# Secrets (NOT in git)

Everything in this directory except `README.md` and `run.sh` is gitignored.
Secrets are **typed in interactively** by `run.sh` — nothing is committed, kept
on external media, or baked into the ISO.

## What counts as a secret here
- share credentials — `/etc/nase.meow.credentials` (CIFS) and `/etc/davfs2/secrets`
  (davfs); the fstab entries that reference them are non-secret and live in
  `02-system/60-shares.sh`
- localsend keys — strip `flutter.ls_security_context` from its prefs before archiving; it regenerates
- GNOME Online Accounts (`~/.config/goa-1.0/accounts.conf`)
- later: licensed/cracked app installers & licenses (see `03-user/90-licensed-apps.sh`)

## Usage
```
sudo ./run.sh        # prompts for each credential, writes the /etc files
```