# Plaintext secrets exist only transiently on a workstation while
# editing; only the .age ciphertext belongs in git.
secrets.env

# Host-side working state written by deploy.sh — never committed.
.rendered/
backups/
data/
challenges/
