# OpenTofu / Terraform
.terraform/
.tofu/
.terraform.lock.hcl
.tofu.lock.hcl
terraform.tfstate
terraform.tfstate.*
crash.log
*.tfvars
*.tfvars.json

test-inventory.ini
inventory.ini
venv/*
.env

# Secrets are ansible-vault encrypted and ARE committed.
# Anything matching *_secrets.plain.yml is a working decryption — never commit those.
*_secrets.plain.yml

# Vault password — never commit
ansible/.vault_pass