# Nix build results
result
result-*

# sops age keys (never commit private keys)
*.age
keys.txt
!keys.txt.age

# Explicitly (dis)allow specific keys/secrets
secrets/ssh-private

# macOS
.DS_Store
._.DS_Store
**/.DS_Store
**/._.DS_Store

# secrets (encrypted via sops, but extra safety)
secrets/*.yaml~

# Editor
.direnv/
.envrc