# secrets / env
.env
backend/.env
# Per-node app configs (secrets; not committed). There are two committed
# templates — one per shape — and they must stay free of real credentials.
backend/configs/*.config.yaml
!backend/configs/example.control.config.yaml
!backend/configs/example.region.config.yaml
# The droplets' operator-owned configs and bootstrap.sh's rendered output. Same
# reason as the lines above: a region's config holds security.secrets_fernet_key
# and every provider credential, control's holds the Ed25519 signing key and the
# Dodo credentials, and rendered/ has the LiveKit secret substituted into it.
# A glob rather than one filename, because there is now a config per node per
# environment. deployment/*/.env is already covered by the bare `.env` rule at
# the top of this file.
deployment/*/[a-z]*.config.yaml
deployment/*/rendered/
# One `deployment/region/` directory serves BOTH regions, so their .env files
# cannot both be named `.env` — each carries its region slug here and is scp'd
# onto its droplet as plain `.env`. The bare `.env` rule at the top of this file
# covers the control droplet's, which is the only node in its directory.
deployment/*/.env.*
!deployment/*/.env.example
# The control plane's Ed25519 pair, kept beside the config that carries it
# inline. Losing the private half means nobody can ever sign in again; committing
# it means anyone can sign in as anyone.
*.pem
*.local
client_secret_*.json

# python
__pycache__/
*.py[cod]
.venv/
venv/
*.egg-info/
.pytest_cache/
.mypy_cache/
.ruff_cache/

# node / next
node_modules/
.next/
out/
clients/typescript/packages/*/dist/
mcp/dist/

# The docs site build. `documentation/build.sh` regenerates it; Cloudflare Pages
# builds it in CI, so a checked-in copy would only ever be stale.
documentation/dist/
documentation/export.zip
npm-debug.log*
.pnpm-debug.log*
*.tsbuildinfo

# data / volumes
pgdata*/
*.log
.tmp-*.json

# os / editor
.DS_Store
.idea/
.vscode/

# Monitoring inputs for create-secrets.sh — droplet IPs, the LiveKit metrics
# password and the Grafana OAuth client. Same reason as the config files.
deployment/prod/scripts/monitoring.env

reviews/*

roadmap/*
