From 0e41c890f92b5510c23a9ec992e8d2c345b5b788 Mon Sep 17 00:00:00 2001
From: syntaxbullet <syntaxbullet@protonmail.com>
Date: Mon, 13 Jul 2026 12:19:45 +0200
Subject: [PATCH] chore: require clean production deploys

---
 .dockerignore          |  7 +++++++
 .gitignore             |  1 +
 docs/vps-deployment.md | 12 +++---------
 scripts/deploy-vps.sh  | 12 +++++++++---
 4 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 8d6a853..f8c5f3b 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,4 +1,8 @@
 .git
+.agents
+.codex
+.pnpm-store
+skills-lock.json
 .next
 .env
 .env.*
@@ -6,7 +10,10 @@
 .DS_Store
 node_modules
 content.db
+next-env.d.ts
 public/media
+public/robots.txt
+public/sitemap*.xml
 tsconfig.tsbuildinfo
 playwright-report
 test-results
diff --git a/.gitignore b/.gitignore
index b18dbc5..40d3d25 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 build
 dist / media
 node_modules
+.pnpm-store/
 .DS_Store
 .env
 .next
diff --git a/docs/vps-deployment.md b/docs/vps-deployment.md
index d153c28..3c992dd 100644
--- a/docs/vps-deployment.md
+++ b/docs/vps-deployment.md
@@ -75,21 +75,15 @@ pnpm deploy:vps
 
 The deploy script:
 
-1. refuses to deploy a dirty worktree by default
+1. refuses to deploy a dirty worktree
 2. rsyncs code to `/var/www/bmp-website/current`
-3. excludes `.env`, `content.db`, `public/media`, `.next`, and `node_modules`
+3. excludes runtime state, dependency caches, generated files, and local agent tooling
 4. writes the deployed Git revision to `.deploy-revision`
 5. builds the Docker image on the VPS
 6. recreates only the `bmp_website` app container
 7. verifies `/` and `/admin`
 
-If you intentionally need an ad-hoc deploy before committing:
-
-```bash
-ALLOW_DIRTY=1 pnpm deploy:vps
-```
-
-Use that sparingly. The preferred workflow is:
+The required workflow is:
 
 ```text
 commit locally -> deploy that commit -> verify production
diff --git a/scripts/deploy-vps.sh b/scripts/deploy-vps.sh
index d757a11..d43dd1d 100755
--- a/scripts/deploy-vps.sh
+++ b/scripts/deploy-vps.sh
@@ -11,7 +11,6 @@ SSH_KEY="${SSH_KEY:-$HOME/.ssh/bmp-vps-deploy}"
 APP_ROOT="${APP_ROOT:-/var/www/bmp-website}"
 APP_DOMAIN="${APP_DOMAIN:-srv1.bayerischer-mittelstandspreis.de}"
 PUBLIC_URL="${PUBLIC_URL:-https://$APP_DOMAIN}"
-ALLOW_DIRTY="${ALLOW_DIRTY:-0}"
 DEPLOY_CADDY="${DEPLOY_CADDY:-0}"
 RUN_MIGRATIONS="${RUN_MIGRATIONS:-0}"
 SKIP_VERIFY="${SKIP_VERIFY:-0}"
@@ -24,9 +23,9 @@ if [[ ! -f "$SSH_KEY" ]]; then
   exit 1
 fi
 
-if [[ "$ALLOW_DIRTY" != "1" && -n "$(git status --porcelain)" ]]; then
+if [[ -n "$(git status --porcelain)" ]]; then
   echo "Refusing to deploy a dirty worktree." >&2
-  echo "Commit or stash changes first, or run with ALLOW_DIRTY=1 for an intentional ad-hoc deploy." >&2
+  echo "Commit or stash changes first." >&2
   exit 1
 fi
 
@@ -36,13 +35,20 @@ echo "Deploying $REVISION to $SSH_TARGET:$APP_ROOT"
 
 rsync -az --delete \
   --exclude '.git/' \
+  --exclude '.agents/' \
+  --exclude '.codex/' \
+  --exclude '.pnpm-store/' \
+  --exclude 'skills-lock.json' \
   --exclude '.env' \
   --include '.env.example' \
   --exclude '.env.*' \
   --exclude '.next/' \
   --exclude 'node_modules/' \
   --exclude 'content.db' \
+  --exclude 'next-env.d.ts' \
   --exclude 'public/media/' \
+  --exclude 'public/robots.txt' \
+  --exclude 'public/sitemap*.xml' \
   --exclude '.DS_Store' \
   --exclude 'tsconfig.tsbuildinfo' \
   -e "ssh -i $SSH_KEY -p $VPS_PORT" \