keys/*
!keys/*.*

# Ansible Vault secrets — never commit plain-text secrets
ansible/group_vars/vault.yml