.gitignore

# ---- OS cruft ----
.DS_Store
._*
Thumbs.db
desktop.ini

# ---- Secrets ----
# Only *.sops.yaml (encrypted at rest) may be committed under secrets/.
.env
.env.*
!.env.example
secrets/*
!secrets/*.sops.yaml
!secrets/*.example.yaml
!secrets/README.md
# The one encrypted file that is never committed: it is encrypted to the key of
# a guest that is destroyed after each investigation (ADR-0071, .sops.yaml).
secrets/scratch.sops.yaml
*.pem
# The one committed certificate: the estate CA's public half, which every
# client of the ingest ports verifies the proxy against (#764). Never a key —
# scripts/check_ingest_ca.sh fails on anything but a single CA certificate here.
!stacks/observability/alloy/ingest-ca.pem
*.key
*.p12
*.pfx
*.crt
age.key
keys.txt
# Literals fed to scripts/purge-history.sh — never commit these.
.purge-secrets.txt
certificates/

# ---- Rendered / decrypted config (produced by scripts/render-config.sh) ----
**/.rendered/

# ---- stacks/soc: generated on odin, never committed ----
# Velociraptor writes its server config here on first start, and that file
# holds the internal CA's private key every client is pinned to (ADR-0030).
stacks/soc/velociraptor/etc/*
!stacks/soc/velociraptor/etc/.gitkeep
# The Wazuh mTLS material from the `certs` profile. *.pem and *.key are already
# ignored above; the directory is listed so nothing else lands in it either.
stacks/soc/wazuh/certs/*
!stacks/soc/wazuh/certs/.gitkeep
# ---- stacks/scratch: the same two, generated on diabolos (ADR-0071) ----
stacks/scratch/velociraptor/etc/*
!stacks/scratch/velociraptor/etc/.gitkeep
stacks/scratch/wazuh/certs/*
!stacks/scratch/wazuh/certs/.gitkeep
# Client installers repacked for GPO deployment are build artefacts.
*.msi

# ---- Reports from scripts/scan-images.sh (make scan-images) ----
.scan/

# ---- Build-time input for `make snmp-generate` (scripts/snmp-mibs.sh) ----
# Vendor MIBs, several MB of them, needed only to regenerate snmp.yaml. The
# generated snmp.yaml itself IS committed, so a deploy never needs these.
stacks/*/snmp-exporter/mibs/

# ---- tofu/: state, plans and provider caches (ADR-0076) ----
# State holds every value a provider touched, in cleartext unless encrypted,
# and a plan holds the same values plus the ones about to be sent. tofu/
# encrypts both and refuses to write either unencrypted (encryption.tf), so
# what would land here is ciphertext. It is ignored anyway: encrypted state
# under a passphrase that sits on one host is still nothing a public repository
# should carry, and the day encryption.tf is broken is the day this line is the
# only thing left. scripts/check-tracked-artefacts.sh asserts the same patterns
# are untracked, because `git add -f` walks straight past this file.
#
# Unanchored, like the rest: a state file one directory down is no safer.
*.tfstate
*.tfstate.*
*.tfplan
**/.terraform/
tofu/state/
# .terraform.lock.hcl is NOT ignored. It pins provider hashes and is committed.

# ---- Backups ----
# `make backup` writes age-encrypted volume archives to backups/volumes/<stamp>/,
# and `make restore` writes a pre-restore snapshot of what it is about to
# replace to backups/volumes/.pre-restore-<stamp>/. `make backup-nas` writes
# the age-encrypted pull of the media tier's state off smaug to backups/nas/<stamp>/.
# `make backup-firewall` writes the SOPS-encrypted pfSense config to
# backups/firewall/. None of it belongs in git.
#
# The firewall config carries the WAN address, the full rule set and user
# password hashes — docs/security.md says those are deliberately unpublished,
# and encryption does not change that a public repository is the wrong place
# for them. grafana-data is the same argument: it holds the admin password
# hash, every API token and every datasource credential. See
# scripts/backup-firewall.sh.
backups/

# ---- Runtime state produced by the stack ----
data/
**/data/
*.db
*.wal
# Paperless-ngx's ingest and export directories (stacks/sensitive). Created by
# scripts/render-config.sh, written to by scans and by document_exporter, and
# the export holds every document in the archive — never tracked. render-config
# asks `git check-ignore` about the path before creating it, which is how it
# tells a runtime directory from a tracked file the checkout has lost.
stacks/*/consume/
stacks/*/export/

# ---- Local tooling ----
.venv/
node_modules/
__pycache__/
*.py[cod]
*.log
*.tmp
*.bak
*.orig

# Claude Code worktrees. `git worktree add` with a relative path creates the
# new checkout inside whichever worktree is current, so without this an entire
# second copy of the repository — carrying its own .claude/worktrees/ — becomes
# untracked content on the branch being worked on, waiting for the next
# `git add -A`. Only worktrees/ is ignored: anything else under .claude/ stays
# visible, so settings or agents can be tracked deliberately if that is wanted.
.claude/worktrees/

# ---- Large local artifacts never meant for git ----
ISOs/
software/
*.iso
*.exe
docs/hardware/*.pdf

# validate.sh emits dashboard panel queries here for promtool; the trap removes
# it, but an interrupted run should not leave a puzzling untracked file behind.
.dashboard-exprs-*.yaml

# check_compose_health.py --proof-cache writes here in CI, restored by
# actions/cache between runs. A proof that binary B execs inside digest D, which
# cannot change while D does not (#602). Never committed: it is an optimisation
# of an immutable fact, and losing it costs a slow run, not a missed defect.
.probe-proofs/