27 lines
1.2 KiB
Plaintext
27 lines
1.2 KiB
Plaintext
# Machine-local config and credentials. Never committed.
|
|
ctrl/.env
|
|
|
|
# Rendered output. Regenerate with `make services render <target>`.
|
|
# Generated config is an artifact, not source — the estate file is the source.
|
|
#
|
|
# The path is ctrl/render/out/, NOT render/out/. A pattern containing a slash is
|
|
# anchored to the directory holding this .gitignore, so `render/out/` would mean
|
|
# berth/render/out/ — which does not exist, and the real output would have been
|
|
# committed. Caught by `git check-ignore -v`, which is the only way to be sure.
|
|
ctrl/render/out/
|
|
|
|
# The "default" scratch bucket: always gitignored, never versioned.
|
|
def/
|
|
|
|
# Key material. NEVER committed.
|
|
#
|
|
# Anchored to ctrl/ for the same reason as render/out/ above: a pattern with a
|
|
# slash resolves against this file's own directory. `git check-ignore -v` is the
|
|
# only way to confirm it, and ctrl/vpn.sh refuses to write a key until it does.
|
|
ctrl/.secrets/
|
|
|
|
# Snapshots of a remote box's state (`host.sh snapshot --run`). Not secrets —
|
|
# the probe refuses to read environments, compose files or logs — but machine
|
|
# state from production, and never source. Anchored to ctrl/ for the reason above.
|
|
ctrl/.snapshots/
|