# Secrets and key material never go in git
.env
*.key
*.pem
openvpn/pki/*
!openvpn/pki/README.md
duo-authproxy/certs/*
!duo-authproxy/certs/README.md

# Technitium runtime state (config DB) when running from the repo dir
technitium/config/

# Ansible: real inventory + secret-bearing vars stay local (vault or not)
ansible/inventory.yml
ansible/group_vars/vpnhub.yml