gitea-sheets-sync/SECRETS.md

Secrets & deployment

This repository contained a committed Google service account and a local .env file with private keys. Those files were removed from the repository.

How to provide credentials securely in your environment:

Options (pick one):

1. Set GOOGLE_APPLICATION_CREDENTIALS to the path of a service account JSON file on the host (do NOT commit the file):

   • Upload the JSON to a secure location on the host (e.g. /etc/secrets/gitea-sync-sa.json) and set:

     export GOOGLE_APPLICATION_CREDENTIALS=/etc/secrets/gitea-sync-sa.json

2. Set GOOGLE_SERVICE_ACCOUNT_JSON to the full JSON string (base64 encoding recommended):

   • Encode the JSON and provide it as an env var in your process manager or CI/CD secret store:

     export GOOGLE_SERVICE_ACCOUNT_JSON='{"type":...}'

   • For CI/CD you can store it as a secret and map it into the runtime.

3. Legacy: set GOOGLE_PRIVATE_KEY and GOOGLE_SERVICE_ACCOUNT_EMAIL separately as env vars. This is supported for backward compatibility but less convenient.

Other notes:

• Do NOT commit .env or service account files. Add them to project .gitignore (done).
• Rotate service account keys immediately if these keys were used publicly.
• Use a secret manager (AWS Secrets Manager, GCP Secret Manager, Vault) in production.

Webhook secret:

• Provide GITEA_WEBHOOK_SECRET as an env var in your runtime environment.
• Do NOT commit it to the repository.