# ─── Deny by default ────────────────────────────────────────────────
# Everything inside a service directory is ignored. This means a new
# service is safe automatically — you don't have to remember to add a
# rule for it before the first `docker compose up`.
*/*

# ─── …except the files that define a stack ──────────────────────────
!*/compose.yaml
!*/docker-compose.yaml
# A service's alternative compose file, published as documentation. Narrow on
# purpose: `!*/compose.*.yaml` would also un-ignore compose.override.yaml,
# which is exactly where people keep local secrets.
!*/compose.personal.yaml
!*/.env.example
!*/README.md

# Support files a stack needs at runtime: init scripts, config fragments.
# Keep them in a per-service `init/` directory so they are never mistaken for
# application state.
!*/init/
!*/init/**

# Docs are not service data.
!docs/**

# ─── Never, anywhere ────────────────────────────────────────────────
.env
*.key
*.pem
*.crt
secrets/
TODO

# VPN configs carry private keys. Named explicitly because the `!*/init/**`
# rule above would otherwise happily commit one dropped in a service's
# init/ directory -- which is exactly where this repo's own conventions
# tell you to put runtime config fragments.
wg*.conf
*.ovpn