# Terraform working dir + plugins
.terraform/

# Local state (holds secrets — never commit)
*.tfstate
*.tfstate.*
crash.log
crash.*.log

# tfvars carry real secrets — ignore all except the checked-in example
*.tfvars
!*.tfvars.example

# The dependency lock IS committed (pins provider versions across machines) — keep it.
!.terraform.lock.hcl