33 lines
1.4 KiB
Markdown
33 lines
1.4 KiB
Markdown
Secrets & deployment
|
|
|
|
This repository contained a committed Google service account and a local `.env` file with private keys. Those files were removed from the repository.
|
|
|
|
How to provide credentials securely in your environment:
|
|
|
|
Options (pick one):
|
|
|
|
1) Set `GOOGLE_APPLICATION_CREDENTIALS` to the path of a service account JSON file on the host (do NOT commit the file):
|
|
|
|
- Upload the JSON to a secure location on the host (e.g. `/etc/secrets/gitea-sync-sa.json`) and set:
|
|
|
|
export GOOGLE_APPLICATION_CREDENTIALS=/etc/secrets/gitea-sync-sa.json
|
|
|
|
2) Set `GOOGLE_SERVICE_ACCOUNT_JSON` to the full JSON string (base64 encoding recommended):
|
|
|
|
- Encode the JSON and provide it as an env var in your process manager or CI/CD secret store:
|
|
|
|
export GOOGLE_SERVICE_ACCOUNT_JSON='{"type":...}'
|
|
|
|
- For CI/CD you can store it as a secret and map it into the runtime.
|
|
|
|
3) Legacy: set `GOOGLE_PRIVATE_KEY` and `GOOGLE_SERVICE_ACCOUNT_EMAIL` separately as env vars. This is supported for backward compatibility but less convenient.
|
|
|
|
Other notes:
|
|
- Do NOT commit `.env` or service account files. Add them to project `.gitignore` (done).
|
|
- Rotate service account keys immediately if these keys were used publicly.
|
|
- Use a secret manager (AWS Secrets Manager, GCP Secret Manager, Vault) in production.
|
|
|
|
Webhook secret:
|
|
- Provide `GITEA_WEBHOOK_SECRET` as an env var in your runtime environment.
|
|
- Do NOT commit it to the repository.
|