# Allowlist. Everything is ignored unless explicitly named below.
# This is deliberate: the previous repo used a two-line denylist and
# accumulated browser caches, mail caches and vendored binaries.
**/*

!.gitignore
!install
!README.md

!meta/
!meta/**
!common/
!common/**
!hosts/
!hosts/**
!packages/
!packages/**

# dotbot submodule
!.gitmodules
!dotbot

# Re-exclude noise inside the allowed trees.
**/__pycache__/
**/*.pyc
*.pre-*
*.backup
**/hcache/
**/node_modules/

# Never, under any circumstances. These are shapes that have actually held
# live credentials on these machines: Claude OAuth tokens, restic repo keys,
# subsonic passwords, the Proton bridge and LiteLLM virtual keys.
**/credentials
**/credentials/**
**/.credentials.json
**/password
**/hosts.yml
**/*.env
.secrets.zsh
