wangjia
7d89ec9d91
- domains.md: 四组域名隔离登记 + 冷备池 ≥5 + 启用流程（不含身份信息） - cdn/terraform: Cloudflare 配置即代码（WAF/bot/速率限制/代理DNS/回源鉴权注入）+ 30min 重放 Runbook - server/internal/originauth: 回源鉴权中间件，非 CDN 网段或鉴权头不符一律 403，支持双值轮换 - tools/endpoint-signer: 离线 Ed25519 签名 CLI（端点 + 公告文档，单调版本防回滚，key_id 双公钥轮换） - tools/publish-mirrors: ≥3 镜像发布 + hash 一致性校验 + 故障转移取回 - CLIENT-CONTRACT.md: schema/验签/防回滚/合并/兜底链/channel 客户端契约 - 出站独立出口要求写入部署文档；私钥/token/身份信息一律不入库 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
765 B
Plaintext
43 lines
765 B
Plaintext
# ---> AL
|
|
.vscode/*
|
|
!.vscode/settings.json
|
|
!.vscode/tasks.json
|
|
!.vscode/launch.json
|
|
!.vscode/extensions.json
|
|
*.code-workspace
|
|
|
|
# Local History for Visual Studio Code
|
|
.history/
|
|
*.app
|
|
.snapshots/*
|
|
|
|
# 密钥与渲染产物 —— 绝不入库
|
|
deploy/secrets/
|
|
deploy/xray/config.json
|
|
deploy/singbox/config.json
|
|
|
|
# 备份系统密钥（age 私钥、AWS 凭据）—— 绝不入库
|
|
deploy/backup/backup.env
|
|
*.age-private*
|
|
age-keypair.txt
|
|
|
|
# infra/domains —— 签名私钥与发布产物绝不入库（公钥可入库）
|
|
*.ed25519.key
|
|
infra/domains/tools/_publish/
|
|
infra/domains/tools/_smoke/
|
|
|
|
# Terraform —— state/tfvars/缓存绝不入库
|
|
**/.terraform/
|
|
*.tfstate
|
|
*.tfstate.*
|
|
*.tfvars
|
|
!*.tfvars.example
|
|
*.tfplan
|
|
tf.plan
|
|
crash.log
|
|
|
|
# 杂项
|
|
.DS_Store
|
|
*.log
|
|
*.bak
|