# Ansible
*.retry
build/config/ansible/inventory/*.retry

# Rendered secrets — only .env.example is ever committed
**/.env
!**/.env.example

# Terraform
# .terraform/ holds the provider cache and, after
# `terraform init -backend-config=...`, the Postgres connection string with
# its password — never commit it. .terraform.lock.hcl is deliberately NOT
# ignored: it pins provider versions and belongs in git.
.terraform/
*.tfstate
*.tfstate.*
*.tfvars
!*.tfvars.example
# A saved plan (`terraform plan -out=…`) is not just a diff: it embeds a copy
# of the state it was made against *and* the values of every input variable,
# `sensitive` ones included — so build/config/terraform/deploy.plan contains
# the Proxmox API token in the clear. Ignored so that a `git add -A` can't
# publish it.
*.plan

# OS cruft
.DS_Store
Thumbs.db

# Scratch output that isn't state and isn't secret-free — e.g. the k3s
# kubeconfig playbooks/k3s.yml fetches to local/k3s/<cluster>.kubeconfig,
# which carries a client cert.
local/