Export tracked files only (never DBs/artifacts/secrets): git archive HEAD from this repo + the sibling netdesk-native repo (extracted into netdesk/native/).
Strip internal + sensitive files: planning/roadmap/queue docs, native/certs/, native/docs/implementation-specs.md, dev screenshots.
Secret scan the export (known secrets + an adversarial multi-scanner sweep for keys/tokens/PII/stray binaries) and scrub any hit. The real account password, owner email, account token and live host ID have been removed from source — keep it that way (they must never be committed).
Package: .tar.gz + .zip (top-level netdesk/) and a bare repo (git clone --bare + git update-server-info) for dumb-HTTP clone.

How it's served

Static nginx locations in /etc/nginx/conf.d/netdesk.space.conf (see nginx-source.snippet) serving /opt/netdesk/public/{source,downloads,git}. Zero app-server changes; nginx -t + systemctl reload nginx (no downtime).

source-page.html is the download/clone landing page (served at /source/).

GitHub-style browsing (Gitea)

The source is also browsable like GitHub — file tree, rendered README, commit history, language stats, per-branch ZIP/TAR.GZ downloads:

Browse: https://netdesk.space/git/akronlogic/netdesk
Clone: git clone https://netdesk.space/git/akronlogic/netdesk.git

Served by Gitea (self-hosted, latest stable) running as the systemd service gitea on 127.0.0.1:3030, reverse-proxied by nginx at the /git/ sub-path (ROOT_URL = https://netdesk.space/git/). SQLite data in /var/lib/gitea, config in /etc/gitea/app.ini. Hardened: registration disabled, anonymous read-only, SSH/Actions/Packages off, offline mode. Admin login is in /root/gitea-admin.txt (root-only) — user ndadmin.

Publishing an update

Rebuild the secret-scrubbed export (see above), then push it to the Gitea repo:

cd <scrubbed-export> && git init && git add -A && git commit -m "release"
git push --force https://ndadmin:<pw>@netdesk.space/git/akronlogic/netdesk.git master

(Only ever push the SCRUBBED export — never the raw repo, which contains the owner email in portal.js. Re-run the secret scan first.)