From e45f94be1dbb542aa5c56ad48bfd6d3fcefe990c Mon Sep 17 00:00:00 2001
From: David Roe <roed.math@gmail.com>
Date: Wed, 22 Jul 2026 02:10:41 -0400
Subject: [PATCH] Untrack config.ini; provide config.ini.example instead

config.ini was tracked at the repo root with a blank `password =` field,
while secrets.ini (the other file that can hold a password) is gitignored
with a "should not be committed!" warning. Anyone testing against a real
server fills the password in and is one `git add -A` away from committing
a credential; discovery of ./config.ini also makes the checkout's copy
silently active for any script run from the repo.

Remove it from tracking, gitignore it alongside secrets.ini, and ship a
commented config.ini.example to copy from. Tests are unaffected: conftest
builds its own throwaway config from libpq environment variables and never
reads the repo file, and CI's downstream smoke step writes its own.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitignore         |  5 ++++-
 config.ini         | 11 -----------
 config.ini.example | 16 ++++++++++++++++
 3 files changed, 20 insertions(+), 12 deletions(-)
 delete mode 100644 config.ini
 create mode 100644 config.ini.example

diff --git a/.gitignore b/.gitignore
index b8bda12..41c3653 100644
--- a/.gitignore
+++ b/.gitignore
@@ -132,4 +132,7 @@ dmypy.json
 *~
 
 # Secrets file: should not be committed to repo!
-secrets.ini
\ No newline at end of file
+secrets.ini
+# Local database configuration (may contain a password): copy
+# config.ini.example to config.ini and edit.  Should not be committed.
+config.ini
diff --git a/config.ini b/config.ini
deleted file mode 100644
index 1ac77de..0000000
--- a/config.ini
+++ /dev/null
@@ -1,11 +0,0 @@
-[logging]
-slowcutoff = 0.1
-slowlogfile = slow_queries.log
-
-[postgresql]
-host = localhost
-port = 5432
-user = postgres
-password = 
-dbname = lmfdb
-
diff --git a/config.ini.example b/config.ini.example
new file mode 100644
index 0000000..9a2a3d5
--- /dev/null
+++ b/config.ini.example
@@ -0,0 +1,16 @@
+# Example psycodict configuration.  Copy this file to config.ini and edit;
+# psycodict reads config.ini from the current directory by default (an
+# explicit config_file always wins).  The password can also be kept out of
+# this file entirely: leave it empty here and put it in secrets.ini, which
+# overrides values in this file and is never committed.
+
+[logging]
+slowcutoff = 0.1
+slowlogfile = slow_queries.log
+
+[postgresql]
+host = localhost
+port = 5432
+user = postgres
+password = 
+dbname = lmfdb