# OpenTofu / Terraform
.terraform/
.tofu/
terraform.tfstate
terraform.tfstate.*
crash.log

# Provider credentials only. Non-secret infra config (the vms map) is committed
# as *.auto.tfvars, and *.lock.hcl is committed on purpose so provider hashes
# are pinned.
terraform.tfvars
terraform.tfvars.json
*secrets.auto.tfvars

venv/*
.env

# Secrets are ansible-vault encrypted and ARE committed.
# Anything matching *_secrets.plain.yml is a working decryption — never commit those.
*_secrets.plain.yml

# Vault password — never commit
ansible/.vault_pass