33 lines
No EOL
1 KiB
Text
33 lines
No EOL
1 KiB
Text
# Ansible
|
|
*.retry
|
|
build/config/ansible/inventory/*.retry
|
|
|
|
# Rendered secrets — only .env.example is ever committed
|
|
**/.env
|
|
!**/.env.example
|
|
|
|
# Terraform
|
|
# .terraform/ holds the provider cache and, after
|
|
# `terraform init -backend-config=...`, the Postgres connection string with
|
|
# its password — never commit it. .terraform.lock.hcl is deliberately NOT
|
|
# ignored: it pins provider versions and belongs in git.
|
|
.terraform/
|
|
*.tfstate
|
|
*.tfstate.*
|
|
*.tfvars
|
|
!*.tfvars.example
|
|
# A saved plan (`terraform plan -out=…`) is not just a diff: it embeds a copy
|
|
# of the state it was made against *and* the values of every input variable,
|
|
# `sensitive` ones included — so build/config/terraform/deploy.plan contains
|
|
# the Proxmox API token in the clear. Ignored so that a `git add -A` can't
|
|
# publish it.
|
|
*.plan
|
|
|
|
# OS cruft
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Scratch output that isn't state and isn't secret-free — e.g. the k3s
|
|
# kubeconfig playbooks/k3s.yml fetches to local/k3s/<cluster>.kubeconfig,
|
|
# which carries a client cert.
|
|
local/ |