[server]
socket         = "/run/authsvc/http.sock"
metrics_listen = "127.0.0.1:9464"
domain_idp     = "idp.tug.portdistrict.net"
domain_account = "account.tug.portdistrict.net"
domain_admin   = "admin.tug.portdistrict.net"
admin_group    = "admins"

[invite]
ttl            = "168h"
default_groups = ["members"]

[session]
ttl = "12h"

# Userbase replication (spec §7.5, README section 9): create the repository, then uncomment and replace every value.
# [userbase]
# repo                  = "ssh://git@forge.example/owner/tug-userbase.git"
# known_hosts           = "/var/lib/tug/userbase_known_hosts"
# break_glass_recipient = "age1-REPLACE-with-the-operators-offline-recipient"

# Configuration from a git repository (spec §7.4, README section 11): step 6 there uncomments this block.
# [config]
# source = "git"
# [config.git]
# remote          = "ssh://git@forge.example/owner/tug-config.git"
# branch          = "main"
# allowed_signers = "/etc/tug/allowed_signers"
# known_hosts     = "/etc/tug/config_known_hosts"

# Google sign-in (optional): deploy/README.md section 8 uncomments [google] and client_id.
# [google]
# client_id  = "….apps.googleusercontent.com"
# allowed_hd = "example.org"    # a Google Workspace domain: only its accounts may sign in