# Machine-local config and credentials. Never committed.
ctrl/.env

# Rendered output. Regenerate with `make services render <target>`.
# Generated config is an artifact, not source — the estate file is the source.
#
# The path is ctrl/render/out/, NOT render/out/. A pattern containing a slash is
# anchored to the directory holding this .gitignore, so `render/out/` would mean
# berth/render/out/ — which does not exist, and the real output would have been
# committed. Caught by `git check-ignore -v`, which is the only way to be sure.
ctrl/render/out/

# The "default" scratch bucket: always gitignored, never versioned.
def/

# Key material. NEVER committed.
#
# Anchored to ctrl/ for the same reason as render/out/ above: a pattern with a
# slash resolves against this file's own directory. `git check-ignore -v` is the
# only way to confirm it, and ctrl/vpn.sh refuses to write a key until it does.
ctrl/.secrets/