|
|
downloads/
|
|
eggs/
|
|
.eggs/
|
|
lib/
|
|
lib64/
|
|
parts/
|
|
sdist/
|
|
var/
|
|
wheels/
|
|
*.egg-info/
|
|
.installed.cfg
|
|
*.egg
|
|
|
|
# Virtual environments
|
|
venv/
|
|
ENV/
|
|
env/
|
|
.venv/
|
|
|
|
# IDE
|
|
.idea/
|
|
.vscode/*
|
|
# Share the team's launch/tasks/extensions; keep personal settings out.
|
|
!.vscode/launch.json
|
|
!.vscode/tasks.json
|
|
!.vscode/extensions.json
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
|
|
# Flask
|
|
instance/
|
|
*.db
|
|
*.sqlite
|
|
|
|
# Testing
|
|
.coverage
|
|
htmlcov/
|
|
.pytest_cache/
|
|
.tox/
|
|
|
|
# Logs
|
|
logs/
|
|
*.log
|
|
|
|
# OS
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Node/Frontend
|
|
node_modules/
|
|
frontend/dist/
|
|
*.local
|
|
|
|
# Secrets and credentials (defensive)
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
!.env.*.example
|
|
*.pem
|
|
*.key
|
|
id_rsa
|
|
id_rsa.*
|
|
*.ppk
|
|
*.p12
|
|
*.pfx
|
|
|
|
# Local/test TLS material for the dev HTTPS listener. Self-signed, per-host,
|
|
# never shipped. The container mounts these at runtime; a site provides its own.
|
|
certs/
|
|
!certs/README.md
|
|
!certs/regenerate-server-cert.sh
|
|
!certs/regenerate-server-cert.ps1
|
|
!certs/openssl.cnf
|
|
secrets.json
|
|
secrets.yaml
|
|
secrets.yml
|
|
*_secret
|
|
*_secrets
|
|
credentials.json
|
|
scripts/site_imports/wjf/idmap.json
|
|
|
|
# work-PC publication clone: bundle drop folder for the transfer pipeline
|
|
_transfer/
|
|
|
|
# Local developer scratch notes and chat handoffs - never committed
|
|
devnotes/
|
|
|
|
# docs/ prose is published to the wiki, not tracked in the product repo. The
|
|
# docs gates detect a published checkout by the ABSENCE of docs/*.md, so a
|
|
# single tracked prose file here makes CI look like an internal checkout while
|
|
# carrying almost no prose: test_there_are_docs_to_check then fails asserting
|
|
# >20 files, test_the_map_itself_is_current fails on a generated PROJECT-MAP
|
|
# that is correctly untracked, and check-gates-ran.sh fails on the resulting
|
|
# skip. That happened - DEV-BUILD-TEST.md and PLUGIN-HOOKS.md were committed in
|
|
# unrelated changes and broke the branch for days. Ignore the whole pattern
|
|
# rather than naming files one at a time, so the next authored doc cannot
|
|
# reintroduce it.
|
|
#
|
|
# Scoped to the top level on purpose: docs/notes/ prose stays tracked, and the
|
|
# gates only glob docs/*.md. docs/openapi.json is tracked (the app serves it)
|
|
# and is unaffected by a *.md rule.
|
|
docs/*.md
|
|
|
|
# Local-only authored docs (planner exports, draft decks and diagrams). Same
|
|
# reasoning as above: keep personal docs out of version control.
|
|
docs/ShopDB-Planner-Tasks.csv
|
|
docs/DRAFT--ShopDB-CSV-Import-Guide.pptx
|
|
docs/diagrams/
|
|
docs/media/
|
|
|
|
# Local-only working artifacts: DB dumps, sample/test datasets, scratch
|
|
# scripts, captured command output, generated maps/reports, vulnerability
|
|
# scan output, and staged agent publish trees. None of these are product
|
|
# source; they are developer scratch that should never enter version control.
|
|
# exports/ (merge kits, decks, catalog snapshots) stays on disk for reference
|
|
# but is not tracked.
|
|
backups/
|
|
exports/
|
|
testdata/
|
|
vuln/
|
|
agent/publish-wjf/
|
|
*.sql
|
|
shopmap.pdf
|
|
shopmap.png
|
|
agent_build.txt
|
|
agent_publish.txt
|
|
backend_out.txt
|
|
backend_out2.txt
|
|
docker_build.txt
|
|
docker_up.txt
|
|
gates_out.txt
|
|
pytest_targeted.txt
|
|
pt*.txt
|
|
alandry.py
|
|
kendry.py
|
|
|
|
# Coordinator local database and MCP state
|
|
data/
|
|
|
|
# Build artifacts - compiled agent binaries
|
|
publish/
|
|
|
|
# Project handoff artifacts and analysis reports
|
|
asset-settings-handoff/
|
|
asset-settings-handoff.zip
|
|
|
|
# Generated SBOM
|
|
sbom.cdx.json
|
|
|
|
# Deployment helper scripts (work PC specific)
|
|
deploy-agent-to-vm.cmd
|
|
start-dev.cmd
|
|
stop-dev.cmd
|
|
|
|
# Visual Studio local editor state (not product source).
|
|
.vs/
|
|
|
|
# Scratch tooling under scripts/ (catalog diff/merge helpers, docx generator).
|
|
# Not product source; developer-local utilities.
|
|
scripts/.temp/
|
|
scripts/docs/
|
|
|
|
# Claude Code personal configuration (machine-specific)
|
|
.claude/settings.json
|
|
.claude/settings.local.json
|
|
.claude/mcp-servers.json
|