operations

🔒 Security and Publication Policy

Public-source allowlist, hard blocklist, and service hardening rules for wiki.moincraft.de.

Allowlist#

Public wiki content may use:

curated Markdown/docs: root AGENTS.md, docs/*.md, moincraft/docs/*.md, non-secret moincraft/*.md, airi/AGENTS.md, nexus-dash/AGENTS.md;
safe structured summaries: nexus-dash/data/skills.json, profiles.json, kanban.json;
public/static service facts: manifest/index.html, moincraft/docs/moincraft-stack-cheatsheet.md.

Never publish or parse into public pages:

.env, .env.*, API key values, tokens, passwords, RCON credentials;
Hermes auth state, pairing state, sessions, private memories, raw logs;
.hermes, .omp, .config, .npm, .cursor*, hidden runtime state;
SQLite DBs, *.db, *.sqlite, *-wal, *-shm;
public/, dist/, .svelte-kit/, resources/_gen/, caches, generated indexes except when inspecting outputs.

Relay :55667 and dashboard :55666 carry API/Socket.IO traffic; protect them with TLS/auth if exposed beyond LAN.
Set a dashboard API token for mutating relay REST endpoints when exposed through an operator boundary.
Prismarine viewer :55669 has no built-in auth; protect it with VPN/firewall or reverse proxy auth.
RCON belongs on localhost or a trusted private network; never expose it publicly without a VPN/firewall allowlist.
Discord access is keyboard-equivalent local control for allowlisted users; treat bot tokens and launcher secrets like SSH keys.

Say what exists and how to operate it. Do not reveal credentials, private session contents, private memory, or raw operational secrets.

Sources: root AGENTS.md, moincraft/docs/security-hardening.md, OMP/Discord docs.