openvisengine/secrets/README.md

1.2 KiB
Executable file

secrets/ — house-account cookies (TRACKED by operator authorization)

This directory is committed to the private, self-hosted Forgejo repository (gitzcreations/openvisengine) by explicit operator authorization, so a sandbox reprovision can never wipe the house accounts. Do not publish this repository anywhere public while these files exist.

What belongs here

Netscape cookies.txt exports of the operator's "house" music-service accounts, one file per service. Stream-a-Link attaches them server-side as the shared fallback login when a visitor has no saved login of their own:

  • house-youtube-cookies.txt — YouTube / YouTube Music
  • house-soundcloud-cookies.txt — SoundCloud
  • house-spotify-cookies.txt — Spotify
  • house-apple-cookies.txt — Apple Music

Loaded by src/lib/server/house-cookies.ts: read server-side only, the status endpoint exposes booleans (never cookie contents), and a visitor's own saved login always takes precedence over the house account.

After a sandbox reset

Nothing to do — git checkout restores this directory and the app picks the files up on boot. (The 2026-11-06 reprovision lost the original files before this directory was tracked; the operator re-exports them once and they are safe from then on.)