Scrub example config of real credentials and internal hosts #190

Merged
clawbot merged 1 commits from issue-172-scrub-example-config into next 2026-09-22 13:45:52 +02:00
Collaborator

Closes #172.

config.example.yml carried a real-looking 20-char S3 access key id and 40-char secret, a private-address http:// endpoint, and a storage_url naming an internal rclone remote and pool path. This replaces them with the same neutral placeholders the config init template (internal/cli/config.go) uses: YOUR_ACCESS_KEY / YOUR_SECRET_KEY, an https://s3.example.com endpoint, a mybucket bucket, and rclone://myremote/path/to/backups. No behavior or other config keys change; this is a documentation/hygiene scrub of the example file only.

Trap worth noting: the credentials live in the commented-out s3: block, which the config loader never parses. So the new test in internal/config/config_test.go reads the file's raw text to assert the placeholders are present and no http:// endpoint remains, and separately loads the file to confirm the active storage_url still parses and validates.

Revoking the leaked key is the owner's separate action, tracked on #73; this PR only scrubs the committed example.

make check is green.

Model: opus-4-8

Closes https://git.eeqj.de/sneak/vaultik/issues/172. `config.example.yml` carried a real-looking 20-char S3 access key id and 40-char secret, a private-address `http://` endpoint, and a `storage_url` naming an internal rclone remote and pool path. This replaces them with the same neutral placeholders the `config init` template (`internal/cli/config.go`) uses: `YOUR_ACCESS_KEY` / `YOUR_SECRET_KEY`, an `https://s3.example.com` endpoint, a `mybucket` bucket, and `rclone://myremote/path/to/backups`. No behavior or other config keys change; this is a documentation/hygiene scrub of the example file only. Trap worth noting: the credentials live in the commented-out `s3:` block, which the config loader never parses. So the new test in `internal/config/config_test.go` reads the file's raw text to assert the placeholders are present and no `http://` endpoint remains, and separately loads the file to confirm the active `storage_url` still parses and validates. Revoking the leaked key is the owner's separate action, tracked on https://git.eeqj.de/sneak/vaultik/issues/73; this PR only scrubs the committed example. `make check` is green. Model: opus-4-8
clawbot added 1 commit 2026-09-22 13:21:06 +02:00
config.example.yml carried a real-looking 20-char S3 access key id and
40-char secret, a private-address http:// endpoint, and a storage_url
naming an internal rclone remote and pool path. Replace them with the
same neutral placeholders the `config init` template uses:
YOUR_ACCESS_KEY / YOUR_SECRET_KEY, a https://s3.example.com endpoint,
a mybucket bucket, and rclone://myremote/path/to/backups. No behavior
or other keys change.

The credentials live in the commented-out s3 block, which the loader
never parses, so the new test reads the file's raw text to assert the
placeholders are present and no http:// endpoint remains, and also
loads it to confirm the active storage_url still parses.

Model: opus-4-8
clawbot added the needs-review label 2026-09-22 13:21:13 +02:00
clawbot self-assigned this 2026-09-22 13:21:13 +02:00
Author
Collaborator

PASS

Model: opus-4-8

PASS Model: opus-4-8
clawbot merged commit 238ce3985f into next 2026-09-22 13:45:52 +02:00
clawbot deleted branch issue-172-scrub-example-config 2026-09-22 13:45:52 +02:00
Sign in to join this conversation.