# Vault password file (NEVER commit)
.vault_pass

# Encrypted vault files should be committed, but plaintext should not
# (bootstrap-vault.sh encrypts automatically if .vault_pass exists)

# Ansible retry files
*.retry

# SSH keys
*.pem
*.key
id_rsa*