.env
backups/
drasl/config/keycloak-client-secret
runtime/authlib-injector.jar

# rendered configs (from tooling/render-config.sh)
drasl/config/config.toml
nmsr/config.toml
# holds the admin bcrypt hash, the shared player hash, the session key and the
# local-backend secret — only the .tmpl is tracked
filestash/config.json

# server mod subset synced from the distribution repo by
# tooling/sync-server-mods.sh (source of truth is mods-sides.json + $DIST jars)
server-mods/

# mod configs, seeded out of the mc_data volume by tooling/export-server-config.sh
# and then bind-mounted rw at /data/config. Host-specific runtime state (cochi and
# oxps diverge), regenerated by the mods themselves — not a source of truth.
server-config/

# vendored binaries
launcher/

# offline data mirror for generators.${BASE_DOMAIN} (~107M of mcmeta +
# vanilla-mcdoc), synced by tooling/sync-generators-data.sh. Needs WAN, so it is
# fetched deliberately before the party — never at the venue.
generators-data/

# landing page: generated build output + deps
www/
landing/node_modules/
landing/.astro/
landing/dist/

# launcher download list: the custom-launcher build output launcher.json,
# synced from UlicraftLauncher/dist/launcher.json (launcher.example.json is
# committed as the documented shape)
landing/src/data/launcher.json

# mod catalogue + extracted logos: generated by tooling/build-modlist.py from
# the distribution forgemods (the .example.json is committed as the empty shape)
landing/src/data/mods.json
landing/public/mod-logos/

# compiled mc-status binary (built into the image; stray local `go build` output)
docker/mc-status/mc-status

# Let's Encrypt certs + private keys (issued by tooling/issue-letsencrypt.sh)
certs/

# migration bundles (migrate-export.sh) — hold .env secrets + LE private keys
ulicraft-bundle-*.tar.gz
