# Terraform working files — never commit these.
.terraform/
*.tfstate
*.tfstate.*
.terraform.tfstate.lock.info
crash.log
crash.*.log

# tfvars may hold secrets (hcloud_token); keep examples only.
*.tfvars
*.tfvars.json
!*.tfvars.example

# Fetched kubeconfig (phase 2 output).
infra.kubeconfig

# NOTE: .terraform.lock.hcl IS committed (pins provider versions for CI).
