From 5f2b0aea8b324afbb2cc0914811ef1f8e91465ab Mon Sep 17 00:00:00 2001
From: hobokenchicken <dustin@dustin.coffee>
Date: Mon, 20 Jul 2026 13:03:42 -0400
Subject: [PATCH] sec: remove certs/cookie from tracking, parameterize LiveKit
 secrets, add .env.example

---
 .env.example        | 46 ++++++++++++++++++++++-----------------------
 .gitignore          |  4 ++++
 docker/livekit.yaml |  6 +++---
 3 files changed, 29 insertions(+), 27 deletions(-)

diff --git a/.env.example b/.env.example
index 6776e83..4fc2f55 100644
--- a/.env.example
+++ b/.env.example
@@ -1,25 +1,23 @@
-# App
-DUMPSTER_HOST=localhost
-DUMPSTER_PORT=8080
-DUMPSTER_SECRET=*** Database
-POSTGRES_HOST=localhost
-POSTGRES_PORT=5432
+# dumpsterChat Environment Configuration
+# Copy this file to .env and fill in your values.
+
+# Server
+DUMPSTER_HOST=dumpster.dustin.coffee
+DUMPSTER_SECRET=generate-a-random-secret-here
+
+# Database
 POSTGRES_USER=dumpster
-POSTGRES_PASSWORD=dumpster
-POSTGRES_SSLMODE=disable
-# Valkey
-VALKEY_URL=redis://localhost:***@example.com
-# MinIO
-MINIO_ENDPOINT=minio:9000
-MINIO_ACCESS_KEY=<generated>
-MINIO_SECRET_KEY=<gener...n
-# LiveKit
-LIVEKIT_URL=wss://livekit.your.domain
-LIVEKIT_API_KEY=<generated>
-LIVEKIT_API_SECRET=<gener...n
-# Web Push
-VAPID_PUBLIC_KEY=<generated>
-VAPID_PRIVATE_KEY=<generated>
-VAPID_SUBJECT=admin@your.domain
-# Integrations
-GIPHY_API_KEY=your_giphy_api_key_here
+POSTGRES_PASSWORD=generate-a-random-password-here
+POSTGRES_DB=dumpster
+
+# MinIO (optional — omit for local filesystem)
+MINIO_ENDPOINT=
+MINIO_ACCESS_KEY=
+MINIO_SECRET_KEY=
+
+# LiveKit (WebRTC / voice)
+LIVEKIT_API_KEY=generate-a-random-key-here
+LIVEKIT_API_SECRET=generate-a-random-secret-here
+
+# Giphy (optional — for GIF search)
+GIPHY_API_KEY=
diff --git a/.gitignore b/.gitignore
index 6f848ac..34b93e6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -46,3 +46,7 @@ steamfree
 # Tauri Android keystore (contains signing passwords)
 web/src-tauri/gen/android/keystore.properties
 
+# Secrets and certificates
+/certs/
+cookie.txt
+
diff --git a/docker/livekit.yaml b/docker/livekit.yaml
index ef50a52..4058046 100644
--- a/docker/livekit.yaml
+++ b/docker/livekit.yaml
@@ -9,9 +9,9 @@ rtc:
     - host: turn.dustin.coffee
       port: 443
       protocol: tls
-      username: V8S6EWOU1Lqp
-      credential: jQRJztgWbqDn9vjMUhHZg1ooxuhiBjhk
+      username: "${LIVEKIT_API_KEY}"
+      credential: "${LIVEKIT_API_SECRET}"
 turn:
   enabled: false
 keys:
-  V8S6EWOU1Lqp: jQRJztgWbqDn9vjMUhHZg1ooxuhiBjhk
+  "${LIVEKIT_API_KEY}": "${LIVEKIT_API_SECRET}"