# lab_hosts seed — applied to the DB at Provisioner startup (config.js applyLabHostsSeed), not
# managed via a runtime API (no host-management endpoints yet — see
# docs/PHASE1_PLATFORM_FOUNDATION.md §4, "don't overbuild scheduling yet").
#
# `endpoint`/`tls_*_path` — the Provisioner's CONTROL-plane connection to this host's Docker
# daemon (create/start/stop/remove containers). Unchanged since Phase 1.
#
# `routing_mode`/`router_endpoint` — Phase 4.1 addition, the Gateway's DATA-plane path to a
# running Lab on this host. See docs/PHASE4_1_PREPRODUCTION_HARDENING.md §1 and
# docs/PRODUCTION_NETWORK_SECURITY.md.
#   direct — Gateway reaches env.internal_ip:internal_port itself. Only correct when Gateway
#            and this lab_host's Docker daemon are on the same network namespace (dev,
#            single-host). This is the default and requires no router_endpoint.
#   router — Gateway reaches this lab_host's Lab Host Router (platform/lab-router) instead,
#            over mTLS, and never touches a Docker-internal address. Required once this
#            lab_host is a genuinely separate VM from the Gateway.

lab_hosts:
  - lab_host_id: dev-local
    display_name: "Local development Docker socket"
    endpoint: "unix:///var/run/docker.sock"
    enabled: true
    routing_mode: direct

  # Production example (not active — shown for reference; uncomment and fill in once a real
  # Lab Host VM exists). CONTROL plane: Provisioner -> dockerd, mTLS, port 2376. DATA plane:
  # Gateway -> Lab Host Router, mTLS, router's own port (infra default 8443) — see
  # infra/docker/lab-host/docker-compose.production.yml and infra/ansible/roles/lab-router.
  # - lab_host_id: labhost-01
  #   display_name: "RootNode Lab Host VM 01"
  #   endpoint: "tcp://10.20.30.5:2376"
  #   tls_ca_path: /etc/rootnode/tls/labhost-01/ca.pem
  #   tls_cert_path: /etc/rootnode/tls/labhost-01/cert.pem
  #   tls_key_path: /etc/rootnode/tls/labhost-01/key.pem
  #   enabled: true
  #   routing_mode: router
  #   router_endpoint: "https://10.20.30.5:8443"