From b7a2d84b4510c00b161c8311a26b2cfa3171859c Mon Sep 17 00:00:00 2001
From: Md Bayazid  Bostame <bostame@bostame-2349.local>
Date: Sun, 29 Mar 2026 00:31:03 +0100
Subject: [PATCH] fix: preserve server env files during local deploy

---
 DEPLOYMENT.md                                               | 6 ++++++
 .../workflows/templates/workflows/developer_handbook.html   | 1 +
 scripts/deploy_test_from_mac.sh                             | 2 ++
 3 files changed, 9 insertions(+)

diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
index 2af6f36..1d39405 100644
--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -176,6 +176,12 @@ What it does:
 4. runs the remote deployment script
 5. verifies the health endpoint
 
+Important:
+- the helper preserves server-local env files:
+  - `.env.test`
+  - `.env.prod`
+- those files are not supposed to be replaced from your Mac checkout
+
 Default assumptions:
 - target host: `root@192.168.2.55`
 - target path: `/opt/workdock`
diff --git a/backend/workflows/templates/workflows/developer_handbook.html b/backend/workflows/templates/workflows/developer_handbook.html
index 1ee31f2..f78f29c 100644
--- a/backend/workflows/templates/workflows/developer_handbook.html
+++ b/backend/workflows/templates/workflows/developer_handbook.html
@@ -386,6 +386,7 @@ make backup-verify BACKUP_DIR=backups/backup_YYYYmmdd_HHMMSS</code></pre>
     <p>The preferred current test-deployment path is the local helper script from a Mac or another LAN-connected workstation:</p>
     <pre><code>./scripts/deploy_test_from_mac.sh</code></pre>
     <p>This script fast-forwards <code>develop</code>, syncs the repo to the server with <code>rsync</code>, runs the remote deployment, and verifies the health endpoint.</p>
+    <p>The script explicitly preserves server-local env files such as <code>.env.test</code> and <code>.env.prod</code> so deployment does not wipe machine-specific secrets.</p>
     <p>Direct server-side deploy is still available if the code is already on the server:</p>
     <pre><code>cd /opt/workdock
 RUN_DJANGO_CHECK=0 DEPLOY_HEALTH_URL="http://127.0.0.1:8088/healthz/" ./scripts/deploy_stack.sh .env.test docker-compose.prod.yml</code></pre>
diff --git a/scripts/deploy_test_from_mac.sh b/scripts/deploy_test_from_mac.sh
index 0ad18b6..0cf80aa 100755
--- a/scripts/deploy_test_from_mac.sh
+++ b/scripts/deploy_test_from_mac.sh
@@ -25,6 +25,8 @@ git pull --ff-only origin develop
 
 echo "Syncing repository to ${DEPLOY_HOST}:${DEPLOY_PATH} ..."
 rsync -az --delete \
+  --filter 'P .env.test' \
+  --filter 'P .env.prod' \
   --exclude '.git' \
   --exclude '.github' \
   --exclude '.venv' \