# Publishing the source on netdesk.space

The full source is downloadable + git-cloneable straight from the website:
- Page:     https://netdesk.space/source
- Download: https://netdesk.space/downloads/netdesk-src-latest.tar.gz (+ .zip)
- Clone:    git clone https://netdesk.space/git/netdesk.git

## How it's built (secret-safe)

1. **Export tracked files only** (never DBs/artifacts/secrets):
   `git archive HEAD` from this repo + the sibling `netdesk-native` repo
   (extracted into `netdesk/native/`).
2. **Strip internal + sensitive** files: planning/roadmap/queue docs,
   `native/certs/`, `native/docs/implementation-specs.md`, dev screenshots.
3. **Secret scan** the export (known secrets + an adversarial multi-scanner
   sweep for keys/tokens/PII/stray binaries) and scrub any hit. The real
   account password, owner email, account token and live host ID have been
   removed from source — keep it that way (they must never be committed).
4. **Package**: `.tar.gz` + `.zip` (top-level `netdesk/`) and a bare repo
   (`git clone --bare` + `git update-server-info`) for dumb-HTTP clone.

## How it's served

Static nginx locations in `/etc/nginx/conf.d/netdesk.space.conf` (see
`nginx-source.snippet`) serving `/opt/netdesk/public/{source,downloads,git}`.
Zero app-server changes; `nginx -t` + `systemctl reload nginx` (no downtime).

`source-page.html` is the download/clone landing page (served at /source/).

## GitHub-style browsing (Gitea)

The source is also browsable like GitHub — file tree, rendered README, commit
history, language stats, per-branch ZIP/TAR.GZ downloads:

- **Browse:** https://netdesk.space/git/akronlogic/netdesk
- **Clone:**  git clone https://netdesk.space/git/akronlogic/netdesk.git

Served by **Gitea** (self-hosted, latest stable) running as the systemd service
`gitea` on 127.0.0.1:3030, reverse-proxied by nginx at the `/git/` sub-path
(`ROOT_URL = https://netdesk.space/git/`). SQLite data in `/var/lib/gitea`,
config in `/etc/gitea/app.ini`. Hardened: registration disabled, anonymous
read-only, SSH/Actions/Packages off, offline mode. Admin login is in
`/root/gitea-admin.txt` (root-only) — user `ndadmin`.

### Publishing an update
Rebuild the secret-scrubbed export (see above), then push it to the Gitea repo:
```bash
cd <scrubbed-export> && git init && git add -A && git commit -m "release"
git push --force https://ndadmin:<pw>@netdesk.space/git/akronlogic/netdesk.git master
```
(Only ever push the SCRUBBED export — never the raw repo, which contains the
owner email in portal.js. Re-run the secret scan first.)