# Sensitive data – never commit
.env
traefik/letsencrypt/
traefik/dynamic.yml
pihole/etc-pihole/
pihole/etc-dnsmasq.d/
wireguard/config/
cups/config/

# Data dirs – keep docker-compose.yml, ignore runtime data
gitea/data/
gitea/indexers/
gitea/log/
gitea/ssh/
gitea/gitea/
gitea/git/
registry/*
!registry/docker-compose.yml
drone/*
!drone/docker-compose.yml
uptime-kuma/*
!uptime-kuma/docker-compose.yml

# Backups (may contain old secrets)
*.bak
docker-compose.override.yml

# Logs & temp
*.log
.DS_Store