; dolt.sr.ht configuration.
;
; In production this section is merged into the single shared instance
; config.ini (the same file every *.sr.ht service reads). Only the keys in the
; [dolt.sr.ht] section below are ours; the rest are shared keys owned by other
; services and referenced (NOT duplicated) here — they must already be present
; and consistent across the instance.
;
; Deployment prerequisite: this host must be inside meta's [meta.sr.ht::api]
; internal-ipnet, because token validation (FetchMetaProfile +
; LookupTokenRevocation) uses internal authentication against meta.

[dolt.sr.ht]
;
; The URL dolt.sr.ht is served at (protocol://domain). This is also the JWT
; audience the Bearer (dolt creds) auth flow checks against, so it must match
; the host clients pass to `dolt login --auth-endpoint`.
origin=https://dolt.srht.bigb.es
;
; PostgreSQL connection string for the dolt.sr.ht metadata database (users
; mirror, repositories, ACLs, dolt keys).
connection-string=postgresql://doltsrht@localhost/dolt.sr.ht?sslmode=disable
;
; Root directory holding the bare NBS chunk-store dirs, one per database at
; <repos>/~<user>/<name>. This is what remotesrv serves and file:// remotes use.
repos=/var/lib/dolt
;
; Address for the remotesapi listener (gRPC ChunkStoreService + HTTP chunk data
; plane, h2c-multiplexed on one port). nginx grpc_pass/proxy_pass targets this.
remotesapi-listen=127.0.0.1:5306
;
; Address for the small CredentialsService.WhoAmI gRPC listener used by the
; `dolt login` keypair flow. nginx path-routes the CredentialsService here.
credsapi-listen=127.0.0.1:5308
;
; Directory containing the built static assets (main.min.<sha>.css, logo.svg).
static-dir=/usr/share/sourcehut/dolt.sr.ht/static
;
; Set to "yes" to run brant migrations automatically on package upgrade.
migrate-on-upgrade=yes

; ---------------------------------------------------------------------------
; Shared keys reused in place (owned by other services, listed for reference;
; do not duplicate their values here — they live in the shared config.ini):
;
;   [sr.ht] network-key      shared secret for internal service auth
;   [sr.ht] site-name        used to render the shared nav brand
;   [sr.ht] environment      non-"production" adds a banner to every page
;   [sr.ht] owner-name / owner-email   author of the initial empty commit
;   [webhooks] private-key    derives the offline Bearer-token HMAC key
;   [meta.sr.ht] origin       meta's URL (login redirects, profile fetch)
;   [meta.sr.ht::api] internal-ipnet   subnets allowed to use internal auth
; ---------------------------------------------------------------------------