From 7f392ef9086fb0ca771c8938de4ac7feafb9cff5 Mon Sep 17 00:00:00 2001
From: Zwitschi <zwitschi82@gmail.com>
Date: Sat, 24 Oct 2026 19:50:39 +0200
Subject: [PATCH] chore(data): stop tracking runtime-refreshed whitelist seeds

The Cloudflare ips-v4/v6.txt and paloalto/.gitkeep were git-tracked. The
Cloudflare files are overwritten at runtime by every whitelist refresh, so on
a deployed server they become locally-modified tracked files that make 'git pull'
conflict. Keep the read-only paloalto/scanner-ips.txt seed tracked; ignore the
rest (they are re-downloaded if absent; built-in ranges are the fallback).
---
 .gitignore                     | 12 +++++++-----
 app/data/cloudflare/ips-v4.txt | 15 ---------------
 app/data/cloudflare/ips-v6.txt |  7 -------
 app/data/paloalto/.gitkeep     |  1 -
 4 files changed, 7 insertions(+), 28 deletions(-)
 delete mode 100644 app/data/cloudflare/ips-v4.txt
 delete mode 100644 app/data/cloudflare/ips-v6.txt
 delete mode 100644 app/data/paloalto/.gitkeep

diff --git a/.gitignore b/.gitignore
index 1bddfc2..d7ccd52 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,12 +13,14 @@ __pycache__/
 # python virtual environment
 .venv/
 
-# app runtime data (feeds, caches, scan state - regenerated each run)
-# matched per-entry (not as a directory) so the whitelist seed files
-# for Cloudflare and PaloAlto below can be re-included
+# app runtime data (feeds, caches, scan state - regenerated each run).
+# All of this must stay UNTRACKED so ``git pull`` never conflicts with files a
+# scan has written since the last pull (see .github/instructions/DEPLOYMENT.md).
+# The single allowed tracked seed is the read-only PaloAlto scanner-ips.txt
+# (never rewritten at runtime); the Cloudflare ips-*.txt are runtime-refreshed
+# downloads, so they are NOT tracked and are re-downloaded if absent.
 app/data/*
-!app/data/cloudflare/
-!app/data/paloalto/
+!app/data/paloalto/scanner-ips.txt
 
 # SQLite database (canonical store) + WAL/SHM sidecars
 app/data/*.db
diff --git a/app/data/cloudflare/ips-v4.txt b/app/data/cloudflare/ips-v4.txt
deleted file mode 100644
index 626248f..0000000
--- a/app/data/cloudflare/ips-v4.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-173.245.48.0/20
-103.21.244.0/22
-103.22.200.0/22
-103.31.4.0/22
-141.101.64.0/18
-108.162.192.0/18
-190.93.240.0/20
-188.114.96.0/20
-197.234.240.0/22
-198.41.128.0/17
-162.158.0.0/15
-104.16.0.0/13
-104.24.0.0/14
-172.64.0.0/13
-131.0.72.0/22
\ No newline at end of file
diff --git a/app/data/cloudflare/ips-v6.txt b/app/data/cloudflare/ips-v6.txt
deleted file mode 100644
index 4584f6a..0000000
--- a/app/data/cloudflare/ips-v6.txt
+++ /dev/null
@@ -1,7 +0,0 @@
-2400:cb00::/32
-2606:4700::/32
-2803:f800::/32
-2405:b500::/32
-2405:8100::/32
-2a06:98c0::/29
-2c0f:f248::/32
\ No newline at end of file
diff --git a/app/data/paloalto/.gitkeep b/app/data/paloalto/.gitkeep
deleted file mode 100644
index a84e557..0000000
--- a/app/data/paloalto/.gitkeep
+++ /dev/null
@@ -1 +0,0 @@
-$ = paloalto