diff --git a/.gitignore b/.gitignore
index e6e1675..f2b6e79 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,17 +8,16 @@ flatcar/flatcar_production_qemu_image.img.fresh
 
 ignition.json
 
-production.tfvars
 
 terraform.tfstate
 terraform.tfstate.backup
 
 app
 
-apps.config
-
-restic-env
-restic-password
+config/apps.config
+config/restic-env
+config/restic-password
+config/production.tfvars
 
 # generated files
 all-apps/lb/Caddyfile
diff --git a/Makefile b/Makefile
index ac22e2a..78f769c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 TERRAFORM_ENV := production
 
-config_dir := ./
+config_dir := ./config/
 apps_config := $(config_dir)apps.config
 
 # .dirstamp plus && $@ is like make magic to get this rule
diff --git a/cl.yaml b/cl.yaml
index d065e44..69bcea1 100644
--- a/cl.yaml
+++ b/cl.yaml
@@ -88,10 +88,10 @@ storage:
   files:
     - path: /restic-password
       contents:
-        local: restic-password
+        local: config/restic-password
     - path: /restic-env
       contents:
-        local: restic-env
+        local: config/restic-env
     ### docker-compose sysext
     ### https://flatcar.github.io/sysext-bakery/docker_compose/
     - path: /opt/extensions/docker-compose/docker-compose-2.34.0-x86-64.raw
diff --git a/apps.config.tmpl b/config/apps.config.tmpl
similarity index 100%
rename from apps.config.tmpl
rename to config/apps.config.tmpl
diff --git a/restic-env.tmpl b/config/restic-env.tmpl
similarity index 100%
rename from restic-env.tmpl
rename to config/restic-env.tmpl
diff --git a/template.tfvars b/config/template.tfvars
similarity index 100%
rename from template.tfvars
rename to config/template.tfvars