# Allowlist. Everything is ignored unless explicitly named below.
# This is deliberate: the previous repo used a two-line denylist and
# accumulated browser caches, mail caches and vendored binaries.
**/*

!.gitignore
!install
!README.md

!meta/
!meta/**
!common/
!common/**
!hosts/
!hosts/**
!packages/
!packages/**

# dotbot submodule
!.gitmodules
!dotbot

# Re-exclude noise inside the allowed trees.
**/__pycache__/
**/*.pyc
*.pre-*
*.backup
**/hcache/
**/node_modules/

# Never, under any circumstances. These are shapes that have actually held
# live credentials on these machines: Claude OAuth tokens, restic repo keys,
# subsonic passwords, the Proton bridge and LiteLLM virtual keys.
**/credentials
**/credentials/**
**/.credentials.json
**/password
**/hosts.yml
**/*.env
.secrets.zsh

# wallust output. Regenerated on every theme change, so tracking it means every
# machine fights over the other's palette. hypr/waybar/swaync write to real
# files; these two land inside directories this repo links, so ignore them here.
common/kitty/colors.conf
common/qutebrowser/colors.py
