# Each Discourse install gets its own [[discourse]] block.
# Only `name` and `baseurl` are required; everything else is optional but
# unlocks more functionality (admin commands need apikey/api_username, SSH
# rebuilds need ssh_host, filtering needs tags, changelog posting needs
# changelog_topic_id).
#
# Where dsc looks for this file (first match wins):
#   1. --config <path> / -c flag
#   2. $DSC_CONFIG env var  (full path to a dsc.toml; errors if missing)
#   3. ./dsc.toml
#   4. $DSC_CONFIG_HOME/dsc.toml  (defaults to ~/.config/dsc/dsc.toml)
#   5. system locations ($XDG_CONFIG_DIRS, /etc/dsc/..., /usr/local/etc/...)
# Run `dsc config` to see which path is active and why.

[[discourse]]
name = "myforum"                                   # unique short name; used everywhere in the CLI
fullname = "My Forum"                              # Discourse site title (optional; display-only)
baseurl = "https://forum.example.com"              # base URL of the Discourse install
apikey = "your_api_key_here"                       # admin API key
api_username = "system"                            # API username the key acts as
ssh_host = "forum.example.com"                     # host used by `dsc update` over SSH (optional)
docker_rootless = false                             # true if `dsc harden` installed Docker rootless (optional)
tags = ["production", "uk"]                        # free-form tags; used by `--tags` filters (optional)
changelog_topic_id = 123                           # topic id to post rebuild changelogs into (optional)

[[discourse]]
name = "otherforum"
fullname = "Other Forum"
baseurl = "https://community.example.org"
apikey = "your_other_api_key_here"
api_username = "system"
ssh_host = "community.example.org"
tags = ["staging"]
changelog_topic_id = 456

# ---------------------------------------------------------------------------
# Defaults for `dsc harden`. Every key below is optional — what's shown is
# what dsc would use anyway. Override per-run with the corresponding flag,
# e.g. `--ssh-port 40022`.
# ---------------------------------------------------------------------------
# [harden]
# new_user                     = "discourse"
# ssh_port                     = 2227
#
# # Where the Docker installer is fetched from. Pin to a snapshot if you
# # want to vet the script before each run.
# docker_install_url           = "https://get.docker.com"
# docker_rootless              = true
#
# # Server posture
# swap_size_gb                 = 2          # 0 to skip
# journald_max_use             = "500M"
# timezone                     = "UTC"
# unattended_security_upgrades = true
# fail2ban                     = true
# mosh                         = false      # opt-in; opens UDP 60000-61000
#
# # SSH algorithm policy overlays (OpenSSH list modifiers), not full pinning.
# # Defaults keep upstream OpenSSH defaults, drop legacy algorithms, and
# # prefer PQ-hybrid key exchange first.
# # If you override these, validate with `sshd -t` and inspect `sshd -T`
# # before reload so mistakes fail loudly.
# # sshd_ciphers = "..."
# # sshd_kex     = "..."
# # sshd_macs    = "..."
#
# # Extra ufw `allow` rules applied after the standard set
# # (22, the new ssh_port, 25, 80, 443, and optionally MOSH UDP).
# # extra_ufw_allow = ["3000/tcp", "192.168.1.0/24"]
