# Secrets / credentials — never commit these
.env
*.env
!*.env.example

# digest-engine per-run output (rendered artifacts, cached ingestion context)
digest-engine/output/

# admin-canvas: the shared output/ volume it writes into (current canvas state +
# uploaded media) — same handling as digest-engine/output/ above.
admin-canvas/output/

# digest-engine: the real OPNsense IDS config carries an API key/secret. Only
# IDSconf.json.example is tracked, matching the digest-engine.env.example pattern.
IDSconf.json

# signal-cli / Telethon session state, if ever run outside their containers
*.session
*.session-journal

# whatsapp-bridge's persisted logged-in browser session (whatsapp-web.js LocalAuth dir)
digest-engine/whatsapp-bridge/.wwebjs_auth/
digest-engine/whatsapp-bridge/.wwebjs_cache/

# thin-client: everything under live-build/config/ is generated — `lb config` writes
# its own files there, and build-thin-client-iso.sh regenerates includes.chroot/ from
# configs/ + agent/ on every run (including an /etc/thinclient-agent/config.env that
# carries MQTT credentials). Only the two hand-written inputs are tracked.
hosts/thin-client/live-build/config/*
!hosts/thin-client/live-build/config/package-lists/
!hosts/thin-client/live-build/config/hooks/
!hosts/thin-client/live-build/config/preseed.cfg
hosts/thin-client/live-build/auto/

# thin-client: live-build's own build artifacts
hosts/thin-client/live-build/.build/
hosts/thin-client/live-build/cache/
hosts/thin-client/live-build/chroot/
hosts/thin-client/live-build/chroot.files
hosts/thin-client/live-build/chroot.packages.*
hosts/thin-client/live-build/binary/
hosts/thin-client/live-build/binary.*
hosts/thin-client/live-build/*.iso
hosts/thin-client/live-build/*.img
hosts/thin-client/live-build/*.log
hosts/thin-client/live-build/*.contents
hosts/thin-client/live-build/*.files
hosts/thin-client/live-build/*.packages

# thin-client: the wayvnc password must never be committed. The image ships a
# sentinel that makes start-wayvnc refuse to run; the real value is generated on the
# booted machine (see hosts/thin-client/README.md).
wayvnc-password
*.rsa_key.pem
hosts/thin-client/**/tls_key.pem

# thin-client: the gallery SMB credentials, same never-commit handling as the wayvnc
# password above — only gallery-credentials.example is tracked.
gallery-credentials

# firmware/esp32-s3-touch-lcd-1.85c: Wi-Fi/API/OTA credentials + the household's
# entity IDs, same never-commit handling as digest-engine.env/admin-canvas.env —
# only secrets.yaml.example is tracked. ESPHome's own build cache, never useful
# to commit either.
firmware/esp32-s3-touch-lcd-1.85c/secrets.yaml
firmware/**/.esphome/

# audio-endpoint (amd64): same generated-includes.chroot / live-build-artifacts
# handling as hosts/thin-client/live-build/ above.
hosts/audio-endpoint/live-build-amd64/config/includes.chroot/
hosts/audio-endpoint/live-build-amd64/auto/
hosts/audio-endpoint/live-build-amd64/.build/
hosts/audio-endpoint/live-build-amd64/cache/
hosts/audio-endpoint/live-build-amd64/chroot/
hosts/audio-endpoint/live-build-amd64/chroot.files
hosts/audio-endpoint/live-build-amd64/chroot.packages.*
hosts/audio-endpoint/live-build-amd64/binary/
hosts/audio-endpoint/live-build-amd64/binary.*
hosts/audio-endpoint/live-build-amd64/*.iso
hosts/audio-endpoint/live-build-amd64/*.log
hosts/audio-endpoint/live-build-amd64/*.contents
hosts/audio-endpoint/live-build-amd64/*.files
hosts/audio-endpoint/live-build-amd64/*.packages

# audio-endpoint (arm64): rpi-image-gen's own build/work output, if ever cloned
# or built inside the repo tree instead of the default /opt/smart-home/src path.
hosts/audio-endpoint/rpi-image-gen/work/
hosts/audio-endpoint/rpi-image-gen/rpi-image-gen/

__pycache__/
*.pyc

# ---------------------------------------------------------------------------
# Build system (tools/) — see tools/README.md
#
# CoreSystemConfig.json is the FILLED-IN config: Wi-Fi PSK, every service token,
# MQTT and HA credentials. Only the .template is tracked. Never commit a real one.
CoreSystemConfig.json
CoreSystemConfig.*.json
!CoreSystemConfig.json.template

# Built images. These have every secret above burnt into them by design, so they are
# credential-bearing artifacts, not just large ones.
build-output/
*.iso
*.img
*.img.xz

# live-build working trees, regenerated from the config on every build.
hosts/*/live-build/config/includes.chroot/
hosts/*/live-build/config/includes.installer/
hosts/*/live-build/.build/
hosts/*/live-build/chroot/
hosts/*/live-build/cache/
hosts/*/live-build/binary/
hosts/*/live-build/*.iso