# Prepared zones are generated from zones/ by scripts/prepare-zones.sh
zones-prepared/*.zone

# Self-signed certs (re-generated by scripts/generate-certs.sh)
certs/*.pem

# Caddy's runtime data: issued certs, ACME account keys, transient state.
# NEVER commit — contains the ACME account private key.
caddy-data/
caddy-config/

# Local-only env overrides
.env.local