From 24eaccd7a881829683bafe4d1da147b544114526 Mon Sep 17 00:00:00 2001
From: Graham McInitre <graham.mcintire@island.io>
Date: Wed, 22 Jul 2026 08:36:40 -0500
Subject: [PATCH] chore: track .envrc, gitignore .envrc.local for secrets

.envrc contains shared direnv/Nix setup (no secrets). Local overrides
and secrets belong in .envrc.local, which is now gitignored.
---
 .envrc     | 7 +++++++
 .gitignore | 3 ++-
 2 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 .envrc

diff --git a/.envrc b/.envrc
new file mode 100644
index 00000000..eb95343b
--- /dev/null
+++ b/.envrc
@@ -0,0 +1,7 @@
+# shellcheck shell=bash
+# shellcheck disable=SC1091
+
+use flake . --impure
+
+dotenv_if_exists .env.local
+
diff --git a/.gitignore b/.gitignore
index 7bc4ce60..6cbe5457 100644
--- a/.gitignore
+++ b/.gitignore
@@ -60,7 +60,8 @@ npm-debug.log
 /priv/plts/
 
 # Environment variables (used by direnv and Kustomize secretGenerator)
-.envrc
+# .envrc is tracked — put local secrets in .envrc.local
+.envrc.local
 k8s/.envrc
 
 /towerops-agent/