chore: require clean production deploys

.dockerignore

@@ -1,4 +1,8 @@
 .git
+.agents
+.codex
+.pnpm-store
+skills-lock.json
 .next
 .env
 .env.*
@@ -6,7 +10,10 @@
 .DS_Store
 node_modules
 content.db
+next-env.d.ts
 public/media
+public/robots.txt
+public/sitemap*.xml
 tsconfig.tsbuildinfo
 playwright-report
 test-results

.gitignore

@@ -1,6 +1,7 @@
 build
 dist / media
 node_modules
+.pnpm-store/
 .DS_Store
 .env
 .next

docs/vps-deployment.md

@@ -75,21 +75,15 @@ pnpm deploy:vps
 
 The deploy script:
 
-1. refuses to deploy a dirty worktree by default
+1. refuses to deploy a dirty worktree
 2. rsyncs code to `/var/www/bmp-website/current`
-3. excludes `.env`, `content.db`, `public/media`, `.next`, and `node_modules`
+3. excludes runtime state, dependency caches, generated files, and local agent tooling
 4. writes the deployed Git revision to `.deploy-revision`
 5. builds the Docker image on the VPS
 6. recreates only the `bmp_website` app container
 7. verifies `/` and `/admin`
 
-If you intentionally need an ad-hoc deploy before committing:
+The required workflow is:
-
-```bash
-ALLOW_DIRTY=1 pnpm deploy:vps
-```
-
-Use that sparingly. The preferred workflow is:
 
 ```text
 commit locally -> deploy that commit -> verify production

scripts/deploy-vps.sh

@@ -11,7 +11,6 @@ SSH_KEY="${SSH_KEY:-$HOME/.ssh/bmp-vps-deploy}"
 APP_ROOT="${APP_ROOT:-/var/www/bmp-website}"
 APP_DOMAIN="${APP_DOMAIN:-srv1.bayerischer-mittelstandspreis.de}"
 PUBLIC_URL="${PUBLIC_URL:-https://$APP_DOMAIN}"
-ALLOW_DIRTY="${ALLOW_DIRTY:-0}"
 DEPLOY_CADDY="${DEPLOY_CADDY:-0}"
 RUN_MIGRATIONS="${RUN_MIGRATIONS:-0}"
 SKIP_VERIFY="${SKIP_VERIFY:-0}"
@@ -24,9 +23,9 @@ if [[ ! -f "$SSH_KEY" ]]; then
   exit 1
 fi
 
-if [[ "$ALLOW_DIRTY" != "1" && -n "$(git status --porcelain)" ]]; then
+if [[ -n "$(git status --porcelain)" ]]; then
   echo "Refusing to deploy a dirty worktree." >&2
-  echo "Commit or stash changes first, or run with ALLOW_DIRTY=1 for an intentional ad-hoc deploy." >&2
+  echo "Commit or stash changes first." >&2
   exit 1
 fi
 
@@ -36,13 +35,20 @@ echo "Deploying $REVISION to $SSH_TARGET:$APP_ROOT"
 
 rsync -az --delete \
   --exclude '.git/' \
+  --exclude '.agents/' \
+  --exclude '.codex/' \
+  --exclude '.pnpm-store/' \
+  --exclude 'skills-lock.json' \
   --exclude '.env' \
   --include '.env.example' \
   --exclude '.env.*' \
   --exclude '.next/' \
   --exclude 'node_modules/' \
   --exclude 'content.db' \
+  --exclude 'next-env.d.ts' \
   --exclude 'public/media/' \
+  --exclude 'public/robots.txt' \
+  --exclude 'public/sitemap*.xml' \
   --exclude '.DS_Store' \
   --exclude 'tsconfig.tsbuildinfo' \
   -e "ssh -i $SSH_KEY -p $VPS_PORT" \