sync public allowlist from private myoffice

proxmox/sync-public.ps1

@@ -0,0 +1,161 @@
+# Sync allowlisted paths from the private repo to the public Gitea repo (no full source).
+# Usage:
+#   $env:GITEA_TOKEN = '<token>'   # optional if using SSH remote
+#   .\proxmox\sync-public.ps1 -GiteaUrl https://gitea.example.com -Owner org -Repo myoffice-public -Push
+#
+# Allowlist: proxmox/, Docker/, README.md, LICENSE (if present).
+# Never syncs MyOffice.* source, _Published, secrets, node_modules, etc.
+
+[CmdletBinding()]
+param(
+	[Parameter(Mandatory = $true)]
+	[string]$GiteaUrl,
+
+	[Parameter(Mandatory = $true)]
+	[string]$Owner,
+
+	[string]$Repo = 'myoffice-public',
+
+	[string]$Branch = 'main',
+
+	[string]$Token = $env:GITEA_TOKEN,
+
+	[string]$WorkDir = '',
+
+	[switch]$Push
+)
+
+$ErrorActionPreference = 'Stop'
+
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$repoRoot = Resolve-Path (Join-Path $scriptDir '..')
+Set-Location $repoRoot
+
+$GiteaUrl = $GiteaUrl.TrimEnd('/')
+
+if (-not $WorkDir) {
+	$WorkDir = Join-Path $env:TEMP 'myoffice-public-sync'
+}
+
+$allowDirs = @('proxmox', 'Docker')
+$allowFiles = @('README.md', 'LICENSE', 'LICENSE.md')
+$excludeNames = @('.git', '_Published', 'myoffice-publish.tar.gz', 'node_modules', 'data', '.env', 'env.local')
+
+function Test-Excluded([string]$Name) {
+	return $excludeNames -contains $Name
+}
+
+function Copy-Allowlisted {
+	param([string]$DestRoot)
+
+	foreach ($dir in $allowDirs) {
+		$src = Join-Path $repoRoot $dir
+		if (-not (Test-Path $src)) {
+			Write-Host "Skip missing dir: $dir"
+			continue
+		}
+		$dest = Join-Path $DestRoot $dir
+		if (Test-Path $dest) {
+			Remove-Item -Recurse -Force $dest
+		}
+		New-Item -ItemType Directory -Path $dest -Force | Out-Null
+
+		Get-ChildItem -Path $src -Force | Where-Object { -not (Test-Excluded $_.Name) } | ForEach-Object {
+			if ($dir -eq 'Docker' -and $_.Name -eq 'data') { return }
+			Copy-Item $_.FullName -Destination (Join-Path $dest $_.Name) -Recurse -Force
+		}
+		Write-Host "Synced $dir/"
+	}
+
+	foreach ($file in $allowFiles) {
+		$src = Join-Path $repoRoot $file
+		if (Test-Path $src) {
+			Copy-Item $src -Destination (Join-Path $DestRoot $file) -Force
+			Write-Host "Synced $file"
+		}
+	}
+
+	$publicNote = Join-Path $DestRoot 'PUBLIC.md'
+	@(
+		'# MyOffice public tree',
+		'',
+		'This repository is a **filtered** mirror for Proxmox CT install scripts and Docker demo files.',
+		'Application **source** stays in the private developer repository.',
+		'Runnable app binaries are published as **Gitea Releases** (`myoffice-publish.tar.gz`).',
+		'',
+		'See [proxmox/README.md](proxmox/README.md).',
+		''
+	) | Set-Content -Path $publicNote -Encoding utf8
+}
+
+if ($Token) {
+	$hostPart = $GiteaUrl -replace '^https://', '' -replace '^http://', ''
+	$scheme = if ($GiteaUrl -match '^http://') { 'http' } else { 'https' }
+	$remote = "${scheme}://oauth2:${Token}@${hostPart}/${Owner}/${Repo}.git"
+}
+else {
+	$remote = "${GiteaUrl}/${Owner}/${Repo}.git"
+	Write-Host "No token — using remote as-is (SSH URL recommended): $remote"
+}
+
+Write-Host "-----------------------------------------------"
+Write-Host "Sync allowlist -> $Owner/$Repo ($Branch)"
+Write-Host "WorkDir: $WorkDir"
+Write-Host "-----------------------------------------------"
+
+if (Test-Path $WorkDir) {
+	Remove-Item -Recurse -Force $WorkDir
+}
+New-Item -ItemType Directory -Path $WorkDir | Out-Null
+
+$cloned = $false
+git clone --depth 1 --branch $Branch $remote $WorkDir 2>$null
+if ($LASTEXITCODE -eq 0) {
+	$cloned = $true
+}
+
+if (-not $cloned) {
+	Write-Host "Clone failed or empty repo — initializing new git repo..."
+	git -C $WorkDir init -b $Branch
+	if ($LASTEXITCODE -ne 0) {
+		git -C $WorkDir init
+		git -C $WorkDir checkout -b $Branch 2>$null
+	}
+	git -C $WorkDir remote remove origin 2>$null
+	git -C $WorkDir remote add origin $remote
+}
+
+Get-ChildItem -Path $WorkDir -Force | Where-Object { $_.Name -ne '.git' } | ForEach-Object {
+	Remove-Item $_.FullName -Recurse -Force
+}
+
+Copy-Allowlisted -DestRoot $WorkDir
+
+git -C $WorkDir add -A
+$status = git -C $WorkDir status --porcelain
+if (-not $status) {
+	Write-Host "No changes to commit."
+}
+else {
+	git -C $WorkDir -c user.email='myoffice-sync@local' -c user.name='myoffice-sync' `
+		commit -m "sync public allowlist from private myoffice"
+	Write-Host "Committed allowlist snapshot."
+}
+
+if ($Push) {
+	Write-Host "Pushing to origin $Branch..."
+	git -C $WorkDir push -u origin "HEAD:$Branch"
+	if ($LASTEXITCODE -ne 0) {
+		throw "git push failed with exit code $LASTEXITCODE"
+	}
+	Write-Host "Pushed."
+}
+else {
+	Write-Host "Dry run (no push). Re-run with -Push to publish."
+	Write-Host "Work tree left at: $WorkDir"
+}
+
+Write-Host ""
+Write-Host "Raw base for CT install:"
+Write-Host "  $GiteaUrl/$Owner/$Repo/raw/branch/$Branch"
+Write-Host ""