# The repository is checked out over $HOME with a bare repo and
# status.showUntrackedFiles=no, so this list is not there to quieten
# "git status" - it is a guard against an absent-minded "config add".
#
# It does not stop "config add -f". Nothing here protects against intent, only
# against carelessness.

# Secrets - never in the repository.
# mailsecrets.py is the existing pattern: .config/waybar/modules/mail.py
# imports its IMAP credentials from it and the file has never been committed.
mailsecrets.py
.netrc
.pgpass
*.key
*.pem
id_*
!id_*.pub

# Machine-local - these must differ per machine, so a shared version would
# overwrite the very thing that distinguishes them.
.config/dotconfs/role
.config/zsh/rc.d/90-local.zsh

# Left behind by the rollout on purpose, as a way back.
.zshrc.pre-dotconfs
.config-backup/

# KDE Connect keeps the device certificate and its private key here. Pairing
# state, not configuration - and the one place under .config that actually
# holds a secret.
.config/kdeconnect/

# Runtime state and caches.
.zsh_history
.zcompdump*
.cache/
.p10k-instant-prompt-*.zsh