# ─── Deny by default ────────────────────────────────────────────────
# Everything inside a service directory is ignored. This means a new
# service is safe automatically — you don't have to remember to add a
# rule for it before the first `docker compose up`.
*/*

# ─── …except the files that define a stack ──────────────────────────
!*/compose.yaml
!*/docker-compose.yaml
!*/.env.example
!*/README.md

# Support files a stack needs at runtime: init scripts, config fragments.
# Keep them in a per-service `init/` directory so they are never mistaken for
# application state.
!*/init/
!*/init/**

# Docs are not service data.
!docs/**

# ─── Never, anywhere ────────────────────────────────────────────────
.env
*.key
*.pem
*.crt
secrets/