ServerKit/.gitignore

# --- ServerKit Consolidated .gitignore ---

# Node / Frontend
/frontend/node_modules/
/frontend/dist/
/frontend/npm-debug.log*
/frontend/yarn-debug.log*
/frontend/yarn-error.log*
/frontend/.eslintcache
/frontend/.stylelintcache
/frontend/coverage/
/frontend/.next/
/frontend/out/
/frontend/build/

# Python (anywhere, incl. builtin-extensions/*/backend)
__pycache__/
*.pyc
*.pyo
*.pyd

# Python / Backend
/backend/venv/
/backend/instance/
/backend/__pycache__/
/backend/.pytest_cache/
/backend/.coverage
/backend/htmlcov/
/backend/.mypy_cache/
/backend/.tox/
/backend/*.pyc
/backend/*.pyo
/backend/*.pyd
/backend/.env
/backend/.venv
/backend/.venv-wsl/
/backend/pip-log.txt
/backend/pip-delete-this-directory.txt
/backend/dev-data/
# Runtime state written by cron_service.py into the shipped data dir.
/backend/app/data/cron_jobs.json
/venv/

# Go / Agent
/agent/serverkit-agent
/agent/serverkit-agent.exe
/agent/dist/
/agent/vendor/
/agent/*.test
/agent/*.out
/agent/bin/
/dist/
# Release artifacts built by .github/workflows/agent-release.yml — these are
# published to GitHub Releases, not committed. (NOTE: the *.syso resource
# objects under agent/cmd/agent/ are build INPUTS, embedded by the Go
# toolchain at build time, and are intentionally tracked.)
/packages/
*.msi
*.wixpdb

# Environment / Secrets
.env
.env.local
.env.development.local
.env.test.local
.env.production.local
# ...and any copy of one. These rules were exact-match, so a `.bak` left behind
# by an editor or by dev.ps1 rewriting its own block showed up as an untracked
# file begging to be committed — and a local env file holds the WSL IP of
# whichever machine wrote it.
.env*.local.*
.env*.local-*
*.key
*.pem
*.crt
*.csr
/backend/.env
/frontend/.env.local
/frontend/.env.development.local

# Docker
.docker-compose.untracked.yml
docker-compose.override.yml

# OS / IDE
.DS_Store
.DS_Store?
._*
.Spotlight-V100
.Trashes
ehthumbs.db
Thumbs.db
.idea/
.vscode/
*.swp
*.swo
*~
*.sublime-project
*.sublime-workspace

# Project Specific
.worktrees/
.planning_old/
.mcp.json
new_templates/
/.marketing/
/template-icons/
/.pr/
/.reviews/
/.claude/settings.local.json
/serverkit.db
/backend/instance/serverkit.db

# Logs & Temp
*.log
*.tmp
*.temp
/logs/
/tmp/
nul
SECURITY_AUDIT.md
APP_IMPROVEMENTS.md
UI_REPORT.md
SECURITY_AND_CODE_AUDIT.md
# Scratch screenshots dropped at the repo root. Real image assets live under
# frontend/ or are force-included below (agent/internal/setupui/*).
*.png
*.jpeg
*.jpg
# …except the README screenshots, generated from mock data by the local
# `screenshots` skill — these are real committed assets.
!/docs/screenshots/
!/docs/screenshots/*.png

# …and the hand-authored documentation diagrams (architecture) plus the locally
# generated donation QR codes (funding). Both are referenced directly from
# committed Markdown, so leaving them ignored publishes docs with broken images.
!/docs/images/
!/docs/images/architecture/*.png
!/docs/images/funding/*.png

# …and the bundled marketplace extension cover icons — real source assets
# imported/hashed by Vite, so they must be committed.
!/frontend/src/assets/extension-icons/
!/frontend/src/assets/extension-icons/*.png

# MSI / build artifacts that should not be committed.
/agent/packaging/msi/output/
/agent/packaging/msi/*.wixpdb

# Release tarballs built by scripts/build-release.sh
/serverkit-*.tar.gz
/serverkit-*.tar.gz.sha256
/serverkit.bak

# Brand assets that the agent embeds at build time are generated by
# agent/packaging/icons/generate_icons.py from the SVG, but must be checked
# in so CI builds don't have to install cairo/Pillow.
!agent/internal/setupui/serverkit.ico
!agent/internal/setupui/serverkit_header.png
docs/PLAN_AGENT_FLEET.md
/docs/plans
/.agents
/.extension-platform-plan/
/.claude
/.github/skills
/.playwright-mcp
docs/audits/UI_CONSISTENCY_AUDIT.md
docs/REMOTE_ACCESS_ROADMAP.md
docs/NOTIFICATIONS_ROADMAP.md
docs/ORCHESTRATION_ROADMAP.md
docs/DNS_ROADMAP.md
docs/SERVICES_ROADMAP.md

# Staging target profiles (scripts/stage.sh) — real profiles carry a host alias
# + paths and must never enter the repo. The committed template is the sole
# exception so `cp example.env <name>.env` always has a starting point.
/deploy/targets/*.env
!/deploy/targets/example.env

# Vite dependency pre-bundle cache (regenerated on every dev run; never commit)
.vite/
**/.vite/

# Install artifacts of extensions that now live in their own repos.
# The panel writes these when the extension is installed from the registry
# (see PluginService._install_from_buffer). They must never be committed back
# here — the source of truth is the extension's own repo, and vendoring a copy
# guarantees the two drift apart.
backend/app/plugins/serverkit-analytics/
backend/app/plugins/serverkit-cloud-provision/
backend/app/plugins/serverkit-crowdsec/
backend/app/plugins/serverkit-dns-server/
backend/app/plugins/serverkit-email/
backend/app/plugins/serverkit-ftp/
backend/app/plugins/serverkit-gpu/
backend/app/plugins/serverkit-gui/
backend/app/plugins/serverkit-k8s/
backend/app/plugins/serverkit-mail/
backend/app/plugins/serverkit-remote-access/
backend/app/plugins/serverkit-status/
backend/app/plugins/serverkit-tramo/
backend/app/plugins/serverkit-wordpress/
frontend/src/plugins/serverkit-analytics/
frontend/src/plugins/serverkit-crowdsec/
frontend/src/plugins/serverkit-dns-server/
frontend/src/plugins/serverkit-email/
frontend/src/plugins/serverkit-gpu/
frontend/src/plugins/serverkit-gui/
frontend/src/plugins/serverkit-k8s/
frontend/src/plugins/serverkit-mail/
frontend/src/plugins/serverkit-tramo/
frontend/src/plugins/serverkit-wordpress/
/graphify-out

# Extension release signing keys (private halves — never commit; see scripts/sign-extension.mjs)
scripts/keys/