# Production lab_hosts seed — points at the real rn-lab-host-01 VM instead of Phase 1's dev
# Unix socket. Same mechanism the Provisioner has had since Phase 1
# (platform/provisioner/config/lab-hosts.seed.yaml), just pointed at real remote endpoints.
#
# Phase 4.1 correction: routing_mode/router_endpoint is REQUIRED here — Phase 4's original
# claim that "no application code changes required" was true for the Provisioner's CONTROL
# plane (Docker mTLS) but false for the Gateway's DATA plane, which used to assume
# env.internal_ip was directly reachable. It is not, across two real VMs. See
# docs/PHASE4_1_PREPRODUCTION_HARDENING.md §1 and docs/PRODUCTION_NETWORK_SECURITY.md.
#
# {{ lab_host_ip }} is an Ansible template variable — see infra/ansible/group_vars/production.yml.
# Rendered by the `platform` role; the raw file here keeps the placeholder for readability.

lab_hosts:
  - lab_host_id: labhost-01
    display_name: "RootNode Lab Host VM 01 (production)"
    # CONTROL plane: Provisioner -> dockerd, mTLS, port 2376.
    endpoint: "tcp://{{ lab_host_ip }}:2376"
    tls_ca_path: /etc/rootnode/docker-tls/ca.pem
    tls_cert_path: /etc/rootnode/docker-tls/provisioner-client-cert.pem
    tls_key_path: /etc/rootnode/docker-tls/provisioner-client-key.pem
    enabled: true
    # DATA plane: Gateway -> Lab Host Router, mTLS, router's own port (8443 by default —
    # infra/docker/lab-host/docker-compose.production.yml). Gateway never touches a
    # Docker-internal address once routing_mode is 'router'.
    routing_mode: router
    router_endpoint: "https://{{ lab_host_ip }}:8443"