# Local deployment config — contains secrets (LDAP admin password, JWT secret,
# OAuth client secret, LDAP service password, SMTP creds). Never commit.
# ./config/ holds the live sso-secrets.js + proxy-secrets.js (generated by
# setup.sh); committed examples live in config.example/.
config/
backups/

# .env: NOT app config (that's ./config/, generated by setup.sh) — this is
# docker compose's own auto-loaded env file, which setup.sh uses only to
# persist *_GIT_COMMIT build args so an ad-hoc rebuild of a single service
# still bakes the right commit hash. Generated; never commit.
# proxy.env: legacy, no longer used — still ignored in case an old
# deployment hasn't deleted it yet.
.env
proxy.env

# setup.env — operator's first-run domain config (copied from setup.env.example,
# which IS committed). Holds the domain as a base DN; setup.env itself is
# per-deployment and is not committed.
setup.env

# Backup artifacts (hold secrets — the whole user directory + Redis dumps)
*.rdb
*.ldif

# Docker Compose runtime artifacts
*.log

# Jekyll build output (docs/ site) — generated, not committed.
docs/_site