# Keep the build context small and NEVER bake secrets or host-built artifacts into the image.

# Secrets — must never enter the image (env is injected by Dokploy at runtime).
.env
.env.*
!.env.example

# Dependencies + build outputs (reinstalled / rebuilt inside the image).
node_modules
**/node_modules
apps/web/dist
apps/api/dist
dist
build
.turbo
.cache
coverage

# VCS / CI / editor / OS noise.
.git
.gitignore
.github
.vscode
.idea
.DS_Store
Thumbs.db

# Logs and legacy Plesk/Passenger runtime scratch.
*.log
logs
tmp

# Local-only storage dirs (documents live in Spaces).
storage
uploads

# Tests and test tooling aren't needed in the runtime image.
apps/api/test
**/*.test.ts
**/*.spec.ts
**/vitest.config.ts
**/vitest.*.config.ts

# Destructive/privileged one-off scripts must NOT ship in the runtime image: an attacker with
# code-exec in the container has DATABASE_URL in-env, so keeping these off disk removes the sharpest
# RCE-amplification tools. Root-anchored to the top-level scripts/ only (apps/web/scripts, used by the
# web build, is a different directory and is kept). DB migrations run via `npm run db:migrate`
# (packages/db), not from scripts/, so this does not affect builds or deploys.
#
# The routine, non-destructive cron scripts (retention-sweep, send-overdue-reminders,
# sweep-orphaned-storage) are intentionally KEPT so Dokploy scheduled jobs can invoke them inside
# the container (e.g. `npm run cron:retention`, which enforces Privacy-Policy retention windows).
/scripts/seed-demo.ts
/scripts/create-admin.ts
/scripts/migrate-storage-to-spaces.ts
/scripts/plesk-deploy.sh

# Note: certs/ is intentionally NOT ignored — the Postgres CA cert (if committed) is baked in
# so production TLS verification works. See DEPLOY-DOKPLOY.md.