# settings/

Safe files that may be committed to Git:

- `ui_builder_draft.json` — editable UI Builder configuration.
- `ui_builder_published.json` — published runtime configuration used by operators.
- `hockey_api.json` — public Stat2TV endpoint/settings configuration; no password is stored here.

Files that must stay local and are ignored by Git:

- `stat2tv_credentials.local.json` — fallback local login/password.
- `editor_security.json` — local editor/PIN security data.
- `backups/`, `settings.json`, `vmix_json.json`, `vmix_functions.json` — machine/runtime-specific files.

## Recommended production credentials

Put secrets in the server environment file instead of JSON:

```env
STAT2TV_LOGIN=...
STAT2TV_PASSWORD=...
STAT2TV_BASE_URL=https://...
STAT2TV_AUTH_MODE=auto
STAT2TV_VERIFY_SSL=true
```

The application reads `STAT2TV_LOGIN` and `STAT2TV_PASSWORD` from the process environment first. The local credentials JSON is only a fallback when those variables are absent.