# Secrets Checklist – Never Commit

Before pushing to git, ensure these are **only** in `.env` (gitignored):

| Variable | Used by | Example |
|----------|---------|---------|
| `ACME_EMAIL` | Traefik | Your email for Let's Encrypt |
| `PIHOLE_PASSWORD` | Pi-hole | Web UI password |
| `TRAEFIK_AUTH_USERS` | traefik/dynamic.yml | `htpasswd -nb user pass` |
| `WOL_API_USER` / `WOL_API_PASS` | Dashboard, WOL API | Basic auth |
| `WOL_DEVICES` | WOL API | `desktop:MAC:IP` format |
| `DRONE_GITEA_CLIENT_ID` / `SECRET` | Drone | OAuth from Gitea |
| `DRONE_RPC_SECRET` | Drone | `openssl rand -hex 16` |
| `DRONE_ADMIN_USER` | Drone | Your Gitea username |
| `CUPSADMIN` / `CUPSPASSWORD` | CUPS | Printer admin |
| `WEATHER_API_KEY` / `WEATHER_CITY` | Dashboard | OpenWeatherMap (optional) |

**Files always gitignored:** `.env`, `traefik/dynamic.yml`, `traefik/letsencrypt/`, data dirs (gitea, pihole, etc.)

**Verify before push:** `git status` – `.env` and `traefik/dynamic.yml` must not appear.