diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..b4d3ba2
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,4 @@
+# Local-only files that must never be pushed to gitea (secrets, real
+# firewall/NAT exports, private notes, etc.). Anything dropped in here
+# stays local.
+private/