# Secrets and machine-local state. Never commit these.
.env
*.env.local
.env.*
!.env.example

# The one exception: the Compose project environment for each deployed stack.
# These hold no credentials (the Grafana password is a Portainer stack variable
# and the SeaweedFS keys are a host file), and Portainer reads them as the
# project .env beside each compose file.
!deploy/.env
!deploy/alloy-node-02/.env

# CodeGraph index artifacts are machine-specific and regenerated by the extension.
.codegraph/

# Validation tooling dependencies: installed locally, never deployed.
node_modules/
package-lock.json

# Local copies of secrets pulled for configuration work.
.secrets/

# Editor and OS noise.
.vscode/
.DS_Store
Thumbs.db
desktop.ini

# Local scratch space for verification output.
.out/
tmp/
