# Root-level ignores

# ============================================
# SENSITIVE DATA - NEVER COMMIT
# ============================================
# Environment variables
.env
.env.*
!.env.example

# Cryptographic keys and certificates
server/keys/*.pem
server/keys/*.key
server/keys/*.crt
server/keys/*.cert
server/keys/*.p12
server/keys/*.pfx
server/keys/*.jks
!server/keys/.gitkeep
byok-test-certs/

# M1b-fixup H-3: locally-generated MediaMTX self-signed certs
mediamtx-certs/

# ISSUE-6: locally-generated nginx TLS-reverse-proxy self-signed cert.
# Each operator's deployment mints its own keypair on first boot via
# nginx-certs-init; never committed.
nginx-certs/

# Agent examples' self-signed TLS pairs (camera-agent[-lite]-certs-init).
agent-certs/

# ISSUE-6 v3: host-hardening artifacts. The nft template + snapshot
# directories are operator-local — they reference the operator's
# specific interface names and contain `nft list ruleset` snapshots
# that may include details of their other firewall rules.
#
# ISSUE-9 fix: the pattern is anchored with a leading slash so it
# matches ONLY ``./host-hardening/`` (the operator artifact dir
# created by ``scripts/apply-camera-vlan-hardening.sh``), not
# ``./tests/host-hardening/`` (our regression test suites — which
# the un-anchored pattern accidentally excluded for the entire
# life of the ISSUE-6 → ISSUE-8 series, leaving every "X tests
# green" claim in CHANGELOG referencing files that lived only in
# local working trees).
/host-hardening/

# Secrets and credentials
secrets/
*.secret
*_secret.txt
credentials.json
token.json

# ============================================
# GENERATED BUILD ARTIFACTS
# ============================================
# Generated recordings output
Recordings/
recordings/
!app/src/views/settings/recordings/
*.mp4
*.mkv
*.avi
*.webm
# …except the bundled talking-avatar clips (placeholders; swap your own in)
!examples/camera-agent/demo/avatar/*.mp4
!examples/camera-agent/demo/avatar/*.webm

# Python compiled
__pycache__/
*.py[cod]
*$py.class
*.so
*.pyo
*.pyd
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib/
!app/src/lib/
lib64/
parts/
sdist/
var/
wheels/
share/python-wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST

# Python virtual environments
venv/
env/
ENV/
.venv/
server/venv/

# uv lockfiles (tracked in git for reproducibility)
# Uncomment if you don't want to track lockfiles:
# uv.lock

# Frontend builds
app/dist/
app/dist-ssr/
app/dev-dist/
app/node_modules/
app/.cache/

# ============================================
# LOGS AND DEBUG FILES
# ============================================
# Application logs
logs/
*.log
*.log.*
server/logs/*.log
server/logs/*.log.*
npm-debug.log*
yarn-debug.log*
yarn-error.log*
pnpm-debug.log*
lerna-debug.log*

# Debug files
debug_*.py
debug_*.txt
*_debug.txt
server/debug_*.py
server/debug_*.txt

# ============================================
# TEMPORARY AND TEST FILES
# ============================================
# Ad-hoc scratch test scripts at the repo root or in server/ are ignored
# (they're typically one-off diagnostics that shouldn't ship). Real test
# suites under server/tests/ ARE tracked — the negation below re-includes
# them so pytest discovery works in CI.
test_*.py
*_test.py
server/test_*.py
!server/tests/test_*.py
!server/tests/**/test_*.py
# KAI-C's pytest suite (A2.4): same negation pattern as server/tests/.
!kai-c/test/test_*.py
# Example-app pytest suites (A2.5+): each example/{slug}/tests/ is part
# of the shipped artifact and must be tracked.
!examples/**/tests/test_*.py
# detect-pipeline (Tier-0) pytest suite: same negation pattern — the tests
# live in detect-pipeline/test/ (singular) and MUST be tracked so CI runs them.
!detect-pipeline/test/test_*.py
# App SDK pytest suite: same negation pattern as server/tests/. Without
# this the blanket ``test_*.py`` above silently untracked the whole
# sdk/opennvr-app-sdk/tests/ suite.
!sdk/opennvr-app-sdk/tests/test_*.py
# App template smoke test: part of the shipped scaffold — the generator
# copies it into every new app and FIRST_DETECTOR.md promises it passes
# out of the box. Without this negation the blanket ``test_*.py`` above
# silently untracked it (review finding: fresh clones got "no tests ran").
!templates/opennvr-app/tests/test_*.py
# App-installer pytest suite: same negation pattern.
!scripts/app-installer/tests/test_*.py
server/scripts/check_*.py
server/scripts/get_*.py
server/scripts/delete_*.py
server/scripts/update_*.py
server/scripts/debug_*.py
server/scripts/setup_venv.py
server/scripts/logging_summary.py
server/scripts/inspect_schema.py
server/check_*.py
server/get_*.py
server/delete_*.py
server/update_*.py
*.dat
*.tmp
*.temp
*.cache

# Database dumps and backups
*.sql
*.db
*.sqlite
*.sqlite3
*.dump

# ============================================
# CONFIGURATION FILES (LOCAL OVERRIDES)
# ============================================
# MediaMTX configs (should use default from repo)
server/mediamtx*.yml
!mediamtx.yml

# Local configs
*.local
*.local.*
!mediamtx.local.yml
config.local.*

# ============================================
# OS GENERATED FILES
# ============================================
.DS_Store
.DS_Store?
._*
.Spotlight-V100
.Trashes
ehthumbs.db
Thumbs.db
desktop.ini
*~

# ============================================
# IDE AND EDITOR FILES
# ============================================
.vscode/
.idea/
*.swp
*.swo
*.swn
*.bak
.project
.classpath
.c9/
*.launch
.settings/
.metadata

# ============================================
# THIRD-PARTY EXECUTABLES
# ============================================
# MediaMTX binary
mediamtx/
mediamtx.exe
mediamtx

# ============================================
# DOCUMENTATION (ANALYSIS/DESIGN DOCS)
# ============================================
# These are analysis docs, not part of codebase
CURRENT_PLAYBACK_ARCHITECTURE.md
KEYS_DIRECTORY_ANALYSIS.md
VOD_PLAYBACK_POSSIBILITIES.md
CLOUD_AI_IMPLEMENTATION.txt
RECORDING_RETENTION_IMPLEMENTATION.md
ENDPOINT_SECURITY_ANALYSIS.md
IMPLEMENTATION_COMPLETE.md
KAVACH_COMPLIANCE_REPORT.md

# ============================================
# LOCAL NESTED REPOS (DEV ONLY)
# ============================================
# AI-adapters is a separate repo
AI-adapters/

# ============================================

# Temporary text files (analysis/debug)
*_analysis.txt
# supervisord config built into image
!supervisord.conf

# Launcher-written host network hints (mounted into opennvr-core)
data/net-hints/

# KAI-C runtime adapter-registration receipts (#371) — machine state,
# never source. In Docker this lives on the opennvr_kai_c_state volume.
kai-c-state/

# make sdk-docs output (generated, see docs/SDK_REFERENCE.md)
sdk/opennvr-app-sdk/docs/api/
