# ─── Deny by default ────────────────────────────────────────────────
# Everything inside a service directory is ignored. This means a new
# service is safe automatically — you don't have to remember to add a
# rule for it before the first `docker compose up`.
*/*

# ─── …except the files that define a stack ──────────────────────────
!*/compose.yaml
!*/docker-compose.yaml
!*/.env.example
!*/README.md

# Docs are not service data.
!docs/**

# ─── Never, anywhere ────────────────────────────────────────────────
.env
*.key
*.pem
*.crt
secrets/