From 21bac66b078357e2a7d4a2d36d3737d54687c937 Mon Sep 17 00:00:00 2001
From: arnef <dev@arnef.de>
Date: Tue, 18 Aug 2026 12:52:05 +0200
Subject: [PATCH] Untrack config.yaml, ignore it, and add config.example.yaml

config.yaml is meant to hold real, deployment-specific secrets (bcrypt
password hashes) and the public base_url, so it shouldn't be committed.
Add it to .gitignore, remove it from version control (kept locally on
disk), and check in config.example.yaml as the template to copy from.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .gitignore                         |  1 +
 README.md                          | 11 +++++++++--
 config.yaml => config.example.yaml |  0
 3 files changed, 10 insertions(+), 2 deletions(-)
 rename config.yaml => config.example.yaml (100%)

diff --git a/.gitignore b/.gitignore
index 8fce603..00e193d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 data/
+config.yaml
diff --git a/README.md b/README.md
index 150c9b4..9879ec0 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,14 @@ go run ./tools/hashpwd mysecretpassword
 # Outputs: $2b$12$...
 ```
 
-### 3. Edit `config.yaml`
+### 3. Create your `config.yaml`
+
+Copy the example config and edit it — `config.yaml` is git-ignored so your
+real credentials/domain never get committed:
+
+```bash
+cp config.example.yaml config.yaml
+```
 
 Replace the placeholder hashes with your real bcrypt hashes:
 
@@ -205,7 +212,7 @@ caldav-server/
 │   ├── store/           # filesystem storage layer
 │   └── webdav/          # WebDAV file handler
 ├── tools/hashpwd/       # bcrypt password hasher CLI
-├── config.yaml          # sample configuration
+├── config.example.yaml  # sample configuration (copy to config.yaml)
 ├── Dockerfile
 ├── docker-compose.yaml
 └── Makefile
diff --git a/config.yaml b/config.example.yaml
similarity index 100%
rename from config.yaml
rename to config.example.yaml