; dolt.sr.ht configuration.
;
; In production this section is merged into the single shared instance
; config.ini (the same file every *.sr.ht service reads). Only the keys in the
; [dolt.sr.ht] section below are ours; the rest are shared keys owned by other
; services and referenced (NOT duplicated) here — they must already be present
; and consistent across the instance.
;
; Deployment prerequisite: this host must be inside meta's [meta.sr.ht::api]
; internal-ipnet, because token validation (FetchMetaProfile +
; LookupTokenRevocation) uses internal authentication against meta.

[dolt.sr.ht]
;
; The URL dolt.sr.ht is served at (protocol://domain). This is also the JWT
; audience the Bearer (dolt creds) auth flow checks against, so it must match
; the host clients pass to `dolt login --auth-endpoint`.
origin=https://dolt.srht.bigb.es
;
; The URL this service's API is served at. It is what api.sr.ht federates:
; the gateway appends "/query" to it, fetches the schema, and merges dolt's
; types into the instance-wide endpoint. There is no second listener — /query
; rides the web one — so this is normally the origin above, and it is only
; worth setting when the API is reachable at a different name. Omit it and
; nothing breaks except federation, which core-go's GetAPI then cannot resolve.
;api-origin=https://dolt.srht.bigb.es
;
; PostgreSQL connection string for the dolt.sr.ht metadata database (users
; mirror, repositories, ACLs, dolt keys).
connection-string=postgresql://doltsrht@localhost/dolt.sr.ht?sslmode=disable
;
; Root directory holding the bare NBS chunk-store dirs, one per database at
; <repos>/~<user>/<name>. This is what remotesrv serves and file:// remotes use.
repos=/var/lib/dolt
;
; Address for the remotesapi listener (gRPC ChunkStoreService + HTTP chunk data
; plane, h2c-multiplexed on one port). nginx grpc_pass/proxy_pass targets this.
remotesapi-listen=127.0.0.1:5306
;
; Address for the small CredentialsService.WhoAmI gRPC listener used by the
; `dolt login` keypair flow. nginx path-routes the CredentialsService here.
credsapi-listen=127.0.0.1:5308
;
; Directory containing the built static assets (main.min.<sha>.css, logo.svg).
static-dir=/usr/share/sourcehut/dolt.sr.ht/static
;
; Set to "yes" to run brant migrations automatically on package upgrade.
migrate-on-upgrade=yes
;
; Verbosity of the daemon's structured log: debug, info, warn or error. An
; unreadable value is read as info rather than refusing to boot — a typo in a
; logging preference must not cost the service.
;
; This is the persistent setting. For one run, $LOG_LEVEL overrides it and the
; -d flag overrides both — and both apply from the first line of startup, before
; the config below has been read.
log-level=info
;
; The GraphQL read schema is served at /query on the same web listener, and has
; no key of its own either, for the same reason. What it answers is decided by
; the credential presented — the bearer plane /mcp defines, or none at all for
; an anonymous caller reading public databases — and by the visibility rules the
; web UI applies. Beside it, /query/api-meta.json tells meta.sr.ht that this
; service defines the "repos" grant, which is what makes
; "dolt.sr.ht/repos:RO" offerable on the personal-token page.
;
; There is deliberately no mcp-enabled key. The read-only MCP surface an agent
; calls (docs/DESIGN.mcp.md) is served at /mcp on the web listener above,
; wherever this daemon runs: a surface that is off in production and on in a
; test is a surface nobody tests. What a caller may read there is decided by the
; credential it presents and by the same visibility rules the web UI applies,
; never by a switch here. The origin above doubles as its Host allowlist, so a
; request forwarded under any other name is refused before it is parsed.

; ---------------------------------------------------------------------------
; Shared keys reused in place (owned by other services, listed for reference;
; do not duplicate their values here — they live in the shared config.ini):
;
;   [sr.ht] network-key      shared secret for internal service auth
;   [sr.ht] site-name        used to render the shared nav brand
;   [sr.ht] environment      non-"production" adds a banner to every page
;   [sr.ht] owner-name / owner-email   author of the initial empty commit
;   [webhooks] private-key    derives the offline Bearer-token HMAC key
;   [meta.sr.ht] origin       meta's URL (login redirects, profile fetch)
;   [meta.sr.ht::api] internal-ipnet   subnets allowed to use internal auth
;   [tokens.sr.ht] origin     where the instance's token daemon answers. It
;                             enables the working-token plane of /mcp: a token
;                             minted by tokens.sr.ht is verified against this
;                             address (the revocation check) and must carry the
;                             dolt:read grant. internal-origin, when set, is
;                             preferred for that check — container to container
;                             rather than out through the reverse proxy and
;                             back. Absent, this instance runs no such daemon:
;                             the daemon still starts, /mcp still answers
;                             anonymous callers and meta personal access tokens,
;                             and a working token is refused with 401 because a
;                             credential we cannot verify is refused rather than
;                             guessed at. The startup line says
;                             instance_tokens=disabled on such an instance.
; ---------------------------------------------------------------------------