# git-back-dots default ignore list for /etc discovery.
# gitignore-style patterns, matched relative to the repo root.
# Categories: secret (credentials/keys), regenerated (machine-made caches),
# churn (frequently rewritten state), editor (temp files).

# --- secret: local credentials -------------------------------------------
shadow
shadow-
gshadow
gshadow-
subuid
subuid-
subgid
subgid-
sudoers
sudoers.d/
netrc
krb5.keytab
sssd/sssd.conf
sssd/conf.d/
heimdal/

# --- secret: SSH host private keys ----------------------------------------
ssh/ssh_host_*_key
!ssh/ssh_host_*_key.pub

# --- secret: VPN / WiFi ----------------------------------------------------
wireguard/*.conf
wpa_supplicant.conf
wpa_supplicant/*.conf
NetworkManager/system-connections/
**/system-connections/
iwd/*.psk
iwd/*.8021x
openvpn/**/*.key
openvpn/**/*.crt
openvpn/openvpn-status.log

# --- secret: crypto / PKI --------------------------------------------------
ssl/private/
letsencrypt/live/
letsencrypt/archive/
acme.sh/
acme/
lego/
pacman.d/gnupg/
clevis/
tang/
tpm2-tss/
systemd/credentials/
yubikey/
age/keys.txt

# --- secret: services ------------------------------------------------------
krb5kdc/kdc.conf
slapd.d/
dovecot/**/*.key
dovecot/passwd*
postfix/sasl_passwd*
postfix/*.db
cups/ssl/
samba/*.tdb
docker/key.json
kubernetes/
rancher/
libvirt/secrets/

# --- secret-adjacent: user decides -----------------------------------------
# crypttab and fstab may reference key files or credentials paths; tracked by
# default (they define the system), but review before pushing.
# crypttab
# fstab

# --- regenerated: caches ----------------------------------------------------
ld.so.cache
prelink.cache
udev/hwdb.bin
ca-certificates/extracted/
ssl/certs/java/cacerts
trust-source/
gtk-2.0/gtk.immodules
gtk-3.0/immodules.cache
gio-2.0/giomodule.cache
gdk-pixbuf-2.0/*/loaders.cache
pango/
fonts/cache/
apparmor.d/cache/
lvm/cache/
lvm/archive/
pacman/sync/
pacman/local/

# --- churn: runtime state ---------------------------------------------------
mtab
mtab.fuselock
network/run
blkid.tab
blkid.tab.old
adjtime
nologin
.pwd.lock
*.LOCK
.fake-hwclock.data
fake-hwclock.data
check_mk/logwatch.state
cups/subscriptions.conf
cups/subscriptions.conf.O
cups/printers.conf
cups/printers.conf.O
ntp.conf.dhcp
.initctl
webmin/fsdump/*.status
webmin/webmin/oscache
X11/xdm/authdir/authfiles/
service/*/supervise/
service/*/log/supervise/
sv/*/supervise/
sv/*/log/supervise/
init.d/.depend.*
*.elc
*.pyc
*.pyo

# --- distro conffile side-effects -------------------------------------------
*.dpkg-*
*.ucf-*
*.rpmnew
*.rpmorig
*.rpmsave
*.apk-new
*.new-*_[0-9]*
._cfg*
*.pacnew
*.pacorig
# *.pacsave: may contain the pre-removal config with secrets; excluded here.
*.pacsave
*.old

# --- editor temp ------------------------------------------------------------
*~
.*.sw?
.sw?
#*#
DEADJOE
*.bak
*.updated
