From 70814970c7034767839b31b8bcb4b5b70614f08c Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Wed, 26 Aug 2026 22:32:32 -0700
Subject: [PATCH] Harden .gitignore: broaden .env exclusion to *.env (with
 explicit exceptions for global.env and *.env-example templates), ignore stray
 .bak files

---
 .gitignore | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.gitignore b/.gitignore
index 64ac7cb..78cf072 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,8 +2,17 @@
 *.swp
 *.swo
 .DS_Store
+
+# Secrets / stack env files - never commit these.
+# deploy/global.env and immich.env-example etc. are the intended committed
+# templates/examples; actual secret-bearing .env files must stay untracked.
 .env
 .env.local
+*.env
+!*.env-example
+!deploy/global.env
+*.env.bak
+*.env.backup
 secrets/
 keys/
 *.key
@@ -15,3 +24,7 @@ keys/
 # Local overrides
 docker-compose.override.yml
 local/
+
+# Editor/adhoc backups that sometimes get left in the tree
+*.bak
+*.bak-*