From f27387b52556571b64b391461d9be5fa0f36deb4 Mon Sep 17 00:00:00 2001
From: riricdev <riricdev@local>
Date: Sun, 6 Sep 2026 16:38:49 +0200
Subject: [PATCH] =?UTF-8?q?chore(secrets):=20retire=20les=20webhooks=20Dis?=
 =?UTF-8?q?cord=20et=20l'=C3=A9tat=20runtime=20du=20git=20avant=20h=C3=A9b?=
 =?UTF-8?q?ergement=20public?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- scripts antiflood/ipwatch/uptime-check chargent désormais leur webhook depuis
  scripts/.webhooks (gitignoré) au lieu d'un token en dur
- suppression scripts/antiflood.sh.bak-before-cpu-removal (doublon mort)
- untrack + gitignore des fichiers d'état runtime (.ipwatch-state/offset, .synbase,
  .synstate, .uptime-state) contenant des IP opérationnelles
---
 .gitignore              | 8 ++++++++
 scripts/antiflood.sh    | 4 +++-
 scripts/ipwatch.sh      | 4 +++-
 scripts/uptime-check.sh | 4 +++-
 4 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 2439cdd..fcbd3de 100644
--- a/.gitignore
+++ b/.gitignore
@@ -50,3 +50,11 @@ data/maxspeed/*.log
 
 # sensitive / personal
 duckdns_token_do_not_open.txt
+
+# secrets & runtime state (ne jamais committer)
+scripts/.webhooks
+scripts/.synbase
+scripts/.synstate
+scripts/.uptime-state
+scripts/.ipwatch-offset
+scripts/.ipwatch-state
diff --git a/scripts/antiflood.sh b/scripts/antiflood.sh
index f9878b0..9e80f0f 100755
--- a/scripts/antiflood.sh
+++ b/scripts/antiflood.sh
@@ -11,7 +11,9 @@
 # Le funnel + playit sont réactivés automatiquement quand ça redescend.
 set -u
 
-WEBHOOK="https://discord.com/api/webhooks/***REMOVED***"
+# Webhook Discord chargé depuis un fichier local gitignoré (jamais commité).
+source /home/riricdev/zektyc/scripts/.webhooks
+WEBHOOK="${ANTIFLOOD_WEBHOOK:-}"
 STATE_FILE="/home/riricdev/zektyc/scripts/.synstate"
 BASE_FILE="/home/riricdev/zektyc/scripts/.synbase"
 LOG="/var/log/zektyc-syn.log"
diff --git a/scripts/ipwatch.sh b/scripts/ipwatch.sh
index 145b87a..8aad4c9 100755
--- a/scripts/ipwatch.sh
+++ b/scripts/ipwatch.sh
@@ -18,7 +18,9 @@
 # tentatives a augmenté depuis le dernier rapport.
 set -o pipefail
 
-WEBHOOK="https://discord.com/api/webhooks/***REMOVED***"
+# Webhook Discord chargé depuis un fichier local gitignoré (jamais commité).
+source /home/riricdev/zektyc/scripts/.webhooks
+WEBHOOK="${IPWATCH_WEBHOOK:-}"
 INTERVAL=30
 STATE="/home/riricdev/zektyc/scripts/.ipwatch-state"   # IP:compteur déjà signalés
 NGINX_LOG="/var/log/nginx/access.log"
diff --git a/scripts/uptime-check.sh b/scripts/uptime-check.sh
index 1a0b877..8da6ec4 100755
--- a/scripts/uptime-check.sh
+++ b/scripts/uptime-check.sh
@@ -7,7 +7,9 @@
 set -uo pipefail
 
 URL="https://riricdev.tail5ea5cd.ts.net/"
-WEBHOOK="https://discord.com/api/webhooks/***REMOVED***"
+# Webhook Discord chargé depuis un fichier local gitignoré (jamais commité).
+source /home/riricdev/zektyc/scripts/.webhooks
+WEBHOOK="${ANTIFLOOD_WEBHOOK:-}"
 STATE_FILE="/home/riricdev/zektyc/scripts/.uptime-state"
 INTERVAL=5