# .chezmoiignore -- PRIVATE tier.
#
# This is gitignore syntax. A `#` in the middle of a line becomes part of the
# pattern, silently producing an entry that matches nothing, so every comment
# in this file is on its own line. Learned in phase 1; it does not announce
# itself.
#
# Ignoring changes what chezmoi manages. It never removes or modifies a file
# on any machine.

# Repo documentation and the endpoint artifact, not dotfiles. Without these
# they land as ~/README.md and ~/bootstrap.env.example.
README.md
bootstrap.env.example

# Runbook scripts for the bootstrap endpoint. Operator tooling that is run by
# hand a few times a year, not configuration that belongs in a home directory.
# They live here rather than in the public tier because they name the endpoint
# host and route, and the public repo is cloneable by strangers.
ops
ops/**

# chezmoi's own config directory. Never manage the thing that configures the
# manager.
.config/chezmoi
.config/chezmoi/**

# Nested git checkouts.
**/.git
**/.git/**

# Generated at apply time by run_after_50-secrets.sh, never tracked anywhere.
# If this line is ever removed, `chezmoi add` on a finished machine sweeps the
# seven API keys straight into the repo.
.config/zsh/secrets.zsh

# The per-machine delta that Q5 puts opposite the base settings.json below.
# Claude Code writes this one; chezmoi must never fight it.
.claude/settings.local.json
.claude.json

# `bws` writes a 600-mode state cache here on its first successful call --
# ~/.config/bws/state/<uuid>, about 2 KB. It is derived from the access token
# and belongs in no repository. Found by watching what appeared in a throwaway
# home directory after the first apply, not by reading the documentation.
.config/bws
.config/bws/**

# The bws access token itself. `dotup` writes this from the bootstrap endpoint
# before this repo is even cloned, so chezmoi has no business managing it: a
# managed copy would overwrite a freshly-rotated token with a stale committed
# one on the next apply. It was committed exactly once, in phase 4, by a
# `chezmoi add` of the live file. Listing it here makes chezmoi decline the
# same `add` rather than accept it silently.
.config/bitwarden
.config/bitwarden/**

# ---------------------------------------------------------------- ssh ---
# Deny-by-default, then name the three things that travel. Q3 is answered as
# "sync public keys, not private": public keys are not secret, private keys
# never cross a network and are generated per machine.
#
# The wildcard is the point. An id_ed25519 generated on this machine tomorrow
# matches `.ssh/*` and is matched by no negation below, so `chezmoi add ~/.ssh`
# cannot sweep it up. New key files are excluded by default rather than
# remembered about.
#
# ~/.ssh/known_hosts is excluded by the same rule, deliberately: it is a log of
# where this machine has been, it rewrites itself constantly, and syncing it
# would make `chezmoi status` permanently dirty.
#
# NOTE THE ABSENCE of `!.ssh/*.pub`. Public keys do travel -- that is what
# ~/.ssh/pubkeys/ is for -- but NOT at ~/.ssh/id_ed25519.pub, and the
# distinction is not pedantry:
#
#   Every machine generates its own keypair. If this tier also wrote
#   id_ed25519.pub, that machine would end up with ITS private key sitting
#   next to SOMEONE ELSE'S public key under the matching name. `ssh-copy-id`
#   and every agent-only auth path read the .pub, so you would authorise the
#   wrong machine and watch it appear to work.
#
# The practical value of syncing public keys is authorized_keys -- a new box
# accepting the keys you already have, with nothing to paste. That is carried
# in full. ~/.ssh/pubkeys/*.pub is the archive of the keys you own, for pasting
# into GitHub and Gitea, parked where ssh will never mistake one for the local
# identity.
.ssh/*
!.ssh/config
!.ssh/authorized_keys
!.ssh/pubkeys
!.ssh/pubkeys/*.pub