Export tracked files only (never DBs/artifacts/secrets): git archive HEAD from this repo + the sibling netdesk-native repo (extracted into netdesk/native/).
Strip internal + sensitive files: planning/roadmap/queue docs, native/certs/, native/docs/implementation-specs.md, dev screenshots.
Secret scan the export (known secrets + an adversarial multi-scanner sweep for keys/tokens/PII/stray binaries) and scrub any hit. The real account password, owner email, account token and live host ID have been removed from source — keep it that way (they must never be committed).
Package: .tar.gz + .zip (top-level netdesk/) and a bare repo (git clone --bare + git update-server-info) for dumb-HTTP clone.

How it's served

Static nginx locations in /etc/nginx/conf.d/netdesk.space.conf (see nginx-source.snippet) serving /opt/netdesk/public/{source,downloads,git}. Zero app-server changes; nginx -t + systemctl reload nginx (no downtime).

source-page.html is the download/clone landing page (served at /source/).