# Plaintext secrets exist only transiently on a workstation while
# editing; only the .age ciphertext belongs in git.
#
# ⚠️ **The glob, because the exact name matched the live file and none of
# its copies.** `deploy.sh` writes `secrets.env.bak-<stamp>` beside it
# before a rewrite and an operator does the same by hand; every one of
# those holds the same keys. Measured on this project's own production
# while giving the deploy repo a first commit: `git add -A` staged
# `secrets.env.bak-pre-acme` (9 non-empty values) and
# `secrets.env.bak.wildcard-…` (10). The exact pattern above had been
# believed correct for the life of the file.
#
# ⚠️ `secrets.env.example` is deliberately still committed: it carries no
# values and its whole purpose is to be read — which is why this is a
# `.bak` glob rather than `secrets.env*`.
secrets.env
secrets.env.bak*

# ⚠️ Host-local, and the same shape: it names this host's ENV / ROLE /
# DEPLOY_DIR, and its `.bak-*` copies carry the same values. It was
# absent from this file entirely — every host that keeps `deploy.conf`
# beside the script rather than in `/etc/ctfy` (which is every host
# without passwordless sudo) would commit it.
deploy.conf
deploy.conf.bak*

# Host-side working state written by deploy.sh — never committed.
.rendered/
backups/
data/
challenges/
