# OS / editor
.DS_Store
*.swp
*~
.idea/
.vscode/

# Secrets — SOPS-encrypted only; never commit plaintext (spec docs/07)
*.dec.yaml
*.decrypted.*
*.key
age.key
*.kubeconfig
kubeconfig

# IaC state / local runtime
.terraform/
*.tfstate
*.tfstate.*
.terraform.lock.hcl
*.tfvars
!*.example.tfvars
# tofu apply/plan run logs (tee'd locally; never commit)
apply.log
plan.log

# Test / build artifacts
/results/
/reports/
*.junit.xml
coverage/

# RETIRED plaintext Tofu secret files. Superseded by the COMMITTED, SOPS/age-encrypted
# infra/tofu/secrets.sops.env + the wrapper infra/tofu/tf.sh (see REMOTE-STATE.md). These
# lines are KEPT as a safety net so any leftover plaintext copy on an operator's machine can
# NEVER be committed; delete the local files once you've migrated to the encrypted flow.
infra/tofu/backend.hcl
infra/tofu/.r2.env

# Operator scratch, writable from inside the dev container (the repo is its only persistent
# read-write mount). Holds things that must never be committed: a staged copy of the SOPS age or
# WireGuard key, rendered VPN client profiles (infra/vpn-ingress/new-peer.sh writes here by
# default). `infra/ansible/.gitignore` already does this for its own .cache/; this is the same
# convention at the root. Do NOT rely on `*.key` alone to protect a staged key — that only covers
# one filename shape, which is why this rule exists.
.cache/

# Claude Code local scratch: agent worktrees + session state. Nothing here is tracked;
# ignoring it keeps `git add -A` from staging embedded worktree repos and keeps the lint
# stage (which scans untracked files) from tripping on .claude/worktrees/.
.claude/

# Vendored ansible collections (installed by ansible-galaxy for node re-provision; not tracked or linted)
infra/ansible/collections/