diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..0bb123e
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,42 @@
+# Terraform caches and local directories
+**/.terraform/**
+
+# Terraform state files (contain environment state and secrets)
+*.tfstate
+*.tfstate.*
+**/terraform.tfstate
+**/terraform.tfstate.*
+**/terraform.tfstate.d/**
+
+# Crash logs
+crash.log
+crash.*.log
+**/crash.log
+**/crash.*.log
+
+# Local variable files (often contain secrets) — keep examples
+*.tfvars
+*.tfvars.json
+terraform.tfvars
+terraform.tfvars.json
+!*.tfvars.example
+!*.tfvars.json.example
+
+# Local override files
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Plan files
+*.tfplan
+*.plan
+**/*.tfplan
+**/*.plan
+
+# CLI config (rarely present in repos)
+.terraformrc
+terraform.rc
+
+# Note: intentionally DO NOT ignore .terraform.lock.hcl (commit it to lock providers)
+