# Secrets and local env — never commit
.env
.env.*
!.env.example
!.env.*.example
*.pem
*.key
*.p12
*.pfx
*.crt
id_rsa
id_rsa.pub
id_ed25519
id_ed25519_*
credentials.json
*-credentials.json
service-account*.json
auth.json
*.secret
secrets/
.aws/
.netrc
*.dump
*.sql.gz

# A host's own files from before its configuration came into git (Redmine #4265); deploy/host/
# holds what replaces them. The deploy's sync neither sends nor deletes them.
/compose.override.yml
/deploy/nginx/default.local.conf

# Python
__pycache__/
*.py[cod]
.venv/
venv/
.pytest_cache/
.mypy_cache/
.ruff_cache/
htmlcov/
.coverage
*.egg-info/
dist/
build/

# Node
node_modules/
.next/
out/
apps/web/public/sw.js
apps/web/public/sw.js.map
apps/web/public/swe-worker*
# Playwright (Redmine #4246): the harness's generated secrets and browser sign-ins, and each
# run's results. Never committed, never uploaded.
apps/web/playwright/.auth/
apps/web/test-results/
apps/web/playwright-report/
coverage/
.turbo/
*.tsbuildinfo

# OS / editors
.DS_Store
Thumbs.db
.idea/
.vscode/
*.swp

# Terraform
infra/.terraform/
infra/*.tfstate
infra/*.tfstate.*
infra/*.tfvars
!infra/*.tfvars.example

# Media / tenant dumps (never commit)
/media/
# MEDIA_ROOT defaults to apps/api/media, which is also a tracked app package, so uploads
# land beside its __init__.py as apps/api/media/<schema>/. The rule above is root-anchored
# and does not reach them; the app's own modules stay tracked.
apps/api/media/*/
/exports/
*.sqlite3
dump.rdb
*.log
