1[server]
 2socket         = "/run/authsvc/http.sock"
 3metrics_listen = "127.0.0.1:9464"
 4domain_idp     = "idp.tug.portdistrict.net"
 5domain_account = "account.tug.portdistrict.net"
 6domain_admin   = "admin.tug.portdistrict.net"
 7admin_group    = "admins"
 8
 9[invite]
10ttl            = "168h"
11default_groups = ["members"]
12
13[session]
14ttl = "12h"
15
16# Userbase replication (spec §7.5, README section 9): create the repository, then uncomment and replace every value.
17# [userbase]
18# repo                  = "ssh://git@forge.example/owner/tug-userbase.git"
19# known_hosts           = "/var/lib/tug/userbase_known_hosts"
20# break_glass_recipient = "age1-REPLACE-with-the-operators-offline-recipient"
21
22# Configuration from a git repository (spec §7.4, README section 11): step 6 there uncomments this block.
23# [config]
24# source = "git"
25# [config.git]
26# remote          = "ssh://git@forge.example/owner/tug-config.git"
27# branch          = "main"
28# allowed_signers = "/etc/tug/allowed_signers"
29# known_hosts     = "/etc/tug/config_known_hosts"
30
31# Google sign-in (optional): deploy/README.md section 8 uncomments [google] and client_id.
32# [google]
33# client_id  = "….apps.googleusercontent.com"
34# allowed_hd = "example.org"    # a Google Workspace domain: only its accounts may sign in