{
  name           = "rustelo-htmx-server",
  workspace_id   = "example-pro",
  image_base     = "registry.ontoref.dev/ontoref.dev/rustelo-htmx-server",
  image_tag      = "latest",
  ctx_type       = 'leptos,
  domain         = "ontoref.dev",
  dns_zone       = "ontoref.dev",
  acme_email     = "jpl@ontoref.dev",
  namespace      = "example-pro",
  port           = 3000,
  component_type      = 'rustelo_website,
  leptos_output_name  = "website",

  data_pvc = {
    enabled       = true,
    size          = "2Gi",
    mount_path    = "/var/www",
    storage_class = "longhorn-retain",
  },

  requires = {
    storage              = { size = "2Gi", persistent = true },
    ports                = [{ port = 3000, exposure = 'public }],
    credentials          = ["SECRET_KEY", "DATABASE_URL"],
    dns_credential       = "dns-example-pro",
    registry_pull_secret = "registry-pull-secret",
  },

  provides = {
    service   = "website",
    port      = 3000,
    endpoints = ["https://ontoref.dev"],
  },

  operations = {
    install = true,
    update  = true,
    delete  = true,
    health  = true,
  },

  context = {
    how = "K8s Deployment in namespace example-pro; image registry.ontoref.dev/ontoref.dev/website (Leptos SSR, port 3000); 2Gi Longhorn-retain PVC at /var/www for content; image pulled via registry-pull-secret secret; TLS via cluster-issuer + Cloudflare DNS-01 on zone ontoref.dev; public Gateway API route via workspace FIP.",
    why = "Primary personal website for ontoref.dev — portfolio, blog, CV. Rustelo/Leptos SSR.",
    priority = 'standard,
    security = {
      posture  = 'public,
      tls      = true,
      concerns = ["secret-key-rotation", "reg-pull-secret-rotation"],
    },
    supervision = {
      health_check = true,
      metrics      = false,
      alerts       = ["website-pod-not-ready"],
    },
    updates = {
      policy = 'pinned,
      holds  = ["homepage-smoke", "health-endpoint-smoke"],
    },
  },

  build_secrets = {
    # reg.librecloud.online's credential is SOPS-encrypted for libre-wuji's age
    # identity, daoreg's for libre-daoshi's — two different workspaces/keys.
    # secrets_base/key_file are PATH-style (`:`-separated candidates, lian-build
    # schema addition 2026-07-07): every push_credential in build_directives.ncl
    # uses this SAME combined search path, so each one just finds its own file
    # under whichever candidate has it and decrypts with whichever key matches
    # — no per-registry field needed. Placeholders patched by the justfile from
    # wuji_secrets_base:secrets_base / wuji_kage:daoshi_kage — never committed
    # as literal absolute paths.
    secrets_base = "SECRET_BASE_PLACEHOLDER",
    key_file     = "KEY_FILE_PLACEHOLDER",

    # reg.librecloud.online (primary write surface) — same path sibling sites
    # (jpl-website, cv-repo, libro-website) already use for this host.
    registry_push = "infra/libre-wuji/secrets/registry-push.sops.yaml",
    # daoreg.librecloud.online (replica) — CONFIRMED scoped to lamina/* only
    # (buildadm's ACL) via a live probe 2026-07-06; NOT verified for arbitrary
    # app pushes under ontoref.dev/*.
    registry_push_daoreg = "infra/libre-daoshi/secrets/registry-push.sops.yaml",
    sccache               = "infra/libre-daoshi/secrets/sccache.sops.yaml",
    cosign                = "infra/libre-daoshi/secrets/cosign.sops.yaml",
  },
}