Stop tracking .env files and sanitize docker/.env.dist

.env, .env.dev, .env.prod, .env.test, and docker/.env contained real
production secrets and were tracked in git despite the Symfony
convention of keeping them local-only. Untrack them and ignore them
going forward; docker/.env.dist stays as a template but now uses
placeholder values instead of live credentials.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env

@@ -1,92 +0,0 @@
-# In all environments, the following files are loaded if they exist,
-# the latter taking precedence over the former:
-#
-#  * .env                contains default values for the environment variables needed by the app
-#  * .env.local          uncommitted file with local overrides
-#  * .env.$APP_ENV       committed environment-specific defaults
-#  * .env.$APP_ENV.local uncommitted environment-specific overrides
-#
-# Real environment variables win over .env files.
-#
-# DO NOT DEFINE PRODUCTION SECRETS IN THIS FILE NOR IN ANY OTHER COMMITTED FILES.
-# https://symfony.com/doc/current/configuration/secrets.html
-#
-# Run "composer dump-env prod" to compile .env files for production use (requires symfony/flex >=1.2).
-# https://symfony.com/doc/current/best_practices.html#use-environment-variables-for-infrastructure-configuration
-
-###> symfony/framework-bundle ###
-APP_ENV=prod
-APP_SECRET=695679907f9c3818e6924d547f872651
-TRUSTED_PROXIES=127.0.0.1,172.20.0.1,172.20.0.0/16
-TRUSTED_HOSTS=^.*$
-###< symfony/framework-bundle ###
-
-SITE_BASE_URL=https://escapepage.com
-
-###> doctrine/doctrine-bundle ###
-# Format described at https://www.doctrine-project.org/projects/doctrine-dbal/en/latest/reference/configuration.html#connecting-using-a-url
-# IMPORTANT: You MUST configure your server version, either here or in config/packages/doctrine.yaml
-#
-# DATABASE_URL="sqlite:///%kernel.project_dir%/var/data_%kernel.environment%.db"
-# DATABASE_URL="mysql://app:!ChangeMe!@127.0.0.1:3306/app?serverVersion=8.0.32&charset=utf8mb4"
-DB_DRIVER=pdo_mysql
-DB_SERVER_VERSION=8.0.32
-DB_CHARSET=utf8mb4
-DB_USER=escapepage
-DB_PASSWORD=Zr1aOYU5NpCbS3dhpxa64cZp
-DB_HOST=database
-DB_PORT=3306
-DB_NAME=escapepage
-MYSQL_ROOT_PASSWORD=root
-DATABASE_URL="${DB_DRIVER}://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME}?serverVersion=${DB_SERVER_VERSION}&charset=${DB_CHARSET}"
-###< doctrine/doctrine-bundle ###
-
-###> symfony/messenger ###
-# Choose one of the transports below
-# MESSENGER_TRANSPORT_DSN=amqp://guest:guest@localhost:5672/%2f/messages
-# MESSENGER_TRANSPORT_DSN=redis://localhost:6379/messages
-MESSENGER_TRANSPORT_DSN=doctrine://default?auto_setup=0
-###< symfony/messenger ###
-
-###> symfony/mailer ###
-# Development: use Mailpit (docker compose override provides service `mailer` on port 1025)
-BREVO_API_KEY=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
-MAILER_DSN=brevo+api://${BREVO_API_KEY}@default
-MAILER_FROM=mailer@escapepage.nl
-# Production/Stage (uncomment and set SENDGRID_API_KEY in real env or secrets):
-# MAILER_DSN=sendgrid+api://%env(SENDGRID_API_KEY)%
-# Alternatively, via SMTP (no extra package needed):
-# MAILER_DSN="smtp://apikey:%env(SENDGRID_API_KEY)%@smtp.sendgrid.net:587?encryption=tls"
-# Optional default sender (used by test command if --from not passed):
-###< symfony/mailer ###
-
-###> symfony/sendgrid-mailer ###
-# MAILER_DSN=sendgrid://KEY@default
-###< symfony/sendgrid-mailer ###
-
-###> mercure ###
-# Internal hub URL used by the PHP app (reachable from the php container)
-MERCURE_URL=http://mercure/.well-known/mercure
-# Public hub URL used by browsers
-MERCURE_PUBLIC_URL=https://mercure.escapepage.com/.well-known/mercure
-# Shared secret for signing JWTs (dev only). In prod, set via real env/secrets.
-MERCURE_JWT_SECRET=!ChangeThisMercureJWTSignedBySymfonySecretKey!
-# Pre-generated JWT tokens for convenience
-MERCURE_PUBLISHER_JWT_TOKEN=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InB1Ymxpc2giOlsiKiJdfX0.E5b7ma4k-kA7lVGOQtICh7r2sspwX4G1iOhwtbxHQck
-MERCURE_SUBSCRIBER_JWT_TOKEN=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InN1YnNjcmliZSI6WyIqIl19fQ.mwSAjvbm6vOnjMoRSHMdcqapNCwyGZs1s57uLK4T3UM
-# CORS allowed origins (default)
-MERCURE_CORS_ALLOWED_ORIGINS="https://www.escapepage.com https://escapepage.com"
-# Base URL for Mercure topics.
-MERCURE_TOPIC_BASE=https://escapepage.com
-###< mercure ###
-
-###> docker ###
-USER_ID=1000
-GROUP_ID=1000
-###< docker ###
-
-###> karser/karser-recaptcha3-bundle ###
-# Get your API key and secret from https://g.co/recaptcha/v3
-RECAPTCHA3_KEY=6LdIvk0sAAAAAC2jMbBXtjDQC24mmNbwHWBulxFu
-RECAPTCHA3_SECRET=6LdIvk0sAAAAAE9TCGAQoczQFwR6l2dxkkwcPKsk
-###< karser/karser-recaptcha3-bundle ###

.env.dev

@@ -1,25 +0,0 @@
-###> symfony/framework-bundle ###
-APP_ENV=dev
-APP_SECRET=620e9ce5f88a714b636179eb39d5be4f
-###< symfony/framework-bundle ###
-
-###> doctrine/doctrine-bundle ###
-DB_HOST=database
-DB_PORT=3306
-DB_NAME=escapepage
-DB_USER=escapepage
-DB_PASSWORD=Zr1aOYU5NpCbS3dhpxa64cZp
-###< doctrine/doctrine-bundle ###
-
-###> symfony/mailer ###
-# Dev uses Mailpit (started via docker compose override)
-MAILER_DSN=smtp://mailer:1025
-###< symfony/mailer ###
-
-###> mercure ###
-MERCURE_URL=http://mercure/.well-known/mercure
-MERCURE_CORS_ALLOWED_ORIGINS=http://localhost:8080
-MERCURE_TOPIC_BASE=https://escapepage.dev
-MERCURE_PUBLISHER_JWT_TOKEN=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InB1Ymxpc2giOlsiKiJdfX0.E5b7ma4k-kA7lVGOQtICh7r2sspwX4G1iOhwtbxHQck
-MERCURE_SUBSCRIBER_JWT_TOKEN=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InN1YnNjcmliZSI6WyIqIl19fQ.mwSAjvbm6vOnjMoRSHMdcqapNCwyGZs1s57uLK4T3UM
-###< mercure ###

.env.prod

@@ -1,39 +0,0 @@
-APP_ENV=prod
-APP_SECRET=a8f89e179e8c338423697669d6728c2c
-
-### Compiled or real environment variables should be used in production.
-### Configure MAILER_DSN to use SendGrid API transport.
-### Prefer storing SENDGRID_API_KEY using Symfony Secrets or real env vars.
-###> symfony/mailer ###
-BREVO_API_KEY=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
-MAILER_DSN=brevo+api://${BREVO_API_KEY}@default
-MAILER_FROM=mailer@escapepage.nl
-###< symfony/mailer ###
-
-###> symfony/framework-bundle ###
-TRUSTED_PROXIES=127.0.0.1,172.20.0.1,172.20.0.0/16
-TRUSTED_HOSTS=^.*$
-###< symfony/framework-bundle ###
-
-SITE_BASE_URL=https://escapepage.com
-
-###> mercure ###
-MERCURE_URL=http://mercure/.well-known/mercure
-MERCURE_PUBLIC_URL=https://mercure.escapepage.com/.well-known/mercure
-MERCURE_JWT_SECRET=55UtgFXsZu09TSTdeIA7ljK4HUo9DLkRzEB7MD5tqOLjRfAb
-MERCURE_PUBLISHER_JWT_TOKEN=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InB1Ymxpc2giOlsiKiJdfX0.qMVdzh7buYK78e-gwCQx7v6qCxk1Js83SAEKK-GZSrI
-MERCURE_SUBSCRIBER_JWT_TOKEN=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InN1YnNjcmliZSI6WyIqIl19fQ.OCnRPXfCoke27ntAxby2R5jkgpTZdw83DPq1yhvkLbw
-MERCURE_CORS_ALLOWED_ORIGINS="https://escapepage.com"
-MERCURE_TOPIC_BASE=https://escapepage.com
-###< mercure ###
-
-DB_HOST=database
-DB_PORT=3306
-DB_NAME=escapepage
-DB_USER=escapepage
-DB_PASSWORD=Zr1aOYU5NpCbS3dhpxa64cZp
-
-###> docker ###
-USER_ID=1000
-GROUP_ID=1000
-###< docker ###

.env.test

@@ -1,18 +0,0 @@
-APP_ENV=test
-
-# define your env variables for the test env here
-KERNEL_CLASS='App\Kernel'
-APP_SECRET='$ecretf0rt3st'
-
-###> mercure ###
-MERCURE_CORS_ALLOWED_ORIGINS=http://localhost:8080
-MERCURE_TOPIC_BASE=http://test
-MERCURE_PUBLISHER_JWT_TOKEN=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InB1Ymxpc2giOlsiKiJdfX0.E5b7ma4k-kA7lVGOQtICh7r2sspwX4G1iOhwtbxHQck
-MERCURE_SUBSCRIBER_JWT_TOKEN=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InN1YnNjcmliZSI6WyIqIl19fQ.mwSAjvbm6vOnjMoRSHMdcqapNCwyGZs1s57uLK4T3UM
-###< mercure ###
-
-DB_HOST=database
-DB_PORT=3306
-DB_NAME=escapepage_test
-DB_USER=escapepage
-DB_PASSWORD="b.0nqrxJ/D*Luf9N"

.gitignore

@@ -1,5 +1,9 @@
 
 ###> symfony/framework-bundle ###
+/.env
+/.env.dev
+/.env.prod
+/.env.test
 /.env.local
 /.env.local.php
 /.env.*.local
@@ -30,3 +34,7 @@ yarn-error.log
 ###< symfony/webpack-encore-bundle ###
 
 /.idea
+
+###> docker env ###
+/docker/.env
+###< docker env ###

docker/.env

@@ -1,54 +0,0 @@
-# Docker Compose environment file — used by docker/compose.yaml.
-# Keep this in sync with the root .env and .env.prod files.
-
-###> symfony/framework-bundle ###
-APP_ENV=prod
-APP_SECRET=a8f89e179e8c338423697669d6728c2c
-TRUSTED_PROXIES=127.0.0.1,172.20.0.1,172.20.0.0/16
-TRUSTED_HOSTS=^.*$
-###< symfony/framework-bundle ###
-
-SITE_BASE_URL=https://escapepage.com
-
-###> doctrine/doctrine-bundle ###
-DB_DRIVER=pdo_mysql
-DB_SERVER_VERSION=8.0.32
-DB_CHARSET=utf8mb4
-DB_USER=escapepage
-DB_PASSWORD=Zr1aOYU5NpCbS3dhpxa64cZp
-DB_HOST=database
-DB_PORT=3306
-DB_NAME=escapepage
-MYSQL_ROOT_PASSWORD=root
-DATABASE_URL=pdo_mysql://escapepage:Zr1aOYU5NpCbS3dhpxa64cZp@database:3306/escapepage?serverVersion=8.0.32&charset=utf8mb4
-###< doctrine/doctrine-bundle ###
-
-###> symfony/messenger ###
-MESSENGER_TRANSPORT_DSN=doctrine://default?auto_setup=0
-###< symfony/messenger ###
-
-###> symfony/mailer ###
-BREVO_API_KEY=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
-MAILER_DSN=brevo+api://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@default
-MAILER_FROM=mailer@escapepage.nl
-###< symfony/mailer ###
-
-###> mercure ###
-MERCURE_URL=http://mercure/.well-known/mercure
-MERCURE_PUBLIC_URL=https://mercure.escapepage.com/.well-known/mercure
-MERCURE_JWT_SECRET=55UtgFXsZu09TSTdeIA7ljK4HUo9DLkRzEB7MD5tqOLjRfAb
-MERCURE_PUBLISHER_JWT_TOKEN=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InB1Ymxpc2giOlsiKiJdfX0.qMVdzh7buYK78e-gwCQx7v6qCxk1Js83SAEKK-GZSrI
-MERCURE_SUBSCRIBER_JWT_TOKEN=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InN1YnNjcmliZSI6WyIqIl19fQ.OCnRPXfCoke27ntAxby2R5jkgpTZdw83DPq1yhvkLbw
-MERCURE_CORS_ALLOWED_ORIGINS=https://escapepage.com
-MERCURE_TOPIC_BASE=https://escapepage.com
-###< mercure ###
-
-###> docker ###
-USER_ID=1000
-GROUP_ID=1000
-###< docker ###
-
-###> karser/karser-recaptcha3-bundle ###
-RECAPTCHA3_KEY=6LdIvk0sAAAAAC2jMbBXtjDQC24mmNbwHWBulxFu
-RECAPTCHA3_SECRET=6LdIvk0sAAAAAE9TCGAQoczQFwR6l2dxkkwcPKsk
-###< karser/karser-recaptcha3-bundle ###

docker/.env.dist

@@ -7,23 +7,23 @@ APP_ENV=prod
 SITE_BASE_URL=https://escapepage.com
 
 # Mailer
-MAILER_DSN=sendgrid://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@default
+MAILER_DSN=sendgrid://CHANGEME_SENDGRID_API_KEY@default
 MAILER_FROM=mailer@escapepage.nl
 
 # Database
-DATABASE_URL=mysql://escapepage:Zr1aOYU5NpCbS3dhpxa64cZp@database:3306/escapepage?serverVersion=8.0.32&charset=utf8mb4
+DATABASE_URL=mysql://escapepage:CHANGEME_DB_PASSWORD@database:3306/escapepage?serverVersion=8.0.32&charset=utf8mb4
 DB_NAME=escapepage
 DB_USER=escapepage
-DB_PASSWORD=Zr1aOYU5NpCbS3dhpxa64cZp
-MYSQL_ROOT_PASSWORD=root
+DB_PASSWORD=CHANGEME_DB_PASSWORD
+MYSQL_ROOT_PASSWORD=CHANGEME_MYSQL_ROOT_PASSWORD
 
 # Mercure
 MERCURE_URL=http://mercure/.well-known/mercure
 MERCURE_PUBLIC_URL=https://escapepage.com/.well-known/mercure
-MERCURE_JWT_SECRET=55UtgFXsZu09TSTdeIA7ljK4HUo9DLkRzEB7MD5tqOLjRfAb
+MERCURE_JWT_SECRET=CHANGEME_MERCURE_JWT_SECRET
 MERCURE_CORS_ALLOWED_ORIGINS=https://escapepage.com
 MERCURE_TOPIC_BASE=https://escapepage.com
 
 # Recaptcha
-RECAPTCHA3_KEY=6LdIvk0sAAAAAC2jMbBXtjDQC24mmNbwHWBulxFu
-RECAPTCHA3_SECRET=6LdIvk0sAAAAAE9TCGAQoczQFwR6l2dxkkwcPKsk
+RECAPTCHA3_KEY=CHANGEME_RECAPTCHA3_KEY
+RECAPTCHA3_SECRET=CHANGEME_RECAPTCHA3_SECRET