# Never commit filled secrets — only *.env.template files are tracked.
*.env
!*.env.template

# Docker TLS material — CA/server/client certs and keys, generated by
# infra/scripts/docker-tls/generate-ca.sh and friends. Templates/READMEs stay tracked.
docker/tls/*.pem
docker/tls/*.key
docker/tls/*.crt
docker/tls/*.srl
!docker/tls/**/README.md

# Ansible Vault password files and any decrypted vars
ansible/.vault_pass
ansible/**/vault_plain.yml

# Terraform/OpenTofu state and generated vars (may contain resource IDs/IPs)
# Phase 4.1: these patterns were previously written repo-root-relative (e.g.
# "infra/terraform/...") inside THIS file, which git resolves relative to the .gitignore's own
# directory (infra/) — so they silently matched nothing at all. Found via `git status` showing
# a real .terraform/ provider cache as untracked when it should have been ignored. Fixed by
# dropping the redundant leading "infra/" from every pattern below.
terraform/**/*.tfstate
terraform/**/*.tfstate.*
terraform/**/.terraform/
terraform/**/terraform.tfvars
!terraform/**/terraform.tfvars.example

# Backup output and restore scratch space
backup/output/
backup/restore-test/

# Load test results (local artifacts, not source)
scripts/loadtest/results/