# Plaintext secrets exist only transiently on a workstation while
# editing; only the .age ciphertext belongs in git.
#
# ⚠️ **The glob, because the exact name matched the live file and none of
# its copies.** `deploy.sh` writes `secrets.env.bak-<stamp>` beside it
# before a rewrite and an operator does the same by hand; every one of
# those holds the same keys. Measured on this project's own production
# while giving the deploy repo a first commit: `git add -A` staged
# `secrets.env.bak-pre-acme` (9 non-empty values) and
# `secrets.env.bak.wildcard-…` (10). The exact pattern above had been
# believed correct for the life of the file.
#
# ⚠️ `secrets.env.example` is deliberately still committed: it carries no
# values and its whole purpose is to be read — which is why this is a
# `.bak` glob rather than `secrets.env*`.
secrets.env
secrets.env.bak*

# ⚠️ Host-local, and the same shape: it names this host's ENV / ROLE /
# DEPLOY_DIR, and its `.bak-*` copies carry the same values. It was
# absent from this file entirely — every host that keeps `deploy.conf`
# beside the script rather than in `/etc/ctfy` (which is every host
# without passwordless sudo) would commit it.
deploy.conf
deploy.conf.bak*

# Host-side working state written by deploy.sh — never committed.
.rendered/
backups/
data/
challenges/

# ⚠️ Host-specific env, layered over the tracked `envs/<env>/env` by
# `--env-overlay`. The base is the 31 keys every host of this fleet
# agrees on and is reviewable in the deployment repo; this is the
# remainder — a worker's CTFY_NODE_PUBLIC_URL and CTFY_PLATFORM_URL, an
# all-role host's CTFY_GRAFANA_DOMAIN and CTFY_REGISTRY_DOMAIN, and the
# three that merely differ. Tracking the whole file instead was what
# made a shared upstream impossible.
envs/*/env.local
envs/*/env.local.bak*
