# ============================================================
# Home Assistant Config Repository – .gitignore
# ============================================================
# Strategy: Default-deny for sensitive areas.
# .storage/* uses an explicit allowlist for files we DO want versioned.
# ============================================================

# === Secrets (Top-Level) ===
secrets.yaml
*.key
*.pem
*.crt
known_devices.yaml
.uuid
*credentials.json
ps5-mqtt/credentials.json

# === Datenbanken & Logs ===
home-assistant_v2.db*
home-assistant.log*
*.log
*.log.*
.ha_run.lock

# === Caches & Runtime ===
tts/
image/
deps/
.cloud/
.cache/
__pycache__/
*.pyc
OZW_Log.txt

# === HACS / Frontend Community Cards ===
www/community/

# === Custom Components – haben eigene Repos ===
custom_components/

# === Z2M-Runtime (enthält Network Keys → SECRETS!) ===
zigbee2mqtt/log/
zigbee2mqtt/database.db
zigbee2mqtt/database.db.tmp.*
zigbee2mqtt/state.json
zigbee2mqtt/coordinator_backup.json
zigbee2mqtt/device_icons/

# === ESPHome Build Artefakte ===
esphome/.esphome/
esphome/.pioenvs/
esphome/.piolibdeps/
esphome/secrets.yaml

# === AppDaemon Runtime & Vendor Code ===
appdaemon/logs/
appdaemon/.cache/
# ControllerX wird per HACS-AppDaemon gemanagt
appdaemon/apps/controllerx/

# === Voice Satellite Wake-Word Modelle (extern trainiert/downloadbar) ===
voice_satellite/

# === Backups (HAOS Backups, manuelle Snapshots) ===
backup/
backups/
*.tar
*.tar.gz

# === Editor / OS ===
.DS_Store
Thumbs.db
*.swp
*.swo
*~
.vscode/
.idea/

# === Claude Code projekt-lokale Settings ===
.claude/settings.local.json
.claude/file-history/
.claude/sessions/
.claude/ha_token
.claude/secrets/
*.token

# ============================================================
# .storage/ – ALLOWLIST-STRATEGIE
# Default: alles ignorieren. Dann gezielt whitelisten.
# ============================================================
.storage/*
.storage/**

# --- Verzeichnis selbst zulassen (sonst wirken die Whitelists nicht) ---
!.storage/

# --- Whitelist: Dashboards & Lovelace (für Refactoring) ---
!.storage/lovelace
!.storage/lovelace.*
!.storage/lovelace_dashboards
!.storage/lovelace_resources
!.storage/map

# --- Whitelist: Helper (für YAML-Migration) ---
!.storage/input_boolean
!.storage/input_button
!.storage/input_datetime
!.storage/input_number
!.storage/input_select
!.storage/input_text
!.storage/timer
!.storage/counter
!.storage/schedule
!.storage/scheduler.storage

# --- Whitelist: Registries (Areas/Floors/Labels — sicher, keine Tokens) ---
!.storage/core.area_registry
!.storage/core.floor_registry
!.storage/core.label_registry
!.storage/core.category_registry

# --- Whitelist: Energy-Dashboard-Konfig ---
!.storage/energy

# --- Whitelist: Frontend-Panels & exposed_entities (UI-Struktur) ---
!.storage/frontend_panels
!.storage/homeassistant.exposed_entities

# --- Whitelist: Powercalc Group-Definitionen (Konfig, kein Secret) ---
!.storage/powercalc_group

# ============================================================
# WICHTIG – diese .storage-Files NIEMALS tracken (Tokens/Keys!):
#   core.config_entries  → 28 OAuth-Tokens und API-Keys
#   core.device_registry → MACs, Seriennummern (Privacy)
#   core.entity_registry → groß, ändert sich ständig (Noise)
#   core.restore_state   → Runtime-State, ändert sich sekündlich
#   core.config          → Längengrad/Breitengrad (Privacy)
#   alarmo.storage       → Alarm-PINs
#   androidtv_adbkey*    → RSA Private Keys
#   esphome.*            → ESPHome Verschlüsselungs-Keys
#   mobile_app           → Push-Tokens
#   tapo_control_*       → Tapo Auth
#   unifi_data           → Unifi Auth
#   roborock/            → Roborock Auth
#   home_agent.*         → AI-Memories (Privacy)
#   waste_collection_schedule.device_keys → API-Keys
#   nibe_energy_conversion_data_* → Werte (Daten, kein Config)
#   bluetooth.*          → Bluetooth-Geräte-Liste
#   homekit_controller*  → HomeKit-Pairing-Daten
#   hassio               → Supervisor-Daten
#   trace.saved_traces   → Trace-Logs
#   hacs.*               → HACS-Cache
#   zone                 → Heim-Adresse/Koordinaten
#   assist_pipeline.pipelines → Cloud-API-Konfig
# Bewusst NICHT in der Whitelist oben.
# ============================================================