# Files that belong here (committed to repo):
#   ca.crt           — Nebula CA certificate (public)
#   *.crt            — per-host certificates (public)
#   *.key.age        — agenix-encrypted private keys (safe to commit)
#
# Files that must NEVER be committed:
#   ca.key           — CA private key (keep offline!)
#   *.key            — plaintext host private keys (encrypt with agenix first)