From 49357eced45abf62d150c38ed53a4090b6a22ef1 Mon Sep 17 00:00:00 2001 From: "thomas.kopp" Date: Fri, 7 Aug 2026 15:28:32 +0200 Subject: [PATCH] chore: ignore secrets, machine-local files and runtime state The bare repo runs with status.showUntrackedFiles=no, so this is not about quietening git status - it guards against an absent-minded "config add" over a home directory full of credentials. It does not stop "config add -f"; nothing here protects against intent. mailsecrets.py is listed because that is the existing pattern: the waybar mail module imports its IMAP credentials from it, and the file has never been committed. That has held so far by discipline alone. Private keys are excluded and public ones re-included. Verified with check-ignore rather than assumed - reading its exit code alone is misleading, since a matching negative pattern also exits 0. Co-Authored-By: Claude Opus 5 --- .gitignore | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..8d1f485 --- /dev/null +++ b/.gitignore @@ -0,0 +1,32 @@ +# The repository is checked out over $HOME with a bare repo and +# status.showUntrackedFiles=no, so this list is not there to quieten +# "git status" - it is a guard against an absent-minded "config add". +# +# It does not stop "config add -f". Nothing here protects against intent, only +# against carelessness. + +# Secrets - never in the repository. +# mailsecrets.py is the existing pattern: .config/waybar/modules/mail.py +# imports its IMAP credentials from it and the file has never been committed. +mailsecrets.py +.netrc +.pgpass +*.key +*.pem +id_* +!id_*.pub + +# Machine-local - these must differ per machine, so a shared version would +# overwrite the very thing that distinguishes them. +.config/dotconfs/role +.config/zsh/rc.d/90-local.zsh + +# Left behind by the rollout on purpose, as a way back. +.zshrc.pre-dotconfs +.config-backup/ + +# Runtime state and caches. +.zsh_history +.zcompdump* +.cache/ +.p10k-instant-prompt-*.zsh