# Secrets / credentials — never commit these
.env
*.env
!*.env.example

# digest-engine per-run output (rendered artifacts, cached ingestion context)
digest-engine/output/

# digest-engine: the real OPNsense IDS config carries an API key/secret. Only
# IDSconf.json.example is tracked, matching the digest-engine.env.example pattern.
IDSconf.json

# signal-cli / Telethon session state, if ever run outside their containers
*.session
*.session-journal

# whatsapp-bridge's persisted logged-in browser session (whatsapp-web.js LocalAuth dir)
digest-engine/whatsapp-bridge/.wwebjs_auth/
digest-engine/whatsapp-bridge/.wwebjs_cache/

# thin-client: everything under live-build/config/ is generated — `lb config` writes
# its own files there, and build-thin-client-iso.sh regenerates includes.chroot/ from
# configs/ + agent/ on every run (including an /etc/thinclient-agent/config.env that
# carries MQTT credentials). Only the two hand-written inputs are tracked.
hosts/thin-client/live-build/config/*
!hosts/thin-client/live-build/config/package-lists/
!hosts/thin-client/live-build/config/hooks/
!hosts/thin-client/live-build/config/preseed.cfg
hosts/thin-client/live-build/auto/

# thin-client: live-build's own build artifacts
hosts/thin-client/live-build/.build/
hosts/thin-client/live-build/cache/
hosts/thin-client/live-build/chroot/
hosts/thin-client/live-build/chroot.files
hosts/thin-client/live-build/chroot.packages.*
hosts/thin-client/live-build/binary/
hosts/thin-client/live-build/binary.*
hosts/thin-client/live-build/*.iso
hosts/thin-client/live-build/*.img
hosts/thin-client/live-build/*.log
hosts/thin-client/live-build/*.contents
hosts/thin-client/live-build/*.files
hosts/thin-client/live-build/*.packages

# thin-client: the wayvnc password must never be committed. The image ships a
# sentinel that makes start-wayvnc refuse to run; the real value is generated on the
# booted machine (see hosts/thin-client/README.md).
wayvnc-password
*.rsa_key.pem
hosts/thin-client/**/tls_key.pem

# thin-client: the gallery SMB credentials, same never-commit handling as the wayvnc
# password above — only gallery-credentials.example is tracked.
gallery-credentials

__pycache__/
*.pyc
