# What does not get sent to the Docker daemon as build context.
#
# Note what this file can and cannot do: the Dockerfile never does `COPY . .`, it
# copies only agent/, run.py and README.md. So nothing here changes the
# contents of the image -- it only decides how much of your tree is uploaded on
# every `docker compose build`. The security-relevant entries (certs/, .env,
# *.key) matter because a build context is transmitted, and because a stray
# secret in the tree is one `COPY . .` away from being baked in.
#
# This is one of three separate ignore mechanisms in this project, and each tool
# reads only its own: .gitignore for git, this file for Docker, and the
# --exclude flags in run_backup.sh for the backup archive. Changing one does not
# change the others. Keep them in step by hand.

# --- secrets ---------------------------------------------------------------
# .env is machine-local configuration and may hold TOMTOM_API_KEY. Docker Compose
# reads it for variable substitution at run time, which is independent of the
# build context -- excluding it here does not break `docker compose up`.
.env

# certs/ is generated by make-cert.sh. Compose mounts it read-only at run time
# (- ./certs:/certs:ro), so it does not need to be in the image either.
certs/

# Belt and braces, matching run_backup.sh: catch key material outside certs/.
# *.crt is not a secret, but certs/ is regenerated wholesale anyway.
*.key
*.pem
*.p12
*.pfx
*.crt

# --- runtime state ---------------------------------------------------------
# .run/ holds server.pid, written by run_server.sh. server.log is in logs/,
# kept separate on purpose: the pid file is machine-local state and must never
# travel, while a log is something you actually read and keep. Neither belongs in
# a build, though, and the log is the entry that really costs something: it grows
# without bound while the server runs, so every build would re-upload the whole
# log so far.
.run/
logs/

# backups/ holds archives of this whole tree -- currently one 552K .tar.gz per
# backup run, growing forever. They are not source and are of no use inside a
# container.
backups/

# data/ is bind-mounted at run time (- ./data:/data) precisely so it stays out
# of the image and survives rebuilds. data/ is the largest directory in the tree:
# postal_codes.csv alone is 2.4 MB.
data/

# --- build noise -----------------------------------------------------------
# Nur mit Pfad, nicht als blasses '__pycache__/'. Gemessen: '__pycache__/',
# '**/__pycache__' und '**/__pycache__/**' lieferten alle 11 .pyc im Image,
# 'src/agent/__pycache__/' dagegen 0. Docker matcht hier nicht auf den Basisnamen
# in beliebiger Tiefe -- deshalb nennt der Dockerfile-Aufbau unten die Pfade.
src/agent/__pycache__/
src/agent/rag/__pycache__/
tests/__pycache__/
*.pyc
*.pyo
.pytest_cache/
.venv/
venv/

# .rag-model/ is the fastembed ONNX model cache, ~241 MB, downloaded from Hugging
# Face. Derived state; uploading it on every build would dominate the context. The
# image fetches its own copy in a Dockerfile layer, so this changes nothing inside.
.rag-model/
.git/

# .rag-cache/ is the vector index the optional retrieval layer builds from data/.
# data/ is already excluded here because it is bind-mounted, and the index is
# derived from it, so the same reasoning applies: nothing to do inside the image,
# and it would otherwise be uploaded on every build. Not that it changes what the
# image contains -- the Dockerfile copies only agent/, run.py and README.md.

# .tile-cache/ is the map tiles web.py's /api/tile proxy caches on disk. Same
# reasoning as .rag-cache above: derived, disposable, and unwanted in the build
# context. Unlike the index it does need a directory inside the image -- the
# server writes to it as a non-root uid -- so the Dockerfile creates it.

# .gitignore itself is not needed to build or run anything.
.gitignore

# --- docs ------------------------------------------------------------------
# Keeps HOWTO.md and AGENTS.md out of the context; the README is copied into the
# image by the Dockerfile, so the negation below is what makes that COPY work.
*.md
!README.md

# --- OS cruft --------------------------------------------------------------
# Both, because this tree is worked on from macOS and Windows.
.DS_Store
Thumbs.db
desktop.ini
