HARBOR:
  # Choose exactly one Harbor source mode:
  # SOURCE_DIR: "/srv/harbor/src"
  CLONE_URL: "https://git.peisongxiao.com/peisongxiao/harbor.git"
  BRANCH: "master"
  DATABASE_URL: "postgres://harbor:replace-me@127.0.0.1:5432/harbor?sslmode=disable"
  DEPLOY_ROOT: "/var/www/harbor"
  RETAIN_DEPLOYMENTS: 3
  RUNTIME_DIR: "/var/lib/harbor"
  BIND_HOST: "127.0.0.1"
  BIND_PORT: 5080
  PUBLIC_BASE_URL: "http://127.0.0.1:5080"
  OIDC:
    ENABLED: true
    MODE: "embedded"
    ISSUER_PATH: "/_harbor/oidc"
    CLIENT_ID: "harbor-local"
    CLIENT_SECRET: "harbor-local-secret"
    SESSION_COOKIE_NAME: "harbor_session"
    SESSION_SECRET: "change-me"
    EMBEDDED_USERS:
      - USERNAME: "writer"
        DISPLAY_USERNAME: "Writer"
        PASSWORD: "writerpass"
        SUBJECT: "user-writer"
        NAME: "Writer User"
        EMAIL: "writer@example.test"
        ROLES:
          - "writer"
  PERMISSIONS:
    guest:
      - "schedule.read"
    writer:
      - "schedule.read"
      - "schedule.write"
  MAINTENANCE:
    ENABLED: false
    MESSAGE: "Harbor is under maintenance."
  WORKSPACE:
    ROOT_DIR: "/var/lib/harbor/workspaces"
    MAX_LEASES: 8
    DEFAULT_SIZE_MB: 256
  APPS:
    - ID: "schedule"
      NAME: "Harbor Schedule"
      DESCRIPTION: "A published calendar surface with guest reads, owner writes, and recurring events."
      SLUG: "schedule"
      SOURCE_DIR: "/srv/harbor/apps/harbor-schedule"
      # Or use CLONE_URL + BRANCH instead of SOURCE_DIR:
      # CLONE_URL: "https://git.peisongxiao.com/peisongxiao/harbor-schedule.git"
      # BRANCH: "master"
      BUILD_COMMAND:
        - "npm"
        - "run"
        - "build:harbor"
        - "--"
        - "--app-dir"
        - "{app_dir}"
      RUN_COMMAND:
        - "node"
        - "{app_dir}/server.cjs"
        - "--config"
        - "{config_path}"
      CONFIG_PATH: "/var/lib/harbor/config/schedule.yml"
      PUBLIC_BIND_ADDR: "127.0.0.1:19092"
      MANAGEMENT_SOCKET_PATH: "/var/lib/harbor/run/schedule.sock"
      GUEST_CAN_VIEW: true
      READ_PERMISSIONS:
        - "schedule.read"
      WRITE_PERMISSIONS:
        - "schedule.write"
    - ID: "whiteboard"
      NAME: "Whiteboard"
      DESCRIPTION: "A docked whiteboard with guest local editing, private authenticated documents, and Harbor-backed MCP."
      SOURCE_DIR: "/srv/harbor/apps/whiteboard"
      SLUG: "whiteboard"
      BUILD_COMMAND:
        - "npm"
        - "run"
        - "build:harbor"
        - "--"
        - "--app-dir"
        - "{app_dir}"
      RUN_COMMAND:
        - "node"
        - "{app_dir}/server.cjs"
        - "--config"
        - "{config_path}"
      CONFIG_PATH: "/var/lib/harbor/config/whiteboard.yml"
      PUBLIC_BIND_ADDR: "127.0.0.1:19094"
      MANAGEMENT_SOCKET_PATH: "/var/lib/harbor/run/whiteboard.sock"
      GUEST_CAN_VIEW: true
      READ_PERMISSIONS: []
      WRITE_PERMISSIONS: []
