# =====================================================================================
# Two kinds of things belong on this list:
#   (a) SECRETS  - leaking these is a domain compromise, not a typo
#   (b) RUNNING CONTAINER STATE - reproducible from this repo; committing it would shadow
#       the config that the entrypoint renders from .env on every start
#
# What you need to build a container stays tracked: image/, scripts/, tests/, docs/,
# docker-compose*.yml, Makefile, README.md, .env.example, .dockerignore, this file.
# =====================================================================================

# --- secrets --------------------------------------------------------------------
# Real configuration: holds the domain administrator password.
# `.env.*` also catches restore scratch/backups (.env.pre-restore-<ts>, .env.tmp).
# .env.example is the only member of this family that belongs in git.
.env
.env.*
!.env.example

# Admin password file, LDAPS CA + leaf + keys, throwaway lab CAs (secrets/tls-lab).
# NOTE: secrets/tls/ca.key is the trust anchor every joined client has installed. Leak it
# and someone can mint certificates your whole fleet trusts.
secrets/*
!secrets/.gitkeep

# Belt-and-braces: never let key material sneak in from anywhere else either.
*.key
*.pem
# (public certs are harmless but only ever live under secrets/, so ignore them too)
*.crt
*.p12
*.pfx

# --- running container state ----------------------------------------------------
# smb.conf as generated/rendered by the entrypoint (source of truth is .env + entrypoint).
conf/*
!conf/.gitkeep
conf-dc2/*
!conf-dc2/.gitkeep

# sam.ldb (NT hashes, Kerberos keys, Backup Key) + SYSVOL + machine account keys.
# This IS the domain. Treat it as production data, never as source.
data/*
!data/.gitkeep
data/samba
!data/samba
data/samba/*
!data/samba/.gitkeep
data/samba-dc2
!data/samba-dc2
data/samba-dc2/*
!data/samba-dc2/.gitkeep

# --- backups ------------------------------------------------------------------
# `samba-tool domain backup` archives are whole-domain copies: password hashes and the
# Backup Key included. They go off-host encrypted, not into version control.
backups/*
!backups/.gitkeep
*.tar.bz2
*.tgz
*.sha256

# --- per-machine compose overrides ----------------------------------------------
# Usually local-only (different IP/realm per box). Force-add if you mean to share it:
#   git add -f docker-compose.override.yml
docker-compose.override.yml
docker-compose.*.local.yml

# --- scratch, logs, editor and OS junk ------------------------------------------
*.log
*.tmp
*.bak
*.swp
*~
.DS_Store
Thumbs.db
# test harness scratch that landed inside the tree
tests/.tmp/

# --- python -------------------------------------------------------------------
__pycache__/
*.py[co]