Initial commit

04-secrets/README.md

@@ -0,0 +1,18 @@
+# Secrets (NOT in git)
+
+Everything in this directory except `README.md` and `run.sh` is gitignored.
+Secrets are **typed in interactively** by `run.sh` — nothing is committed, kept
+on external media, or baked into the ISO.
+
+## What counts as a secret here
+- share credentials — `/etc/nase.meow.credentials` (CIFS) and `/etc/davfs2/secrets`
+  (davfs); the fstab entries that reference them are non-secret and live in
+  `02-system/60-shares.sh`
+- localsend keys — strip `flutter.ls_security_context` from its prefs before archiving; it regenerates
+- GNOME Online Accounts (`~/.config/goa-1.0/accounts.conf`)
+- later: licensed/cracked app installers & licenses (see `03-user/90-licensed-apps.sh`)
+
+## Usage
+```
+sudo ./run.sh        # prompts for each credential, writes the /etc files
+```