.env
data/
result

# Binary cache state + signing keys. The cache.sec must never be
# committed; the public key is regenerated per deployment too
# (`nix-store --generate-binary-cache-key`).
cache/

# Caddy state: ACME account + issued certs + on-disk config tree.
caddy/