sec: remove certs/cookie from tracking, parameterize LiveKit secrets, add .env.example

.env.example

@@ -1,25 +1,23 @@
-# App
+# dumpsterChat Environment Configuration
-DUMPSTER_HOST=localhost
+# Copy this file to .env and fill in your values.
-DUMPSTER_PORT=8080
+
-DUMPSTER_SECRET=*** Database
+# Server
-POSTGRES_HOST=localhost
+DUMPSTER_HOST=dumpster.dustin.coffee
-POSTGRES_PORT=5432
+DUMPSTER_SECRET=generate-a-random-secret-here
+
+# Database
 POSTGRES_USER=dumpster
-POSTGRES_PASSWORD=dumpster
+POSTGRES_PASSWORD=generate-a-random-password-here
-POSTGRES_SSLMODE=disable
+POSTGRES_DB=dumpster
-# Valkey
+
-VALKEY_URL=redis://localhost:***@example.com
+# MinIO (optional — omit for local filesystem)
-# MinIO
+MINIO_ENDPOINT=
-MINIO_ENDPOINT=minio:9000
+MINIO_ACCESS_KEY=
-MINIO_ACCESS_KEY=<generated>
+MINIO_SECRET_KEY=
-MINIO_SECRET_KEY=<gener...n
+
-# LiveKit
+# LiveKit (WebRTC / voice)
-LIVEKIT_URL=wss://livekit.your.domain
+LIVEKIT_API_KEY=generate-a-random-key-here
-LIVEKIT_API_KEY=<generated>
+LIVEKIT_API_SECRET=generate-a-random-secret-here
-LIVEKIT_API_SECRET=<gener...n
+
-# Web Push
+# Giphy (optional — for GIF search)
-VAPID_PUBLIC_KEY=<generated>
+GIPHY_API_KEY=
-VAPID_PRIVATE_KEY=<generated>
-VAPID_SUBJECT=admin@your.domain
-# Integrations
-GIPHY_API_KEY=your_giphy_api_key_here

.gitignore

@@ -46,3 +46,7 @@ steamfree
 # Tauri Android keystore (contains signing passwords)
 web/src-tauri/gen/android/keystore.properties
 
+# Secrets and certificates
+/certs/
+cookie.txt
+

docker/livekit.yaml

@@ -9,9 +9,9 @@ rtc:
     - host: turn.dustin.coffee
       port: 443
       protocol: tls
-      username: V8S6EWOU1Lqp
+      username: "${LIVEKIT_API_KEY}"
-      credential: jQRJztgWbqDn9vjMUhHZg1ooxuhiBjhk
+      credential: "${LIVEKIT_API_SECRET}"
 turn:
   enabled: false
 keys:
-  V8S6EWOU1Lqp: jQRJztgWbqDn9vjMUhHZg1ooxuhiBjhk
+  "${LIVEKIT_API_KEY}": "${LIVEKIT_API_SECRET}"