.session

# `nix build` / `nixos-rebuild build` output symlink. Points into /nix/store and
# churns on every build, so it must not be tracked.
result
result-*

# git-secret. `git secret init` writes the random_seed and the `!*.secret`
# negation; the rest is hardening.
#
# WARNING: `!*.secret` only un-ignores the *encrypted* blobs. It does nothing to
# protect the plaintext originals -- that relies entirely on `git secret add`
# appending each plaintext path below. Always run `git secret add <file>` from
# the repo root (never hand-edit .gitsecret/paths/mapping.cfg) and verify with
# `git status` before committing.
.gitsecret/keys/random_seed
# .gitsecret/keys is git-secret's GPG homedir. pubring.kbx is meant to be
# committed; private key material and sockets never are.
.gitsecret/keys/private-keys-v1.d/
.gitsecret/keys/openpgp-revocs.d/
.gitsecret/keys/*.gpg~
.gitsecret/keys/.#*
.gitsecret/keys/S.*
!*.secret