# deployments

GitOps state — nested `customer/site` directories, rendered by the provisioning
CLI (Phase 4). Empty until the first site is provisioned.

Layout (see
[../docs/03-naming-conventions.md](../docs/03-naming-conventions.md) §7):

```
<customer>/
└── <site>/
    ├── site.yaml            # declarative source of truth (customer, site, profile, domains)
    ├── docker-compose.yml   # rendered from a site-templates profile
    ├── .env.example         # non-secret references
    └── secrets.enc.yaml     # SOPS/age-encrypted secrets (committed encrypted only)
```

**Never commit plaintext secrets.** Only `*.enc.*` / `*.sops.*` are allowed.