.gitignore

# Ansible cache — persisted on host via volume mount, not tracked in git
configs/.facts_cache/*
!configs/.facts_cache/.gitkeep
configs/.inventory_cache/*
!configs/.inventory_cache/.gitkeep

# Ansible Galaxy content — installed via `make galaxy`, not tracked in git
configs/.galaxy/

# Vault password and install locks — never track secrets
configs/.vault_pass
configs/.pip-install.lock

# Ansible logs
logs/*
!logs/.gitkeep

# SSH keys — never commit private keys
# The whole directory: keys of ANY filename (prod.pem, deploy_key, ...) must
# be uncommittable, not just the id_* defaults.
ssh/

# Python
__pycache__/
*.pyc
.venv/

# Claude Code local agent config — developer-local, not part of the image
.claude/
CLAUDE.local.md

# Site-local mesh compose override (points the ansible service at the
# orchestrator image) — machine-specific, never committed
orchestrator.override.yml