# Secrets — never commit plaintext. Use SOPS/age (*.enc.yaml is allowed).
*.env
.env
.env.*
!.env.example
secrets/
*.key
*.pem
!*.pub

# SOPS-encrypted files ARE allowed to be committed:
!*.enc.*
!*.sops.*

# Rendered runtime state that should not be tracked
deployments/**/.state/
deployments/**/data/

# OS / editor cruft
.DS_Store
Thumbs.db
*.swp
.idea/
.vscode/

# Ansible
*.retry
platform-infra/ansible/inventory/hosts.yml
platform-infra/ansible/.ansible/
platform-infra/ansible/collections/

# Python (control-panel CLI)
__pycache__/
*.pyc
.venv/
venv/
*.egg-info/
.pytest_cache/
control-panel/config.yaml