# deployments

GitOps state — one directory per site, rendered by the provisioning CLI
(Phase 4). Empty until the first site is provisioned.

Per-site layout (see
[../docs/03-naming-conventions.md](../docs/03-naming-conventions.md) §7):

```
<slug>/
├── site.yaml            # declarative source of truth (slug, profile, domains)
├── docker-compose.yml   # rendered from a site-templates profile
├── .env.example         # non-secret references
└── secrets.enc.yaml     # SOPS/age-encrypted secrets (committed encrypted only)
```

**Never commit plaintext secrets.** Only `*.enc.*` / `*.sops.*` are allowed.