diff --git a/.gitleaks.toml b/.gitleaks.toml index 8a35146..3587bd4 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -1,15 +1,6 @@ # Homelab bootstrap — gitleaks allowlist (tests, examples, placeholders) -# -# IMPORTANT: `useDefault = true` is required — without it gitleaks loads ONLY -# this file (title + allowlist) with ZERO detection rules, so it would never -# flag a real secret. Fixed 2026-07 (security-hardening track); if you're -# re-pushing this template to a repo that already had the old version, that -# repo's secret scanning was a no-op until this lands. title = "homelab gitea bootstrap" -[extend] -useDefault = true - [allowlist] description = "Test fixtures and example configs are not production secrets" paths = [ diff --git a/README.md b/README.md index 4e2a973..a512970 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,19 @@ Publish the repo root as static files (nginx `root`, Gitea pages, etc.). git push origin master ``` +## Email capture (Listmonk) + +The page has a "not ready to book" email form near the bottom that posts to Listmonk (`listmonk.levkin.ca`) via `POST /api/public/subscription`. One-time setup before it works: + +1. In Listmonk admin, create a list (e.g. `auto.levkin.ca leads`) and make sure "Enable public subscription page" is on for it. +2. Copy the list's UUID. +3. In `index.html`, replace `REPLACE_WITH_LIST_UUID` (search for it) with that UUID. +4. If Listmonk enforces a captcha on public subscriptions, the plain `fetch` call in the inline `