# Git
# NOTE: .git is intentionally NOT excluded — the gitinfo build stage in
# Dockerfile.openldap reads it to bake the commit hash into the image (see
# nodejs/utils/build_info.js), then it's discarded before the final stage.
# It never ends up in the final image.
.gitignore

# Development
.claude
*.md
# README.md and tos.md are both read at runtime (tos.md is loaded by
# routes/index.js at boot). DEPLOYMENT.md/API.md/directory_spec.md/docs/*.md
# are read at runtime too, by routes/docs.js -- all must stay in the build
# context.
!README.md
!tos.md
!CHANGELOG.md
!DEPLOYMENT.md
!API.md
!directory_spec.md
!docs/**/*.md

# Tests (excluded from production builds; test-runner Dockerfile copies them explicitly)
# nodejs/tests/
# nodejs/*.test.js

# Host dependency tree — let the image run a clean `npm ci`. Also avoids
# copying platform-wrong native modules (e.g. bcrypt built for the host OS).
nodejs/node_modules

# IDE
.vscode
.idea
*.swp
*.swo

# Logs
*.log
logs/

# OS
.DS_Store
Thumbs.db

# Docker (prevent recursive copy)
Dockerfile*
docker-compose.yml
.dockerignore

# Ops scripts (not needed in container) — except the custom LDAP schema files,
# which Dockerfile.openldap COPYs into the image for the bundled slapd.
ops/
!ops/schema/
!ops/schema/*.schema

# Secrets (mount at runtime instead)
nodejs/conf/secrets.js
secrets.js