# Real secrets / domain — never commit
.env
CREDENTIALS.txt

# Traefik ACME storage (contains private keys + certificates)
traefik/acme/acme.json

# Runtime data (bind-mounted host folders, not named volumes)
postgres/data/*
!postgres/data/.gitkeep

synapse/data/*
!synapse/data/.gitkeep

# Rendered configs (contain the real domain) — templates are tracked instead
element/config/config.json
synapse-admin/config/config.json
wellknown/html/well-known-matrix-client.json
traefik/dynamic/routes.yml