From 42c805f430ab8f96aea3e614e83fd8c6ef385730 Mon Sep 17 00:00:00 2001
From: ahmza <hamza@ahmza.com>
Date: Thu, 6 Aug 2026 17:07:59 +0100
Subject: [PATCH] untrack the build result symlink and harden .gitignore

result is a symlink into /nix/store that nix build rewrites on every
invocation, so tracking it churns the history and pins a store path that
means nothing on any other machine. it was committed pointing at a t480
system while sitting on shadow.

the two git-secret lines are what `git secret init` writes. worth being
explicit about what they do and do not cover: `!*.secret` un-ignores the
*encrypted* blobs only. nothing here protects the plaintext originals -
that relies entirely on `git secret add` appending each plaintext path to
this file, so always run it from the repo root rather than hand-editing
.gitsecret/paths/mapping.cfg.

.gitsecret/keys is git-secret's gpg homedir. pubring.kbx is meant to be
committed, but a stray `gpg --homedir .gitsecret/keys --import` of a
private key would drop private-keys-v1.d/ in there, so those paths are
ignored up front rather than after the fact.
---
 .gitignore | 23 +++++++++++++++++++++++
 result     |  1 -
 2 files changed, 23 insertions(+), 1 deletion(-)
 delete mode 120000 result

diff --git a/.gitignore b/.gitignore
index 1f8011a..f0c7373 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,24 @@
 .session
+
+# `nix build` / `nixos-rebuild build` output symlink. Points into /nix/store and
+# churns on every build, so it must not be tracked.
+result
+result-*
+
+# git-secret. `git secret init` writes the random_seed and the `!*.secret`
+# negation; the rest is hardening.
+#
+# WARNING: `!*.secret` only un-ignores the *encrypted* blobs. It does nothing to
+# protect the plaintext originals -- that relies entirely on `git secret add`
+# appending each plaintext path below. Always run `git secret add <file>` from
+# the repo root (never hand-edit .gitsecret/paths/mapping.cfg) and verify with
+# `git status` before committing.
+.gitsecret/keys/random_seed
+# .gitsecret/keys is git-secret's GPG homedir. pubring.kbx is meant to be
+# committed; private key material and sockets never are.
+.gitsecret/keys/private-keys-v1.d/
+.gitsecret/keys/openpgp-revocs.d/
+.gitsecret/keys/*.gpg~
+.gitsecret/keys/.#*
+.gitsecret/keys/S.*
+!*.secret
diff --git a/result b/result
deleted file mode 120000
index 90987da..0000000
--- a/result
+++ /dev/null
@@ -1 +0,0 @@
-/nix/store/dgd4pa9cl1n266zsbf8xi277p304zxcw-nixos-system-t480-26.05.20260803.531670d
\ No newline at end of file