diff --git a/.gitignore b/.gitignore
index 79b429d4a..934c2005b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,6 +25,14 @@ ios/
 docs/*_CREDENTIALS.md
 docs/CREDENTIALS_*.md
 
+# Service secrets (private keys, never commit)
+secrets/
+
+# Local backup files (Mac Mini operator workflow)
+*.bak-*
+.env.macmini.bak-*
+cloudflared-config.yml.bak-*
+
 # Environment files
 .env
 .env.local
diff --git a/cloudflared-config.yml b/cloudflared-config.yml
index fb4f3c23c..9ca0e001c 100644
--- a/cloudflared-config.yml
+++ b/cloudflared-config.yml
@@ -130,6 +130,8 @@ ingress:
   # ============================================
   # Forgejo (Git + CI/CD)
   # ============================================
+  - hostname: git.mana.how
+    service: http://localhost:3030
 
   # ============================================
   # Standalone microservices